Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    TCP Fast Open (TFO) Support

    Scheduled Pinned Locked Moved General pfSense Questions
    6 Posts 4 Posters 818 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      Exocomp
      last edited by

      Does pfSense support TCP Fast Open? Basically it is a performance optimization to TCP to save a round trip (initial 3 way hand shake).

      More info here: https://tools.ietf.org/html/rfc7413

      I would be using it for a case where I setup a port forward, traffic going to pfSense and then pfSense sending the traffic node behind pfSense. So both incoming and outgoing connections are at play.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        In a port forward the TCP session is not terminated in pfSense so it would not have to support it explicitly. The only issue I could see there would be pf rejecting the TCP state if the packets are flagged incorrectly. However it doesn't appear that they are so I imagine it might just work with no changes. If it does see that traffic as out of state for TCP you can add firewall rules to pass it anyway. As shown here but obviously a different cause:
        https://docs.netgate.com/pfsense/en/latest/firewall/troubleshooting-blocked-log-entries-due-to-asymmetric-routing.html?highlight=sloppy#manual-fix

        Steve

        1 Reply Last reply Reply Quote 0
        • M
          marnog
          last edited by

          still not implement TFO in pfsense ?

          Many apps now use TFO

          thank you

          Kin d Regards

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Nothing has changed in 5 years there. TCP connections are still not terminated in the router/firewall so the TCP session, and therefore what has to support TFO, is between the client and server.
            pfSense still doesn't need to support this.

            M 1 Reply Last reply Reply Quote 1
            • M
              marnog @stephenw10
              last edited by

              @stephenw10

              Thank you for the quick response.

              Now many applicantions need TFO

              will be good time to put TFO in working orders.
              to now get the security risk. I think in Gob area and Datacenter will be a big issue of security now.

              Thank you

              Kind Regards

              M 1 Reply Last reply Reply Quote 0
              • M
                michmoor LAYER 8 Rebel Alliance @marnog
                last edited by

                @marnog
                HA proxy supports FastOpen but not sure if this fits into your design. Up to you.

                Firewall: NetGate,Palo Alto-VM,Juniper SRX
                Routing: Juniper, Arista, Cisco
                Switching: Juniper, Arista, Cisco
                Wireless: Unifi, Aruba IAP
                JNCIP,CCNP Enterprise

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.