I am trying to configure the firewall at our company and I was wondering what a good default TCP connection timeout would be. We currently have it set for 10 minutes but I feel like this is too long but at the same time I am not really sure.

If anybody has any advice or knowledge on the subject it would be greatly appreciated.


This fully depends on the kind of applications you are running. If this is only simple web traffic then a timeout of a minute should already be sufficient. But, if you have long living TCP connections which can be idle for a long time and where the peers don't use TCP keep alive or similar to keep the connection open then even 10 minutes will be to short. Typical applications like this might be telnet or SSH sessions but also IMAP connections which expect the server to notify the client if new mails arrive can be idle for a long time.

Thus, know your network, know what kind of applications are in use and how they behave in the network and only then you can decide what an appropriate timeout will be. And unless your firewall exposes only basic functionality you could also have different timeouts based on the target port of the TCP connection and maybe dynamic adjustments of timeouts based on the number of currently tracked states, i.e. shorter timeouts when more states are open to keep the memory usage down.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.