Don't expire connection limit sets

diff --git a/cookbooks/networking/templates/default/nftables.conf.erb b/cookbooks/networking/templates/default/nftables.conf.erb
index 325e7740a3c23c8e915a8fef8f899fc7e276fd39..7fc46cff29896c7045b03d83699763d12b786650 100644 (file)
--- a/cookbooks/networking/templates/default/nftables.conf.erb
+++ b/cookbooks/networking/templates/default/nftables.conf.erb
@@ -52,7 +52,9 @@ table inet filter {
     type ipv6_addr
 <%- end %>
     flags dynamic
+<%- unless set.start_with?("connlimit-") %>
     timeout 120s
+<%- end %>
   }
 
 <%- end %>