From bdad4e046872e054ec7783b2f04b73a8a690a045 Mon Sep 17 00:00:00 2001
From: Viacheslav Hletenko <v.gletenko@vyos.io>
Date: Wed, 20 Sep 2023 11:46:42 +0000
Subject: T5217: Add firewall synproxy

Add ability to SYNPROXY connections
It is useful to protect against TCP SYN flood attacks and port-scanners

set firewall global-options syn-cookies 'enable'
set firewall ipv4 input filter rule 10 action 'synproxy'
set firewall ipv4 input filter rule 10 destination port '22'
set firewall ipv4 input filter rule 10 inbound-interface interface-name 'eth1'
set firewall ipv4 input filter rule 10 protocol 'tcp'
set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
---
 interface-definitions/include/firewall/common-rule-inet.xml.i | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'interface-definitions/include/firewall/common-rule-inet.xml.i')

diff --git a/interface-definitions/include/firewall/common-rule-inet.xml.i b/interface-definitions/include/firewall/common-rule-inet.xml.i
index e51dd0056..b04e40fa0 100644
--- a/interface-definitions/include/firewall/common-rule-inet.xml.i
+++ b/interface-definitions/include/firewall/common-rule-inet.xml.i
@@ -219,6 +219,7 @@
     </leafNode>
   </children>
 </node>
+#include <include/firewall/synproxy.xml.i>
 <node name="state">
   <properties>
     <help>Session state</help>
@@ -372,4 +373,4 @@
     </leafNode>
   </children>
 </node>
-<!-- include end -->
\ No newline at end of file
+<!-- include end -->
-- 
cgit v1.2.3