diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf index 0ca4c04..133e1c7 100644 --- a/src/debian/debian_ts_nftables.conf +++ b/src/debian/debian_ts_nftables.conf @@ -46,10 +46,6 @@ table inet router { oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" } - chain prerouting { - type filter hook prerouting priority filter; policy accept; - } - chain syn_flood { limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit" counter drop comment "defconf: drop excess new TCP connections" @@ -81,7 +77,6 @@ table inet router { chain accept_to_lan { meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage" - meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv6 leakage" oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" } @@ -130,45 +125,6 @@ table inet router { chain srcnat_lan { meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic" - meta nfproto ipv6 counter masquerade comment "defconf: masquerade LAN IPv6 traffic" - } - - - # - # Raw rules (notrack) - # - - chain raw_prerouting { - type filter hook prerouting priority raw; policy accept; - } - - chain raw_output { - type filter hook output priority raw; policy accept; - } - - - # - # Mangle rules - # - - chain mangle_prerouting { - type filter hook prerouting priority mangle; policy accept; - } - - chain mangle_postrouting { - type filter hook postrouting priority mangle; policy accept; - } - - chain mangle_input { - type filter hook input priority mangle; policy accept; - } - - chain mangle_output { - type route hook output priority mangle; policy accept; - } - - chain mangle_forward { - type filter hook forward priority mangle; policy accept; } }