UDP NAT Timeouts and How To Change Them On Linux

When I recently had problems keeping a UDP session alive over a NAT router I found out that my Raspberry Pi acting as the NAT router only keeps port mapping for the UDP session for 3 minutes. If there is no traffic during that time the mapping is discarded and all incoming packets afterward will no longer be delivered. While that's probably o.k. for most applications it didn't work for me. Fortunately it can be easily changed.

The following commands shows the current UDP session timers variables and their values:

sudo ls -l /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_*

sudo cat /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_*

On my Rasperry Pi I get 30 seconds for the initial timeout and and 180 seconds once the stream is established. The following command changes the timeout for new streams to 20 minutes:

sudo sysctl -w net.ipv4.netfilter.ip_conntrack_udp_timeout_stream=1200

And to find out which TCP and UDP streams are currently in the NAT translation table the following command can be used:

sudo cat  /proc/net/ip_conntrack

The second value in each line is the number of seconds remaining before the entry is removed if no further packets arrive that are part of the stream.

And for more details have a look here.