Recently, I’ve been building a VPN server/client application. The server side runs on Ubuntu, and the client side runs on iOS (using Network Extension). The primary process is all IP packets tramsims from Client to Server through a TCP tunnel; when the VPN server gets the packets, it makes NTA to every packet (changing the source IP and the source port) and then sends these packets to the target server(IP forwarding) using a raw socket, VPN server does receive response packets from the target server, after that, it changes the source IP and source port to the origin on those packets and send them back through the tunnel to the Client, the problem is the Client seems doesn’t accept the response packet.

As the following picture I captured with Wireshark shows, the Client sends A TCP SYN packet to the Server(1027->80 port, an HTTP request), The HTTP Server responds with a SYN-ACK packet back, but the Client then sends the SYN packet again, the HTTP Server response again, after server times, the TCP connections finally established. Sometimes, tons of retransmissions happen in one TCP data transmission. The checksums and TTL have been checked, and they are all correct. What possible situation caused these retransmissions to happen?