This target will process TCP three-way-handshake parallel in netfilter

context to protect either local or backend system. This target requires

connection tracking because sequence numbers need to be translated.

.TP

\fB\-\-mss\fP \fImaximum segment size\fP

Maximum segment size announced to clients. This must match the backend.

.TP

\fB\-\-wscale\fP \fIwindow scale\fP

Window scale announced to clients. This must match the backend.

.TP

\fB\-\-sack\-perm\fP

Pass client selective acknowledgement option to backend (will be disabled

if not present).

.TP

\fB\-\-timestamps\fP

Pass client timestamp option to backend (will be disabled if not present,

also needed for selective acknowledgement and window scaling).

.PP

Example:

.PP

Determine tcp options used by backend, from an external system

.IP

tcpdump -pni eth0 -c 1 'tcp[tcpflags] == (tcp-syn|tcp-ack)'

.br

    port 80 &

.br

telnet 192.0.2.42 80

.br

18:57:24.693307 IP 192.0.2.42.80 > 192.0.2.43.48757:

.br

    Flags [S.], seq 360414582, ack 788841994, win 14480,

.br

    options [mss 1460,sackOK,

.br

    TS val 1409056151 ecr 9690221,

.br

    nop,wscale 9],

.br

    length 0

.PP

Switch tcp_loose mode off, so conntrack will mark out\-of\-flow

packets as state INVALID.

.IP

echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose

.PP

Make SYN packets untracked

.IP

iptables \-t raw \-A PREROUTING \-i eth0 \-p tcp \-\-dport 80

    \-\-syn \-j CT \-\-notrack

.PP

Catch UNTRACKED (SYN packets) and INVALID (3WHS ACK packets) states

and send them to SYNPROXY. This rule will respond to SYN packets with

SYN+ACK syncookies, create ESTABLISHED for valid client response (3WHS ACK

packets) and drop incorrect cookies. Flags combinations not expected

during 3WHS will not match and continue (e.g. SYN+FIN, SYN+ACK).

.IP

iptables \-A INPUT \-i eth0 \-p tcp \-\-dport 80

    \-m state \-\-state UNTRACKED,INVALID \-j SYNPROXY

    \-\-sack\-perm \-\-timestamp \-\-mss 1460 \-\-wscale 9

.PP

Drop invalid packets, this will be out\-of\-flow packets that were not

matched by SYNPROXY.

.IP

iptables \-A INPUT \-i eth0 \-p tcp \-\-dport 80 \-m state \-\-state INVALID \-j DROP