Idle connections silently dropped by firewall/NAT Networking Origin: Network OSI layer 4 · Transport Last updated 5 Nov 2026

Networking: Connection works, then fails after being idle — firewall/NAT idle timeout dropped the TCP session (use keepalive)

A connection that sat idle was forgotten by a firewall or NAT device, so the next packet gets reset or vanishes.

Exact message you may see connection dropped after idleidle timeout firewall TCP sessionNAT idle timeout connection resetConnection reset after idle periodenable TCP keepalive
Explore the map of this error Full error map →
Seen on: Linux AWS Networking

Meaning

Stateful devices remove idle mappings after a timeout (often 60 s to 1 h; AWS NLB 350 s, Azure LB 4 min). Enable TCP keepalive with intervals shorter than that timeout, or application-level pings and reconnect logic, and lengthen the idle timeout where configurable.

Common causes

  • Firewall/NAT/load-balancer idle timeout shorter than the connection's idle time
  • No TCP keepalive or app heartbeat
  • Default Linux keepalive of 2 hours
  • Database or SSH sessions left idle
  • Connection pool keeping stale connections

⚡ Quick fix

  1. Lower tcp_keepalive_time below the device timeout
  2. Add app-level ping/heartbeat
  3. Validate pooled connections before use

Detailed fix by platform

Linux

  1. sudo sysctl -w net.ipv4.tcp_keepalive_time=240 net.ipv4.tcp_keepalive_intvl=30 net.ipv4.tcp_keepalive_probes=4

How to diagnose

  1. Failure — After idle time?
  2. Keepalive — Enabled and short enough?
  3. Device timeout — Known?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

1005 — Cloudflare Error 1005: Access denied — The owner of this website has banned the autonomous system number (ASN) your IP address is in (Cloudflare)10051006 — Cloudflare Error 1006 / 1007 / 1008: Access denied — Your IP address has been banned (Cloudflare)10061012 — Cloudflare Error 1012: Access denied (Cloudflare)10121020 — Cloudflare Error 1020: Access Denied (Cloudflare)102040615 — Azure SQL: Cannot open server 'x' requested by the login. Client with IP address 'y' is not allowed to access the server (Error 40615) (Azure)40615client_loop: send disconnect: Broken pipe — client_loop: send disconnect: Broken pipe (SSH session drops when idle) (Linux)client_loop: send dis…ECONNRESET / Connection reset by peer on idle Redis connection — Redis: Error: read ECONNRESET / redis.exceptions.ConnectionError: Connection reset by peer after idle time (Redis)ECONNRESET / Connecti…iptables: No chain/target/match — driver failed programming external connectivity on endpoint: iptables: No chain/target/match by that name (Docker)iptables: No chain/ta…Idle conn…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.