From ed7f9c5fc96199b94db8f57a21c8657de8e54356 Mon Sep 17 00:00:00 2001 From: CallMeR <9463297+callmer@user.noreply.gitee.com> Date: Tue, 4 Aug 2026 17:31:19 +0800 Subject: [PATCH] =?UTF-8?q?=E7=B2=BE=E7=AE=80=20TS=20=E9=98=B2=E7=81=AB?= =?UTF-8?q?=E5=A2=99=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/debian/debian_ts_nftables.conf | 80 ++++++++++-------------------- 1 file changed, 27 insertions(+), 53 deletions(-) diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf index 9a81978..95e7c25 100644 --- a/src/debian/debian_ts_nftables.conf +++ b/src/debian/debian_ts_nftables.conf @@ -26,26 +26,25 @@ table inet router { chain input { type filter hook input priority filter; policy drop; iif "lo" accept comment "defconf: accept traffic from loopback" - ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows" + ct state established,related accept comment "defconf: handle inbound flows" tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "defconf: rate limit new TCP connections" - iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" - iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic" + iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 input traffic" + iifname "tailscale0" goto accept_from_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic" } chain forward { type filter hook forward priority filter; policy drop; - ct state established,related flow add @ft; - ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows" - iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" - iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic" + ct state established,related flow add @ft accept comment "defconf: offload and accept forwarded flows" + iifname "eth0" goto forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" + iifname "tailscale0" goto forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic" } chain output { type filter hook output priority filter; policy accept; oif "lo" accept comment "defconf: accept traffic towards loopback" - ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows" - oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" - oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" + ct state established,related accept comment "defconf: handle outbound flows" + oifname "eth0" goto accept_to_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" + oifname "tailscale0" goto accept_to_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" } chain syn_flood { @@ -53,51 +52,30 @@ table inet router { counter drop comment "defconf: drop excess new TCP connections" } - chain input_lan { - ct status dnat accept comment "lanconf: accept port redirect" - jump accept_from_lan - } - chain forward_lan { - jump accept_to_tailscale comment "tsconf: accept LAN to TS forwarding" + oifname "tailscale0" goto accept_to_tailscale comment "tsconf: accept LAN to TS forwarding" ct status dnat accept comment "lanconf: accept port forwards" - jump accept_to_lan - } - - chain output_lan { - jump accept_to_lan - } - - chain accept_from_lan { - iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" - } - - chain accept_to_lan { - meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage" - oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" - } - - chain input_tailscale { - jump accept_from_tailscale + oifname "eth0" goto accept_to_lan } chain forward_tailscale { - jump accept_to_lan comment "tsconf: accept TS to LAN forwarding" - jump accept_to_tailscale + oifname "eth0" goto accept_to_lan comment "tsconf: accept TS to LAN forwarding" + oifname "tailscale0" goto accept_to_tailscale } - chain output_tailscale { - jump accept_to_tailscale + chain accept_to_lan { + meta nfproto ipv4 ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage" + accept comment "defconf: accept LAN IPv4 / IPv6 traffic" } chain accept_from_tailscale { - meta nfproto ipv4 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic" - meta nfproto ipv6 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic" + meta nfproto ipv4 counter accept comment "tsconf: accept TS IPv4 traffic" + meta nfproto ipv6 counter accept comment "tsconf: accept TS IPv6 traffic" } chain accept_to_tailscale { - meta nfproto ipv4 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic" - meta nfproto ipv6 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic" + meta nfproto ipv4 counter accept comment "tsconf: accept TS IPv4 traffic" + meta nfproto ipv6 counter accept comment "tsconf: accept TS IPv6 traffic" } @@ -107,21 +85,17 @@ table inet router { chain dstnat { type nat hook prerouting priority dstnat; policy accept; - iifname { "eth0", "tailscale0" } meta l4proto { tcp, udp } th dport domain jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic" + iifname { "eth0", "tailscale0" } meta l4proto { tcp, udp } th dport domain goto redirect_dns comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic" } chain srcnat { type nat hook postrouting priority srcnat; policy accept; - oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic" + oifname "eth0" meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic" } - chain dstnat_lan { - meta nfproto ipv4 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv4 DNS redirect" - meta nfproto ipv6 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv6 DNS redirect" - } - - chain srcnat_lan { - meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic" + chain redirect_dns { + meta nfproto ipv4 counter redirect comment "lanconf: LAN IPv4 DNS redirect" + meta nfproto ipv6 counter redirect comment "lanconf: LAN IPv6 DNS redirect" } @@ -131,12 +105,12 @@ table inet router { chain mangle_postrouting { type filter hook postrouting priority mangle; policy accept; - oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing" + oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing" } chain mangle_forward { type filter hook forward priority mangle; policy accept; - iifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing" + iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing" } }