I have implemented a simple SYNPROXY iptables target. It is much like the SYNPROXY implementation in pf of OpenBSD, but won't have state until the first connection is established with the help of syncookies. The code is hosted at github: http://github.com/xiaosuo/xiaosuo/tree/master/synproxy/ Currently, it can work with firewall and local socket. It is in the very early stage, and ugly. And I will add --timeout parameter to this target as TCP_DFER_ACCEPT, so I can do NAT basing on the request data. i.e. iptables -t nat -A OUTPUT -p tcp -m synproxy --http-url "*.jpg" -j DNAT --to-destination $image_http_server:80 And is there any chance to merge it into mainline? -- Regards， Changli Gao(xiaosuo@xxxxxxxxx) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
