Re: Is there a way to extend the timeout of elements in an nftables set?

Cyrus <[email protected]> Sat, 11 Oct 2025 19:26:07 +0200
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <CAEcyiz_MVC+FK011gjT7=tq1Sn1ZWUjq4wfwRyxC0Xs33qp_jw@mail.gmail.com>
Thanks Florian. I was able to get this to work on Ubuntu 24.04 but not
on Ubuntu 22.04 so it looks like something changed between nft v1.0.2
and v1.0.9. Although, interestingly, the command didn't fail on
v1.0.2, it just didn't reset the timeout.

Anyway, I now have a couple more questions:

* What is the point of the timeout flag in those `nft add element`
commands? Having both a timeout flag and an expires flag seems
redundant.
* Woudn't it make more sense if the expires value defaulted to the
timeout of the set if it isn't explicitly set on the add element call?
Otherwise, an application like dnsmasq now has to be configured with
this value or figure it out somehow.