scrub on $if reassemble tcp

     reassemble tcp
           Statefully normalizes TCP connections.  scrub reassemble tcp rules
           may not have the direction (in/out) specified.  reassemble tcp per-
           forms the following normalizations:

           ttl      Neither side of the connection is allowed to reduce their
                    IP TTL.  An attacker may send a packet such that it reach-
                    es the firewall, affects the firewall state, and expires
                    before reaching the destination host.  reassemble tcp will
                    raise the TTL of all packets back up to the highest value
                    seen on the connection.
           timeout modulation
                    Modern TCP stacks will send a timestamp on every TCP pack-
                    et and echo the other endpoint's timestamp back to them.
                    Many operating systems will merely start the timestamp at
                    zero when first booted, and increment it several times a
                    second.  The uptime of the host can be deduced by reading
                    the timestamp and multiplying by a constant.  Also observ-
                    ing several different timestamps can be used to count
                    hosts behind a NAT device.  And spoofing TCP packets into
                    a connection requires knowing or guessing valid times-
                    tamps.  Timestamps merely need to be monotonically in-
                    creasing and not derived off a guessable base time.
                    reassemble tcp will cause scrub to modulate the TCP times-
                    tamps with a random number.

More TCP scrubbing: Modulate TCP timestamps to frustrate NAT detection and prevent remote uptime guesses. New scrub option 'reassemble tcp'.

scrub on $tun_if random-id reassemble tcp