gated0/pve_toss_notes
Archived
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

同步上游更新

Browse Source
This commit is contained in:
CallMeR
2024-01-06 14:59:35 +08:00
parent 79703f9d62
commit 6497efb00a
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+7 -7
View File
@@ -24,25 +24,25 @@ table inet router {
chain input { chain input {
type filter hook input priority filter; policy drop; type filter hook input priority filter; policy drop;
iifname "lo" accept comment "defconf: accept traffic from loopback" iif "lo" accept comment "defconf: accept traffic from loopback"
ct state established,related accept comment "defconf: allow inbound established and related flows" ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets" tcp flags syn / fin,syn,rst,ack counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic" iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
} }
chain forward { chain forward {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
meta l4proto { tcp, udp } flow offload @ft comment "defconf: track forwarded flows" meta l4proto { tcp, udp } flow add @ft comment "defconf: track forwarded flows"
ct state established,related accept comment "defconf: allow forwarded established and related flows" ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows"
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic" iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
} }
chain output { chain output {
type filter hook output priority filter; policy accept; type filter hook output priority filter; policy accept;
oifname "lo" accept comment "defconf: accept traffic towards loopback" oif "lo" accept comment "defconf: accept traffic towards loopback"
ct state established,related accept comment "defconf: allow outbound established and related flows" ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows"
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
} }