From 4bf1e1d523f3ac9c157a43e9e9a07f99ccf631ca Mon Sep 17 00:00:00 2001
From: CallMeR <9463297+callmer@user.noreply.gitee.com>
Date: Fri, 27 Sep 2024 14:01:18 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20Nftables=20=E8=A7=84?=
 =?UTF-8?q?=E5=88=99?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/debian/debian_ts_nftables.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 46b3b0d..3529a5c 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -26,7 +26,7 @@ table inet router {
         type filter hook input priority filter; policy drop;
         iif "lo" accept comment "defconf: accept traffic from loopback"
         ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
-        tcp flags syn / fin,syn,rst,ack counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
+        ct state new meta l4proto tcp counter jump syn_flood comment "defconf: rate limit new TCP connections"
         iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
         iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
     }
@@ -54,8 +54,8 @@ table inet router {
     }
 
     chain syn_flood {
-        limit rate 200/second burst 100 packets return comment "defconf: accept SYN packets below rate-limit"
-        counter drop comment "defconf: drop excess packets"
+        limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
+        counter drop comment "defconf: drop excess new TCP connections"
     }
 
     chain input_lan {