diff --git a/07.PVE制作TS服务器.md b/07.PVE制作TS服务器.md
index 8cf6ccc..47f19e0 100644
--- a/07.PVE制作TS服务器.md
+++ b/07.PVE制作TS服务器.md
@@ -228,6 +228,9 @@ net.ipv4.conf.default.arp_ignore = 1
 net.ipv4.conf.all.rp_filter = 2
 net.ipv4.conf.default.rp_filter = 2
 
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
 net.ipv4.igmp_max_memberships = 256
 
 net.ipv4.route.error_burst = 500
diff --git a/src/debian/debian_ts_99_sysctl.conf b/src/debian/debian_ts_99_sysctl.conf
index 7a53e57..5e8e985 100644
--- a/src/debian/debian_ts_99_sysctl.conf
+++ b/src/debian/debian_ts_99_sysctl.conf
@@ -34,6 +34,9 @@ net.ipv4.conf.default.arp_ignore = 1
 net.ipv4.conf.all.rp_filter = 2
 net.ipv4.conf.default.rp_filter = 2
 
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
 net.ipv4.igmp_max_memberships = 256
 
 net.ipv4.route.error_burst = 500
diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 992be20..7f40a93 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -128,5 +128,20 @@ table inet router {
         meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
     }
 
+
+    #
+    # Mangle rules
+    #
+
+    chain mangle_postrouting {
+        type filter hook postrouting priority mangle; policy accept;
+        ct packets < 20 oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
+    }
+
+    chain mangle_forward {
+        type filter hook forward priority mangle; policy accept;
+        ct packets < 20 iifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
+    }
+
 }