# Networking: Connection works, then fails after being idle — firewall/NAT idle timeout dropped the TCP session (use keepalive)

**Code:** `Idle connections silently dropped by firewall/NAT` · **Category:** Networking · **Seen on:** Linux, AWS, Networking

A connection that sat idle was forgotten by a firewall or NAT device, so the next packet gets reset or vanishes.

## Meaning

Stateful devices remove idle mappings after a timeout (often 60 s to 1 h; AWS NLB 350 s, Azure LB 4 min). Enable TCP keepalive with intervals shorter than that timeout, or application-level pings and reconnect logic, and lengthen the idle timeout where configurable.

## Common causes

- Firewall/NAT/load-balancer idle timeout shorter than the connection's idle time
- No TCP keepalive or app heartbeat
- Default Linux keepalive of 2 hours
- Database or SSH sessions left idle
- Connection pool keeping stale connections

## Quick fix

1. Lower `tcp_keepalive_time` below the device timeout
2. Add app-level ping/heartbeat
3. Validate pooled connections before use

## Detailed fix by platform

### Linux

1. `sudo sysctl -w net.ipv4.tcp_keepalive_time=240 net.ipv4.tcp_keepalive_intvl=30 net.ipv4.tcp_keepalive_probes=4`

## How to diagnose

1. **Failure** — After idle time?
2. **Keepalive** — Enabled and short enough?
3. **Device timeout** — Known?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/idle-connection-dropped-by-firewall-keepalive)