Is there a way to extend the timeout of elements in an nftables set?

Cyrus <[email protected]> Sat, 11 Oct 2025 12:09:22 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <CAEcyiz83o-NK263Efj5xfGPuVMUqur7TT-RofZ-WkJirMzB9oA@mail.gmail.com>
With ipsets, the timeout of an element in a set gets extended each
time you `ipset add` it. However, that doesn't happen with nftables
(v1.1.1) sets - when you `nft add` an element, the timeout is set
initially but never subsequently updated. Is there another way to do
this that I'm missing?

Regardless, I think it's worth noting that the existing behavior makes
the `nftset` functionality of dnsmasq (where it automatically adds
select resolved IPs to nftables sets) unusable for me compared to its
equivalent `ipset` functionality.

Thanks,
Cyrus