The flowtables mechanism has a timeout for each flow, like the connection tracking system.
If it expires (=if no packets are seen for NF_FLOW_TIMEOUT (30) seconds, which is the default timeout value), a garbage collector removes that entry from the flowable.
Thus, the remaining packets are thereby thrown back to the classic forwarding path and to connection tracking, which then re-starts its own timeout mechanism.
You can change the timeout individually for TCP and for UDP protocol by using one of the following sysctl's, which effectively change the used timeout for all offloaded flows in the current network namespace:
vyos@r4# sudo sysctl -a -r nf_flowtable net.netfilter.nf_flowtable_tcp_timeout = 30 net.netfilter.nf_flowtable_udp_timeout = 30 [edit] vyos@r4#
Needs to think about the CLI option. It is a tag node now:
vyos@r4# set firewall flowtable Possible completions: > <text> Flowtable >