gated0/pve_toss_notes
Archived
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

更新 TS 测试配置

Browse Source
This commit is contained in:
CallMeR
2023-12-01 18:54:38 +08:00
parent 891d8ef2f6
commit 29f6296a1c
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+4 -3
View File
@@ -26,7 +26,6 @@ table inet router {
type filter hook input priority filter; policy drop;
iifname "lo" accept comment "defconf: accept traffic from loopback"
ct state established,related accept comment "defconf: allow inbound established and related flows"
ct state invalid counter drop comment "defconf: drop input flows with invalid conntrack state"
tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
@@ -36,7 +35,6 @@ table inet router {
type filter hook forward priority filter; policy drop;
meta l4proto { tcp, udp } flow offload @ft comment "defconf: track forwarded flows"
ct state established,related accept comment "defconf: allow forwarded established and related flows"
ct state invalid counter drop comment "defconf: drop forward flows with invalid conntrack state"
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
}
@@ -45,7 +43,6 @@ table inet router {
type filter hook output priority filter; policy accept;
oifname "lo" accept comment "defconf: accept traffic towards loopback"
ct state established,related accept comment "defconf: allow outbound established and related flows"
ct state invalid counter drop comment "defconf: drop output flows with invalid conntrack state"
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
}
@@ -53,6 +50,7 @@ table inet router {
chain prerouting {
type filter hook prerouting priority filter; policy accept;
iifname "eth0" jump helper_lan comment "defconf: handle LAN IPv4 / IPv6 helper assignment"
iifname "tailscale0" jump helper_tailscale comment "tsconf: handle TS IPv4 / IPv6 helper assignment"
}
chain syn_flood {
@@ -101,6 +99,9 @@ table inet router {
counter jump accept_to_tailscale
}
chain helper_tailscale {
}
chain accept_from_tailscale {
iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic"
}