I do some forwarding for ip proto 4 and 93 from my external interface to a server using DST-NAT.
The connections set the Unreplied flag if not in use anymore.
The strange issue is that connection counters, after counting down the set timeout will roll over at 0 and start counting up, without dropping the connections when reaching 0.
The result is that the connection stays there forever.
Tracking_counters.png
This happens for all protocols (ipencap, axip, gre) except TCP and mostly for UDP.
The issue is that for that specific IP pair, communication is not possible anymore.
Deleting the entry will return function to normal until that state is reached again.
Data flow using that pair does not update the counter to the timeout value.
Checked it on 6.25 and 6.27 (is is the same).
On 6.20 this seems to work properly.
Connections in the unreplied state time out and get removed from the connection tracking list.
The up counting appears only if that connection has traffic and need to stay up.
LE: It seems that setting tracking to “yes” instead of “auto” cures the issue.
Is this a correct behavior or a bug?