User Tools
advanced-firewall
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| advanced-firewall [2026/07/21 15:20] – add TCP MSS Clamping pedro | advanced-firewall [2026/07/23 17:43] (current) – Condense, clarity for Enable TCP Syn Packets hogwild | ||
|---|---|---|---|
| Line 15: | Line 15: | ||
| **Limit communication to: **specifies the maximum number of requests per second to which the Firewall replies. | **Limit communication to: **specifies the maximum number of requests per second to which the Firewall replies. | ||
| - | Setting a limit is recommended to prevent DDoS attacks.\\ | + | Setting a limit is recommended to prevent DDoS attacks.\\ |
| - | **Enable TCP SYN cookies: | + | {{:: |
| - | It encodes information from the SYN packet into the (SYN/ACK) response. | + | \\ **Enable TCP SYN cookies: |
| + | |||
| + | This uses a standard method for preventing SYN floods. | ||
| \\ | \\ | ||
| Line 29: | Line 31: | ||
| **Allow DHCP Spoofing: **makes FreshTomato accept/ | **Allow DHCP Spoofing: **makes FreshTomato accept/ | ||
| - | Such behaviour is often categorized as a DHCP spoofing attack, but rarely, might be legitimate. Using this lowers security.\\ \\ | + | Such behaviour is often categorized as a DHCP spoofing attack, but rarely, might be legitimate. Using this lowers security. |
| - | **Smart MTU black hole detection: | + | |
| - | For details on MTU and black holes, see this blog post: [[https:// | + | **Smart MTU black hole detection: |
| + | |||
| + | For details on MTU and black holes, see this blog post: [[https:// | ||
| + | |||
| + | \\ | ||
| **TCP MSS Clamping:** | **TCP MSS Clamping:** | ||
| - | TCP MSS Clamping | + | This adjusts the Maximum Segment Size of forwarded TCP connections on WAN and VPN interfaces to match the discovered path MTU. |
| - | This helps avoid MTU-related connection problems, especially on PPPoE links, VPN tunnels, IPv6 tunnels, or networks | + | This helps avoid MTU-related connection problems, especially on PPPoE links, VPN tunnels, IPv6 tunnels, or networks |
| Disabling this option reduces the number of firewall rules and may slightly improve performance on low-end routers, but can cause connection stalls or TLS handshake timeouts on links with reduced MTU. | Disabling this option reduces the number of firewall rules and may slightly improve performance on low-end routers, but can cause connection stalls or TLS handshake timeouts on links with reduced MTU. | ||
| - | Recommended setting: enabled, unless MTU/MSS is handled manually or the network | + | Recommended setting: enabled, unless MTU/MSS is handled manually or the network |
| ===== NAT ===== | ===== NAT ===== | ||
advanced-firewall.1784643637.txt.gz · Last modified: by pedro
Page Tools
