Patent ID: 8191132

Claim:
A method in a computing system for proxying network traffic between a first node and a second node, comprising, in an intermediate node between the first node and the second node: in a stateful packet filter, for packets received from the first node and packets received from the second node: filtering packets not permissible under a set of policies; associating unfiltered packets with connections to which they belong; and passing unfiltered packets to a transport protocol stack; in the transport protocol stack: identifying a first subset of the unfiltered packets pertaining to a connection setup process between the first node and the second node; forwarding packets in the first subset directly to their destinations without acting as a proxy between the first node and the second node, wherein acting as a proxy comprises acknowledging one or more packets in the first subset; updating a status maintained for the connection between the first node and the second node upon detecting completion of the connection setup process; and proxying a second subset of the packets received from the packet filter to their destinations in response to updating the connection status, the packets in the second subset pertaining to the connection between the first node and the second node.