- transparent proxy (pf rdr) in IPv4 environment - support both tcp and udp - enable TCP_FASTOPEN, SO_REUSEPORT_LB, SO_REUSEADDR - sockopt:mark is mapped to SO_USER_COOKIE