# HAProxy responses SYN,ACK before RST when "tcp-request connection reject" is triggered

**URL:** <https://discourse.haproxy.org/t/haproxy-responses-syn-ack-before-rst-when-tcp-request-connection-reject-is-triggered/4980>\
**Category:** Help!\
**Created:** [March 19, 2020, 12:14pm UTC](https://discourse.haproxy.org/t/haproxy-responses-syn-ack-before-rst-when-tcp-request-connection-reject-is-triggered/4980 "2020-03-19T12:14:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Warkeeper](https://avatars.discourse-cdn.com/v4/letter/w/919ad9/32.png) [@Warkeeper](https://discourse.haproxy.org/u/Warkeeper)\
**Post date:** [March 19, 2020, 12:14pm UTC](https://discourse.haproxy.org/t/haproxy-responses-syn-ack-before-rst-when-tcp-request-connection-reject-is-triggered/4980/1 "2020-03-19T12:14:04Z")

</div>

Greetings all.

I’m using “tcp-request connection reject if site\_dead” to reject all tcp connection requests when backend has no available server.

But I found that when a client wants to establish a connection to a server (reject event is triggered,so backend is all down) behind HAProxy (technically,it’s client sending SYN package to HAProxy),the client receives SYN,ACK first,then receives the RST after client send ACK.

So I wonder if there is anyway to make HAProxy reject the connection request as soon as it receives SYN? (instead of establish tcp connection first then send RST)

Here is what I captured by Wireshark

 ![HAProxy](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/7/7c4baff828d216aba23a4e339e4395a69496e48c.png)

And part of my configuration as follows

```auto
backend magpie_backend_1
        mode tcp
        server magpie_server_1 X.X.X.X:39853 check

frontend magpie_frontend_1
        mode tcp
        bind 0.0.0.0:29853
        acl site_dead nbsrv(magpie_backend_1) lt 1
        tcp-request connection reject if site_dead
        default_backend magpie_backend_1

```

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [March 19, 2020, 4:58pm UTC](https://discourse.haproxy.org/t/haproxy-responses-syn-ack-before-rst-when-tcp-request-connection-reject-is-triggered/4980/2 "2020-03-19T16:58:15Z")

</div>

No, because the socket is only passed from the kernel to the application (haproxy) after the 3-way handshake.