I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue. Here is rule sample. I use bridge interfaces but I don't think it is related with my problem.#syn proxy rule iptables -t raw -A PREROUTING -i br0 -p tcp -m physdev --physdev-in enp3s0f0 -m tcp --syn -j CT --notrack iptables -t filter -A FORWARD -i br0 -p tcp -m physdev --physdev-in enp3s0f0 -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460iptables -t filter -A FORWARD -i br0 -m physdev --physdev-in enp3s0f0 -m state --state INVALID -j DROP#connlimit rule iptables -t filter -A FORWARD -i br0 -p tcp -m physdev --physdev-in enp3s0f0 -m tcp --syn -m connlimit --connlimit-above 100 -j DROPProblem is that since syn packets (packet that open connection) can not go beyond syn proxy rule, they can not match connlimit. I am looking for alternative way to write connlimit so that it can work with synproxy. 
How to use both syn proxy and connlimit rules with iptables?
rhel;iptables;firewall