table ip filter { ct timeout cttime { protocol tcp l3proto ip policy = { established : 123, close : 12 } } chain c { ct timeout set "cttime" } }