table ip filter { ct timeout cttime { protocol tcp; l3proto ip policy = {established: 123, close: 12} } chain c { ct timeout set "cttime" } }