Middlebox systems that can enter a connection include a monitoring module to monitor information in a connection between a client and a server, a processor to determine that the connection is idle, a table configured to create a first entry for the client and a second entry for the server, where the entries are initialized using information gathered by the monitoring module, and a control module to redirect the connection between the client and server to the middlebox. Middlebox systems that can exit a connection include a processor to determine a mismatch between sequence numbers in a first connection to a client device and in a second connection to a server device. A network control module delays acknowledgment signals from the middlebox on a connection to decrease the degree of mismatch and establishes a direct connection between the client device and the server device when mismatch is zero.