TCP Flags Filter

TCP SYN cookies filter is unavailable in gate mode, and the tcp_flags filter is intended to be used instead in this mode. That is a simple TCP rate-limiting filter that can be enabled as follows:

tcp_flags [syn | rst];

The filter supports the syn and rst attributes. It operates by rate-limiting all TCP segments that has carry the corresponding TCP flags (SYN or RST).

Example configuration:

tcp_flags syn : ratelimit=default_ratelimit;

Patch example:

tcp_flags/del rst;