gated0/pve_toss_notes
Archived
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙配置

Browse Source
This commit is contained in:
CallMeR
2025-04-16 17:03:38 +08:00
parent 01f00f4bc7
commit 7c6c92d7ed
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+2 -1
View File
@@ -25,7 +25,7 @@ table inet router {
chain input { chain input {
type filter hook input priority filter; policy drop; type filter hook input priority filter; policy drop;
ct state established,related accept comment "defconf: handle inbound flows" ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle inbound flows"
iif "lo" accept comment "defconf: accept traffic from loopback" iif "lo" accept comment "defconf: accept traffic from loopback"
ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections" ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
@@ -73,6 +73,7 @@ table inet router {
} }
chain accept_to_lan { chain accept_to_lan {
meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }