TLS proxy - SSE channel timeouts

Question

We're using the TLS proxy to expose different services on different ports on port 443. Some of these services use an SSE channnel - that's a chunked connection style event stream that stays up forever. If we bypass the TLS proxy, the connection does stay up indefinitely. Through the proxy, the browser reports an

net::ERR_INCOMPLETE_CHUNKED_ENCODING

after 2 minutes.

And I think why - our config files contain the idleTimeout parameter set to 120. The sample config states the default value is 120. Is there any value that would disable the timeout? Or what is the max value that can be set?

here's the tail end of such an SSE connection - there's a keepalive message from server to client every 15 seconds until the connection gets closed.

2025-06-11 07:00:30.557 [DBG] Tunnel(52226)[#0
'audm-443-127.0.0.1:8189'][-]: Forwarding 20 bytes (IN <== OUT).
2025-06-11 07:00:30.557 [VRB] Tunnel(52226)[#0
'audm-443-127.0.0.1:8189'][-]: IN <== OUT 0000
|66-0D-0A-3A-20-4B-45-45 50-41-4C-49-56-45-0D-0A| f..: KEEPALIVE..
0010 |0D-0A-0D-0A | .... 2025-06-11
07:00:30.557 [VRB] Tunnel(52226)[#0 'audm-443-127.0.0.1:8189'][I]:
Sent TLS packet: 0000 |17-03-03-00-14-66-0D-0A
3A-20-4B-45-45-50-41-4C| .....f..: KEEPAL 0010
|49-56-45-0D-0A-0D-0A-0D 0A | IVE...... 2025-06-11
07:00:45.559 [VRB] Tunnel(52226)[#0 'audm-443-127.0.0.1:8189'][O]:
Received TLS packet: 0000 |17-03-03-00-14-66-0D-0A
3A-20-4B-45-45-50-41-4C| .....f..: KEEPAL 0010
|49-56-45-0D-0A-0D-0A-0D 0A | IVE...... 2025-06-11
07:00:45.559 [DBG] Tunnel(52226)[#0 'audm-443-127.0.0.1:8189'][-]:
Forwarding 20 bytes (IN <== OUT). 2025-06-11 07:00:45.559 [VRB]
Tunnel(52226)[#0 'audm-443-127.0.0.1:8189'][-]: IN <== OUT 0000
|66-0D-0A-3A-20-4B-45-45 50-41-4C-49-56-45-0D-0A| f..: KEEPALIVE..
0010 |0D-0A-0D-0A | .... 2025-06-11
07:00:45.559 [VRB] Tunnel(52226)[#0 'audm-443-127.0.0.1:8189'][I]:
Sent TLS packet: 0000 |17-03-03-00-14-66-0D-0A
3A-20-4B-45-45-50-41-4C| .....f..: KEEPAL 0010
|49-56-45-0D-0A-0D-0A-0D 0A | IVE...... 2025-06-11
07:00:54.830 [DBG] Tunnel(52227)[#0 'audm-443-127.0.0.1:8189'][I]: TLS
socket was closed, 0 bytes of data were received. 2025-06-11
07:00:54.830 [DBG] Tunnel(52227)[#0 'audm-443-127.0.0.1:8189'][-]:
Forwarding from inbound tunnel finished (IN ==> OUT). 2025-06-11
07:00:54.830 [DBG] Tunnel(52227)[#0 'audm-443-127.0.0.1:8189'][-]:
Closing tunnel from 192.168.201.138:51163. 2025-06-11 07:00:54.830
[DBG] Tunnel(52227)[#0 'audm-443-127.0.0.1:8189'][O]:
Alert:CloseNotify was sent. 2025-06-11 07:00:54.830 [VRB]
Tunnel(52227)[#0 'audm-443-127.0.0.1:8189'][O]: Sent TLS packet: .
0000 |15-03-03-00-02-01-00 | .......
2025-06-11 07:00:54.831 [DBG] Tunnel(52227)[#0
'audm-443-127.0.0.1:8189'][O]: TLS socket was closed, 0 bytes of data
were received. 2025-06-11 07:00:54.832 [DBG] Tunnel(52227)[#0
'audm-443-127.0.0.1:8189'][-]: Forwarding from outbound tunnel
finished (IN <== OUT). 2025-06-11 07:00:54.832 [INF] Tunnel(52227)[#0
'audm-443-127.0.0.1:8189'][-]: Tunnel from 192.168.201.138:51163
closed. 2025-06-11 07:01:00.560 [VRB] Tunnel(52226)[#0
'audm-443-127.0.0.1:8189'][O]: Received TLS packet: 0000
|17-03-03-00-14-66-0D-0A 3A-20-4B-45-45-50-41-4C| .....f..: KEEPAL
0010 |49-56-45-0D-0A-0D-0A-0D 0A | IVE......
2025-06-11 07:01:00.560 [DBG] Tunnel(52226)[#0
'audm-443-127.0.0.1:8189'][-]: Forwarding 20 bytes (IN <== OUT).
2025-06-11 07:01:00.560 [VRB] Tunnel(52226)[#0
'audm-443-127.0.0.1:8189'][-]: IN <== OUT 0000
|66-0D-0A-3A-20-4B-45-45 50-41-4C-49-56-45-0D-0A| f..: KEEPALIVE..
0010 |0D-0A-0D-0A | .... 2025-06-11
07:01:00.560 [VRB] Tunnel(52226)[#0 'audm-443-127.0.0.1:8189'][I]:
Sent TLS packet: 0000 |17-03-03-00-14-66-0D-0A
3A-20-4B-45-45-50-41-4C| .....f..: KEEPAL 0010
|49-56-45-0D-0A-0D-0A-0D 0A | IVE...... 2025-06-11
07:01:00.779 [DBG] Tunnel(52226)[#0 'audm-443-127.0.0.1:8189'][I]:
Rebex.Net.TlsException: The operation was not completed within the
specified time limit. ---> System.TimeoutException: The operation has
timed out.

Answer 1

Currently the maximal value for idleTimeout is 2147483 which is 24 days, 20 hours, 31 minutes and 23 seconds.

If this not enough for you, we can add support for infinite timeout. Just let us know.

Comments

That should be more than enough - users have to login more frequent than that anyway. May I recommend that the allowed value range be mentioned in the sample config file though? Currently it only states what the parameter is for and its default value - there's nothing about minimum value (seems 0 results in 120) and maximum value you just posted.

If at some point it seems convenient to make 0 => infinite, I wouldn't balk at that though ;)

---

Yes, it is omission that valid values are not documented. I will update it.

Yes, I have zero value in mind for infinite timeout as well. So, I will add it as well.