I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue.

Here is rule sample.

#syn proxy rule 
iptables -t raw -A PREROUTING -i eth1 -p tcp -m tcp --syn -j CT --notrack 
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i eth1 -m state --state INVALID -j DROP

#connlimit rule 
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp --syn -m connlimit --connlimit-above 100 -j DROP

Problem is that since syn packets (packet that open connection) can not go beyond syn proxy rule, they can not match connlimit. I am looking for alternative way to write connlimit so that it can work with synproxy.

  • An option is to use hashlimit beforehand in the raw table.
    – jofel
    Jan 23, 2015 at 11:02
  • I want to process synproxy first so that a spoofed ip doesnt match connlimit rule. Only solution I found so far that to put connlimit rule mangle/postrouting.
    – ibrahim
    Jan 23, 2015 at 13:10

1 Answer 1


I was using the same rule (synproxy on a bridge) but realized that the normal tcp request would not work, i.e., after implementing the synproxy rules ALL syn request got blocked. I have monitored with tcpdump. I wonder if your synproxy rules work as expected?

  • Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
    – ibrahim
    Feb 23, 2015 at 12:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .