From 702b543494e1c52782ed4f011f13f6085f4fbbf7 Mon Sep 17 00:00:00 2001 From: "Jose M. Guisado Gomez" Date: Mon, 30 Sep 2019 19:28:07 +0200 Subject: extensions: libxt_SYNPROXY: add xlate method This adds translation capabilities when encountering SYNPROXY inside iptables rules. Signed-off-by: Jose M. Guisado Gomez Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_SYNPROXY.txlate | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 extensions/libxt_SYNPROXY.txlate (limited to 'extensions/libxt_SYNPROXY.txlate') diff --git a/extensions/libxt_SYNPROXY.txlate b/extensions/libxt_SYNPROXY.txlate new file mode 100644 index 00000000..b3de2b2a --- /dev/null +++ b/extensions/libxt_SYNPROXY.txlate @@ -0,0 +1,2 @@ +iptables-translate -t mangle -A INPUT -i iifname -p tcp -m tcp --dport 80 -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 +nft add rule ip mangle INPUT iifname "iifname" tcp dport 80 ct state invalid,untracked counter synproxy sack-perm timestamp wscale 7 mss 1460 -- cgit v1.2.3