From 2c22ba9212df932c6c20a3082a26000b78a00d3e Mon Sep 17 00:00:00 2001
From: CallMeR <9463297+callmer@user.noreply.gitee.com>
Date: Thu, 16 Jan 2025 17:57:50 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20TS=20=E6=9C=8D=E5=8A=A1?=
 =?UTF-8?q?=E5=99=A8=E5=8F=82=E6=95=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 07.PVE制作TS服务器.md               |  3 +++
 src/debian/debian_ts_99_sysctl.conf |  3 +++
 src/debian/debian_ts_nftables.conf  | 15 +++++++++++++++
 3 files changed, 21 insertions(+)

diff --git a/07.PVE制作TS服务器.md b/07.PVE制作TS服务器.md
index 8cf6ccc..47f19e0 100644
--- a/07.PVE制作TS服务器.md
+++ b/07.PVE制作TS服务器.md
@@ -228,6 +228,9 @@ net.ipv4.conf.default.arp_ignore = 1
 net.ipv4.conf.all.rp_filter = 2
 net.ipv4.conf.default.rp_filter = 2
 
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
 net.ipv4.igmp_max_memberships = 256
 
 net.ipv4.route.error_burst = 500
diff --git a/src/debian/debian_ts_99_sysctl.conf b/src/debian/debian_ts_99_sysctl.conf
index 7a53e57..5e8e985 100644
--- a/src/debian/debian_ts_99_sysctl.conf
+++ b/src/debian/debian_ts_99_sysctl.conf
@@ -34,6 +34,9 @@ net.ipv4.conf.default.arp_ignore = 1
 net.ipv4.conf.all.rp_filter = 2
 net.ipv4.conf.default.rp_filter = 2
 
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
 net.ipv4.igmp_max_memberships = 256
 
 net.ipv4.route.error_burst = 500
diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 992be20..7f40a93 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -128,5 +128,20 @@ table inet router {
         meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
     }
 
+
+    #
+    # Mangle rules
+    #
+
+    chain mangle_postrouting {
+        type filter hook postrouting priority mangle; policy accept;
+        ct packets < 20 oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
+    }
+
+    chain mangle_forward {
+        type filter hook forward priority mangle; policy accept;
+        ct packets < 20 iifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
+    }
+
 }