From 07d5ea174aca15f2c7c4350025052ae9b7abead3 Mon Sep 17 00:00:00 2001 From: CallMeR <9463297+callmer@user.noreply.gitee.com> Date: Tue, 28 Nov 2023 19:01:35 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20TS=20=E6=B5=8B=E8=AF=95?= =?UTF-8?q?=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 05.PVE制作虚拟机模板.md | 4 +- src/debian/debian_dns_99_sysctl.conf | 4 +- src/debian/debian_ts_20auto_upgrades.conf | 5 + .../debian_ts_50unattended_upgrades.conf | 178 ++++++++++++++++++ src/debian/debian_ts_99_sysctl.conf | 65 +++++++ src/debian/debian_ts_dnsmasq.conf | 45 +++++ src/debian/debian_ts_lo_network.conf | 125 ++++++++++++ src/debian/debian_ts_nftables.conf | 176 +++++++++++++++++ src/debian/debian_ts_resolv.conf | 15 ++ src/debian/debian_ts_server_modules.conf | 5 + 10 files changed, 618 insertions(+), 4 deletions(-) create mode 100644 src/debian/debian_ts_20auto_upgrades.conf create mode 100644 src/debian/debian_ts_50unattended_upgrades.conf create mode 100644 src/debian/debian_ts_99_sysctl.conf create mode 100644 src/debian/debian_ts_dnsmasq.conf create mode 100644 src/debian/debian_ts_lo_network.conf create mode 100644 src/debian/debian_ts_nftables.conf create mode 100644 src/debian/debian_ts_resolv.conf create mode 100644 src/debian/debian_ts_server_modules.conf diff --git a/05.PVE制作虚拟机模板.md b/05.PVE制作虚拟机模板.md index 4288e80..b1c5b10 100644 --- a/05.PVE制作虚拟机模板.md +++ b/05.PVE制作虚拟机模板.md @@ -182,8 +182,8 @@ $ sudo nvim /etc/sysctl.d/99-sysctl.conf 在配置文件末尾输入以下配置项，注意配置中间的空格。 ```bash -# This configuration file is customized by fox -# Optimize system parameters +# This configuration file is customized by fox, +# Optimize sysctl parameters for local DNS server. kernel.panic = 20 kernel.panic_on_oops = 1 diff --git a/src/debian/debian_dns_99_sysctl.conf b/src/debian/debian_dns_99_sysctl.conf index 53fe8a9..6c25a6b 100644 --- a/src/debian/debian_dns_99_sysctl.conf +++ b/src/debian/debian_dns_99_sysctl.conf @@ -1,5 +1,5 @@ -# This configuration file is customized by fox -# Optimize system parameters +# This configuration file is customized by fox, +# Optimize sysctl parameters for local DNS server. kernel.panic = 20 kernel.panic_on_oops = 1 diff --git a/src/debian/debian_ts_20auto_upgrades.conf b/src/debian/debian_ts_20auto_upgrades.conf new file mode 100644 index 0000000..0336ec6 --- /dev/null +++ b/src/debian/debian_ts_20auto_upgrades.conf @@ -0,0 +1,5 @@ +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Unattended-Upgrade "10"; +APT::Periodic::AutocleanInterval "1"; +APT::Periodic::CleanInterval "1"; + diff --git a/src/debian/debian_ts_50unattended_upgrades.conf b/src/debian/debian_ts_50unattended_upgrades.conf new file mode 100644 index 0000000..b010b3c --- /dev/null +++ b/src/debian/debian_ts_50unattended_upgrades.conf @@ -0,0 +1,178 @@ +// Unattended-Upgrade::Origins-Pattern controls which packages are +// upgraded. +// +// Lines below have the format "keyword=value,...". A +// package will be upgraded only if the values in its metadata match +// all the supplied keywords in a line. (In other words, omitted +// keywords are wild cards.) The keywords originate from the Release +// file, but several aliases are accepted. The accepted keywords are: +// a,archive,suite (eg, "stable") +// c,component (eg, "main", "contrib", "non-free") +// l,label (eg, "Debian", "Debian-Security") +// o,origin (eg, "Debian", "Unofficial Multimedia Packages") +// n,codename (eg, "jessie", "jessie-updates") +// site (eg, "http.debian.net") +// The available values on the system are printed by the command +// "apt-cache policy", and can be debugged by running +// "unattended-upgrades -d" and looking at the log file. +// +// Within lines unattended-upgrades allows 2 macros whose values are +// derived from /etc/debian_version: +// ${distro_id} Installed origin. +// ${distro_codename} Installed codename (eg, "buster") +Unattended-Upgrade::Origins-Pattern { + // Codename based matching: + // This will follow the migration of a release through different + // archives (e.g. from testing to stable and later oldstable). + // Software will be the latest available for the named release, + // but the Debian release itself will not be automatically upgraded. + "origin=Debian,codename=${distro_codename}-updates"; +// "origin=Debian,codename=${distro_codename}-proposed-updates"; + "origin=Debian,codename=${distro_codename},label=Debian"; + "origin=Debian,codename=${distro_codename},label=Debian-Security"; + "origin=Debian,codename=${distro_codename}-security,label=Debian-Security"; + "origin=Tailscale,codename=${distro_codename},label=Tailscale"; + + // Archive or Suite based matching: + // Note that this will silently match a different release after + // migration to the specified archive (e.g. testing becomes the + // new stable). +// "o=Debian,a=stable"; +// "o=Debian,a=stable-updates"; +// "o=Debian,a=proposed-updates"; +// "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports"; +}; + +// Python regular expressions, matching packages to exclude from upgrading +Unattended-Upgrade::Package-Blacklist { + // The following matches all packages starting with linux- +// "linux-"; + + // Use $ to explicitely define the end of a package name. Without + // the $, "libc6" would match all of them. +// "libc6$"; +// "libc6-dev$"; +// "libc6-i686$"; + + // Special characters need escaping +// "libstdc\+\+6$"; + + // The following matches packages like xen-system-amd64, xen-utils-4.1, + // xenstore-utils and libxenstore3.0 +// "(lib)?xen(store)?"; + + // For more information about Python regular expressions, see + // https://docs.python.org/3/howto/regex.html +}; + +// This option allows you to control if on a unclean dpkg exit +// unattended-upgrades will automatically run +// dpkg --force-confold --configure -a +// The default is true, to ensure updates keep getting installed +//Unattended-Upgrade::AutoFixInterruptedDpkg "true"; + +// Split the upgrade into the smallest possible chunks so that +// they can be interrupted with SIGTERM. This makes the upgrade +// a bit slower but it has the benefit that shutdown while a upgrade +// is running is possible (with a small delay) +//Unattended-Upgrade::MinimalSteps "true"; + +// Install all updates when the machine is shutting down +// instead of doing it in the background while the machine is running. +// This will (obviously) make shutdown slower. +// Unattended-upgrades increases logind's InhibitDelayMaxSec to 30s. +// This allows more time for unattended-upgrades to shut down gracefully +// or even install a few packages in InstallOnShutdown mode, but is still a +// big step back from the 30 minutes allowed for InstallOnShutdown previously. +// Users enabling InstallOnShutdown mode are advised to increase +// InhibitDelayMaxSec even further, possibly to 30 minutes. +//Unattended-Upgrade::InstallOnShutdown "false"; + +// Send email to this address for problems or packages upgrades +// If empty or unset then no email is sent, make sure that you +// have a working mail setup on your system. A package that provides +// 'mailx' must be installed. E.g. "user@example.com" +//Unattended-Upgrade::Mail ""; + +// Set this value to one of: +// "always", "only-on-error" or "on-change" +// If this is not set, then any legacy MailOnlyOnError (boolean) value +// is used to chose between "only-on-error" and "on-change" +//Unattended-Upgrade::MailReport "on-change"; + +// Remove unused automatically installed kernel-related packages +// (kernel images, kernel headers and kernel version locked tools). +//Unattended-Upgrade::Remove-Unused-Kernel-Packages "true"; + +// Do automatic removal of newly unused dependencies after the upgrade +//Unattended-Upgrade::Remove-New-Unused-Dependencies "true"; + +// Do automatic removal of unused packages after the upgrade +// (equivalent to apt-get autoremove) +//Unattended-Upgrade::Remove-Unused-Dependencies "false"; + +// Automatically reboot *WITHOUT CONFIRMATION* if +// the file /var/run/reboot-required is found after the upgrade +//Unattended-Upgrade::Automatic-Reboot "false"; + +// Automatically reboot even if there are users currently logged in +// when Unattended-Upgrade::Automatic-Reboot is set to true +//Unattended-Upgrade::Automatic-Reboot-WithUsers "true"; + +// If automatic reboot is enabled and needed, reboot at the specific +// time instead of immediately +// Default: "now" +//Unattended-Upgrade::Automatic-Reboot-Time "02:00"; + +// Use apt bandwidth limit feature, this example limits the download +// speed to 70kb/sec +//Acquire::http::Dl-Limit "70"; + +// Enable logging to syslog. Default is False +// Unattended-Upgrade::SyslogEnable "false"; + +// Specify syslog facility. Default is daemon +// Unattended-Upgrade::SyslogFacility "daemon"; + +// Download and install upgrades only on AC power +// (i.e. skip or gracefully stop updates on battery) +// Unattended-Upgrade::OnlyOnACPower "true"; + +// Download and install upgrades only on non-metered connection +// (i.e. skip or gracefully stop updates on a metered connection) +// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true"; + +// Verbose logging +// Unattended-Upgrade::Verbose "false"; + +// Print debugging information both in unattended-upgrades and +// in unattended-upgrade-shutdown +// Unattended-Upgrade::Debug "false"; + +// Allow package downgrade if Pin-Priority exceeds 1000 +// Unattended-Upgrade::Allow-downgrade "false"; + +// When APT fails to mark a package to be upgraded or installed try adjusting +// candidates of related packages to help APT's resolver in finding a solution +// where the package can be upgraded or installed. +// This is a workaround until APT's resolver is fixed to always find a +// solution if it exists. (See Debian bug #711128.) +// The fallback is enabled by default, except on Debian's sid release because +// uninstallable packages are frequent there. +// Disabling the fallback speeds up unattended-upgrades when there are +// uninstallable packages at the expense of rarely keeping back packages which +// could be upgraded or installed. +// Unattended-Upgrade::Allow-APT-Mark-Fallback "true"; + +Unattended-Upgrade::AutoFixInterruptedDpkg "true"; + +Unattended-Upgrade::Remove-Unused-Kernel-Packages "true"; + +Unattended-Upgrade::Remove-New-Unused-Dependencies "true"; + +Unattended-Upgrade::Remove-Unused-Dependencies "true"; + +Unattended-Upgrade::Automatic-Reboot "true"; + +Unattended-Upgrade::Automatic-Reboot-Time "03:00"; + diff --git a/src/debian/debian_ts_99_sysctl.conf b/src/debian/debian_ts_99_sysctl.conf new file mode 100644 index 0000000..347700a --- /dev/null +++ b/src/debian/debian_ts_99_sysctl.conf @@ -0,0 +1,65 @@ +# This configuration file is customized by fox, +# Optimize sysctl parameters for Linux Router. + +kernel.panic = 20 +kernel.panic_on_oops = 1 + +net.core.default_qdisc = fq_codel +net.ipv4.tcp_congestion_control = bbr + +net.ipv4.ip_forward = 1 + +net.ipv6.conf.all.forwarding = 1 +net.ipv6.conf.default.forwarding = 1 + +# Other adjustable system parameters + +net.core.netdev_budget = 600 +net.core.netdev_budget_usecs = 20000 + +net.core.rps_sock_flow_entries = 32768 + +net.ipv4.conf.all.accept_redirects = 0 +net.ipv4.conf.default.accept_redirects = 0 + +net.ipv4.conf.all.accept_source_route = 0 +net.ipv4.conf.default.accept_source_route = 0 + +net.ipv4.conf.all.arp_ignore = 1 +net.ipv4.conf.default.arp_ignore = 1 + +net.ipv4.conf.all.rp_filter = 2 +net.ipv4.conf.default.rp_filter = 2 + +net.ipv4.conf.all.log_martians = 1 + +net.ipv4.igmp_max_memberships = 256 + +net.ipv4.route.error_burst = 500 +net.ipv4.route.error_cost = 100 + +net.ipv4.route.redirect_load = 2 +net.ipv4.route.redirect_silence = 2048 + +net.ipv4.tcp_challenge_ack_limit = 1000 +net.ipv4.tcp_fin_timeout = 30 +net.ipv4.tcp_keepalive_time = 120 +net.ipv4.tcp_syncookies = 1 + +net.ipv6.conf.all.accept_ra = 0 +net.ipv6.conf.default.accept_ra = 0 + +net.ipv6.conf.all.accept_redirects = 0 +net.ipv6.conf.default.accept_redirects = 0 + +net.ipv6.conf.all.accept_source_route = 0 +net.ipv6.conf.default.accept_source_route = 0 + +net.ipv6.conf.all.use_tempaddr = 0 +net.ipv6.conf.default.use_tempaddr = 0 + +net.netfilter.nf_conntrack_acct = 1 +net.netfilter.nf_conntrack_tcp_timeout_established = 7440 +net.netfilter.nf_conntrack_udp_timeout = 60 +net.netfilter.nf_conntrack_udp_timeout_stream = 180 + diff --git a/src/debian/debian_ts_dnsmasq.conf b/src/debian/debian_ts_dnsmasq.conf new file mode 100644 index 0000000..1c58c5d --- /dev/null +++ b/src/debian/debian_ts_dnsmasq.conf @@ -0,0 +1,45 @@ +# This configuration file is customized by fox, +# Optimize dnsmasq parameters for local DNS server. + +# Main Config + +conf-dir=/etc/dnsmasq.d/,*.conf +conf-file=/etc/dnsmasq.conf + +log-facility=/var/log/dnsmasq.log +log-async=20 + +cache-size=1024 +edns-packet-max=1232 +rebind-domain-ok=/fox.home.arpa/ + +bind-dynamic +bogus-priv +domain-needed +localise-queries +local-service +no-hosts +no-negcache +rebind-localhost-ok +stop-dns-rebind + +# DNS Filter + +server=/alt/ +server=/home.arpa/ +server=/ipv4only.arpa/ +server=/resolver.arpa/ +server=/example/ +server=/bind/ +server=/invalid/ +server=/local/ +server=/localhost/ +server=/onion/ +server=/test/ + +# DNS Server + +server=/fox.home.arpa/172.16.1.1 +server=/ts.net/100.100.100.100 +server=172.16.1.1 + diff --git a/src/debian/debian_ts_lo_network.conf b/src/debian/debian_ts_lo_network.conf new file mode 100644 index 0000000..32e6dbe --- /dev/null +++ b/src/debian/debian_ts_lo_network.conf @@ -0,0 +1,125 @@ +# This configuration file is customized by fox, +# Optimize for lo network. + +[Match] +Name=lo + +# rfc6890 +[Route] +Destination=0.0.0.0/8 +Type=unreachable +[Route] +Destination=10.0.0.0/8 +Type=unreachable +[Route] +Destination=100.64.0.0/10 +Type=unreachable +[Route] +Destination=127.0.0.0/8 +Type=unreachable +[Route] +Destination=169.254.0.0/16 +Type=unreachable +[Route] +Destination=172.16.0.0/12 +Type=unreachable +[Route] +Destination=192.0.0.0/24 +Type=unreachable +[Route] +Destination=192.0.0.0/29 +Type=unreachable +[Route] +Destination=192.0.2.0/24 +Type=unreachable +[Route] +Destination=192.88.99.0/24 +Type=unreachable +[Route] +Destination=192.168.0.0/16 +Type=unreachable +[Route] +Destination=198.18.0.0/15 +Type=unreachable +[Route] +Destination=198.51.100.0/24 +Type=unreachable +[Route] +Destination=203.0.113.0/24 +Type=unreachable +[Route] +Destination=240.0.0.0/4 +Type=unreachable +[Route] +Destination=255.255.255.255/32 +Type=unreachable +[Route] +Destination=::1/128 +Type=unreachable +[Route] +Destination=::/128 +Type=unreachable +[Route] +Destination=64:ff9b::/96 +Type=unreachable +[Route] +Destination=::ffff:0:0/96 +Type=unreachable +[Route] +Destination=100::/64 +Type=unreachable +[Route] +Destination=2001::/23 +Type=unreachable +[Route] +Destination=2001::/32 +Type=unreachable +[Route] +Destination=2001:2::/48 +Type=unreachable +[Route] +Destination=2001:db8::/32 +Type=unreachable +[Route] +Destination=2001:20::/28 +Type=unreachable +[Route] +Destination=2002::/16 +Type=unreachable +[Route] +Destination=fc00::/7 +Type=unreachable +[Route] +Destination=fe80::/10 +Type=unreachable + +[Route] +Table=1024 +Destination=fc00::/7 +Type=throw +[Route] +Table=1024 +Destination=::/0 +Type=prohibit +[Route] +Table=1024 +Destination=10.0.0.0/10 +Type=throw +[Route] +Table=1024 +Destination=172.16.0.0/12 +Type=throw +[Route] +Table=1024 +Destination=192.168.0.0/16 +Type=throw +[Route] +Table=1024 +Destination=0.0.0.0/0 +Type=prohibit + +[RoutingPolicyRule] +Priority=10000 +From=fc00::/7 +Table=1024 + diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf new file mode 100644 index 0000000..ebadb0b --- /dev/null +++ b/src/debian/debian_ts_nftables.conf @@ -0,0 +1,176 @@ +#!/usr/sbin/nft -f + +# This configuration file is customized by fox, +# Optimize nftables rules for Linux Router. + +table inet router +flush table inet router + +table inet router { + # + # Flowtable + # + + flowtable ft { + hook ingress priority filter; + devices = { eth0 }; + counter; + } + + + # + # Filter rules + # + + chain input { + type filter hook input priority filter; policy drop; + iifname "lo" accept comment "defconf: accept traffic from loopback" + ct state established,related accept comment "defconf: allow inbound established and related flows" + ct state invalid counter drop comment "defconf: drop input flows with invalid conntrack state" + tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets" + iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" + iifname "tailscale0" jump input_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 input traffic" + } + + chain forward { + type filter hook forward priority filter; policy drop; + meta l4proto { tcp, udp } flow offload @ft comment "defconf: track forwarded flows" + ct state established,related accept comment "defconf: allow forwarded established and related flows" + ct state invalid counter drop comment "defconf: drop forward flows with invalid conntrack state" + iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" + iifname "tailscale0" jump forward_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 forward traffic" + } + + chain output { + type filter hook output priority filter; policy accept; + oifname "lo" accept comment "defconf: accept traffic towards loopback" + ct state established,related accept comment "defconf: allow outbound established and related flows" + ct state invalid counter drop comment "defconf: drop output flows with invalid conntrack state" + oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" + oifname "tailscale0" jump output_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 output traffic" + } + + chain prerouting { + type filter hook prerouting priority filter; policy accept; + iifname "eth0" jump helper_lan comment "defconf: handle LAN IPv4 / IPv6 helper assignment" + } + + chain syn_flood { + limit rate 200/second burst 100 packets return comment "defconf: accept SYN packets below rate-limit" + counter drop comment "defconf: drop excess packets" + } + + chain input_lan { + ct status dnat counter accept comment "lanconf: accept port redirect" + jump accept_from_lan + } + + chain forward_lan { + jump accept_to_tailscale comment "lanconf: accept Tailscale forward" + ct status dnat counter accept comment "lanconf: accept port forward" + jump accept_to_lan + } + + chain output_lan { + jump accept_to_lan + } + + chain helper_lan { + } + + chain accept_from_lan { + iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic" + } + + chain accept_to_lan { + meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NAT leakage" + oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic" + } + + chain input_tailscale { + jump accept_from_tailscale + } + + chain output_tailscale { + jump accept_to_tailscale + } + + chain forward_tailscale { + jump accept_to_lan comment "defconf: accept Tailscale to LAN forward" + jump accept_to_tailscale + } + + chain accept_from_tailscale { + iifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic" + } + + chain accept_to_tailscale { + oifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic" + } + + + # + # NAT rules + # + + chain dstnat { + type nat hook prerouting priority dstnat; policy accept; + iifname "eth0" meta l4proto { tcp, udp } th dport domain counter jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic" + } + + chain srcnat { + type nat hook postrouting priority srcnat; policy accept; + oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic" + } + + chain dstnat_lan { + meta nfproto ipv4 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: Lan IPv4 DNS redirect" + meta nfproto ipv6 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: Lan IPv6 DNS redirect" + } + + chain srcnat_lan { + meta nfproto ipv4 masquerade comment "defconf: masquerade IPv4 LAN traffic" + } + + + # + # Raw rules (notrack) + # + + chain raw_prerouting { + type filter hook prerouting priority raw; policy accept; + } + + chain raw_output { + type filter hook output priority raw; policy accept; + } + + + # + # Mangle rules + # + + chain mangle_prerouting { + type filter hook prerouting priority mangle; policy accept; + } + + chain mangle_postrouting { + type filter hook postrouting priority mangle; policy accept; + } + + chain mangle_input { + type filter hook input priority mangle; policy accept; + } + + chain mangle_output { + type route hook output priority mangle; policy accept; + } + + chain mangle_forward { + type filter hook forward priority mangle; policy accept; + iifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing" + oifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing" + } + +} + diff --git a/src/debian/debian_ts_resolv.conf b/src/debian/debian_ts_resolv.conf new file mode 100644 index 0000000..e0ad0ac --- /dev/null +++ b/src/debian/debian_ts_resolv.conf @@ -0,0 +1,15 @@ +# This configuration file is customized by fox, +# Optimize system resolve parameters for Linux Router. +# +# For use local domain, +# please modify 'search' parameter according to +# your network environment. +# +# eg: +# search fox.home.arpa + +nameserver 127.0.0.1 +nameserver 172.16.1.1 +options edns0 timeout:1 trust-ad +search fox.home.arpa + diff --git a/src/debian/debian_ts_server_modules.conf b/src/debian/debian_ts_server_modules.conf new file mode 100644 index 0000000..10a273f --- /dev/null +++ b/src/debian/debian_ts_server_modules.conf @@ -0,0 +1,5 @@ +# This configuration file is customized by fox, +# Optimize netfilter related modules at system boot. + +nf_conntrack +