Add firewall synproxy.
It is helpful to protect against TCP SYN flood attacks and port-scanners
The SYNPROXY target allows you to intercept TCP connections and
establish them using syncookies before passing them on to the
server. This allows to avoid conntrack and server resource usage
during SYN-flood attacks.
Can be used for `input` or `forward`
```
table ip anon_synproxy_demo {
chain PRE {
type filter hook prerouting priority raw; policy accept;
tcp dport 8888 tcp flags syn notrack
}
chain IN {
type filter hook input priority filter; policy accept;
tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
ct state invalid drop
}
}
```
It also requires the kernel `CONFIG_NFT_SYNPROXY=m`
```
vyos@r14# zcat /proc/config.gz | grep -i CONFIG_NFT_SYNPROXY
# CONFIG_NFT_SYNPROXY is not set
[edit]
vyos@r14#
```
Using synproxy requires disabling the conntrack loose tracking option
Also, because synproxy relies on syncookies and tcp timestamps, ensure these are enabled:
```
% echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose
% echo 1 > /proc/sys/net/ipv4/tcp_syncookies
% echo 1 > /proc/sys/net/ipv4/tcp_timestamps
```
Recommendation increase the conntrack hash size.
```
% echo 1000000 > /sys/module/nf_conntrack/parameters/hashsize
% /sbin/sysctl -w net/netfilter/nf_conntrack_max=2000000
```
https://wiki.nftables.org/wiki-nftables/index.php/Synproxy
https://git.netfilter.org/nftables/commit/?id=1188a69604c3df2a63daca9e735fdb535e8f6b63
https://github.com/torvalds/linux/blob/master/net/netfilter/nft_synproxy.c