TCP Authentication Filter

The filter prevents unauthenticated traffic (mostly RST and ACK flood) from new TCP peers.

The filter allows TCP traffic only from previously seen (established) TCP connections.

Tempesta xFW automatically learns all active TCP flows, even when no rules are loaded. ACK and RST segments are allowed only if Tempesta xFW has seen the TCP handshake for the corresponding flow, or if it had already observed the flow before the filter was enabled.

All filter functionality is turned on with a single setting:

tcp_auth_filter;

The functionality can be turned off in a patch with a command:

tcp_auth_filter/del;

By default the filter is disabled.

PUSH flag isn’t accounted in statistics, but the filter protects from PUSH flood too.

This filter requires specifying a protected network.