How to use both syn proxy and connlimit rules with iptables?

Question

I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue.

Here is rule sample.

#syn proxy rule 
iptables -t raw -A PREROUTING -i eth1 -p tcp -m tcp --syn -j CT --notrack 
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i eth1 -m state --state INVALID -j DROP

#connlimit rule 
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp --syn -m connlimit --connlimit-above 100 -j DROP

Problem is that since syn packets (packet that open connection) can not go beyond syn proxy rule, they can not match connlimit. I am looking for alternative way to write connlimit so that it can work with synproxy.

Answer 1

I was using the same rule (synproxy on a bridge) but realized that the normal tcp request would not work, i.e., after implementing the synproxy rules ALL syn request got blocked. I have monitored with tcpdump. I wonder if your synproxy rules work as expected?