Re: Is there a way to extend the timeout of elements in an nftables set?
Cyrus <[email protected]> Sat, 11 Oct 2025 19:26:07 +0200
| Newsgroups | gmane.comp.security.firewalls.netfilter.general |
|---|---|
| Message-ID | <CAEcyiz_MVC+FK011gjT7=tq1Sn1ZWUjq4wfwRyxC0Xs33qp_jw@mail.gmail.com> |
Thanks Florian. I was able to get this to work on Ubuntu 24.04 but not on Ubuntu 22.04 so it looks like something changed between nft v1.0.2 and v1.0.9. Although, interestingly, the command didn't fail on v1.0.2, it just didn't reset the timeout. Anyway, I now have a couple more questions: * What is the point of the timeout flag in those `nft add element` commands? Having both a timeout flag and an expires flag seems redundant. * Woudn't it make more sense if the expires value defaulted to the timeout of the set if it isn't explicitly set on the add element call? Otherwise, an application like dnsmasq now has to be configured with this value or figure it out somehow.