netfilter/iptables synproxy; need help deciding