conntrack, idle TCP connection and keep-alives

[WGH <wgh@torlan.ru>]

Hello!

It seems that, when masquerading, conntrack silently drops idle
connection after nf_conntrack_tcp_timeout_established seconds. This's
pretty terrible, as application inside the network, if it never sends
anything, will never know that connection was dropped.

RFC 5382 gives us a solution to this:
> A NAT can check if an endpoint for a session has crashed by sending a
> TCP keep-alive packet and receiving a TCP RST packet in response.

However, it I couldn't find such feature in netfilter. It would be
pretty nice to have.

It would be much more effective than enabling keep-alives system-wide
(which is not even possible in practice). It makes sense that NAT has to
manage such things, as only NAT knows the timeouts of itself. If there's
a NAT along the route, it will send keep-alives (overhead, but
inevitable). If there's no NATs, there will be no keep-alives. Simple.

AFAIK, Cisco implements this under name Dead Connection Detection.