diff --git a/envoy/config/accesslog/v3/accesslog.proto b/envoy/config/accesslog/v3/accesslog.proto
index e9d815aa..54fa1390 100644
--- a/envoy/config/accesslog/v3/accesslog.proto
+++ b/envoy/config/accesslog/v3/accesslog.proto
@@ -254,6 +254,7 @@ message ResponseFlagFilter {
         in: "UMSDR"
         in: "RFCF"
         in: "NFCF"
+        in: "DT"
       }
     }
   }];
diff --git a/envoy/config/accesslog/v4alpha/accesslog.proto b/envoy/config/accesslog/v4alpha/accesslog.proto
index bd4bcd48..a94f6d52 100644
--- a/envoy/config/accesslog/v4alpha/accesslog.proto
+++ b/envoy/config/accesslog/v4alpha/accesslog.proto
@@ -253,6 +253,7 @@ message ResponseFlagFilter {
         in: "UMSDR"
         in: "RFCF"
         in: "NFCF"
+        in: "DT"
       }
     }
   }];
diff --git a/envoy/data/accesslog/v3/accesslog.proto b/envoy/data/accesslog/v3/accesslog.proto
index c16b5be1..af7edab5 100644
--- a/envoy/data/accesslog/v3/accesslog.proto
+++ b/envoy/data/accesslog/v3/accesslog.proto
@@ -186,7 +186,7 @@ message AccessLogCommon {
 }
 
 // Flags indicating occurrences during request/response processing.
-// [#next-free-field: 23]
+// [#next-free-field: 24]
 message ResponseFlags {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.data.accesslog.v2.ResponseFlags";
@@ -272,6 +272,9 @@ message ResponseFlags {
 
   // Indicates that a filter configuration is not available.
   bool no_filter_config_found = 22;
+
+  // Indicates that request or connection exceeded the downstream connection duration.
+  bool duration_timeout = 23;
 }
 
 // Properties of a negotiated TLS connection.
diff --git a/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto b/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto
index 3d305cad..46716090 100644
--- a/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto
+++ b/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto
@@ -22,7 +22,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // TCP Proxy :ref:`configuration overview <config_network_filters_tcp_proxy>`.
 // [#extension: envoy.filters.network.tcp_proxy]
 
-// [#next-free-field: 13]
+// [#next-free-field: 14]
 message TcpProxy {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.network.tcp_proxy.v2.TcpProxy";
@@ -134,4 +134,10 @@ message TcpProxy {
   // payloads over a shared HTTP/2 tunnel. If this message is absent, the payload
   // will be proxied upstream as per usual.
   TunnelingConfig tunneling_config = 12;
+
+  // The maximum duration of a connection. The duration is defined as the period since a connection
+  // was established. If not set, there is no max duration. When max_downstream_connection_duration
+  // is reached the connection will be closed. Duration must be at least 1ms.
+  google.protobuf.Duration max_downstream_connection_duration = 13
+      [(validate.rules).duration = {gte {nanos: 1000000}}];
 }
diff --git a/envoy/extensions/filters/network/tcp_proxy/v4alpha/tcp_proxy.proto b/envoy/extensions/filters/network/tcp_proxy/v4alpha/tcp_proxy.proto
index 1857f2ab..eafc3234 100644
--- a/envoy/extensions/filters/network/tcp_proxy/v4alpha/tcp_proxy.proto
+++ b/envoy/extensions/filters/network/tcp_proxy/v4alpha/tcp_proxy.proto
@@ -22,7 +22,7 @@ option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSIO
 // TCP Proxy :ref:`configuration overview <config_network_filters_tcp_proxy>`.
 // [#extension: envoy.filters.network.tcp_proxy]
 
-// [#next-free-field: 13]
+// [#next-free-field: 14]
 message TcpProxy {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy";
@@ -134,4 +134,10 @@ message TcpProxy {
   // payloads over a shared HTTP/2 tunnel. If this message is absent, the payload
   // will be proxied upstream as per usual.
   TunnelingConfig tunneling_config = 12;
+
+  // The maximum duration of a connection. The duration is defined as the period since a connection
+  // was established. If not set, there is no max duration. When max_downstream_connection_duration
+  // is reached the connection will be closed. Duration must be at least 1ms.
+  google.protobuf.Duration max_downstream_connection_duration = 13
+      [(validate.rules).duration = {gte {nanos: 1000000}}];
 }