精简 TS 防火墙配置

06.PVE制作DNS服务器.md

@@ -220,7 +220,7 @@ $ sudo /tmp/smartdns/install -i
 
 ```bash
 ## 升级 SmartDNS
-$ sudo ./install -U
+$ sudo /tmp/smartdns/install -U
 ```
 
 修改 `SmartDNS` 配置之前，需检查 `smartdns.service` 服务状态，确保该服务开机自启。  
@@ -392,7 +392,7 @@ server-tls dns.alidns.com
 server-https https://doh.pub/dns-query
 server-https https://dns.alidns.com/dns-query
 
-server-quic dns.alidns.com -fallback
+server-h3 h3://dns.alidns.com/dns-query -fallback
 server-https https://doh.360.cn/dns-query -fallback
 
 ```

src/debian/debian_dns_smartdns.conf

@@ -58,6 +58,6 @@ server-tls dns.alidns.com
 server-https https://doh.pub/dns-query
 server-https https://dns.alidns.com/dns-query
 
-server-quic dns.alidns.com -fallback
+server-h3 h3://dns.alidns.com/dns-query -fallback
 server-https https://doh.360.cn/dns-query -fallback
 

src/debian/debian_ts_nftables.conf

@@ -26,26 +26,25 @@ table inet router {
     chain input {
         type filter hook input priority filter; policy drop;
         iif "lo" accept comment "defconf: accept traffic from loopback"
-        ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
+        ct state established,related accept comment "defconf: handle inbound flows"
         tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "defconf: rate limit new TCP connections"
-        iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
+        iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 input traffic"
-        iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
+        iifname "tailscale0" goto accept_from_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
     }
 
     chain forward {
         type filter hook forward priority filter; policy drop;
-        ct state established,related flow add @ft;
+        ct state established,related flow add @ft accept comment "defconf: offload and accept forwarded flows"
-        ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows"
+        iifname "eth0" goto forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
-        iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
+        iifname "tailscale0" goto forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
-        iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
     }
 
     chain output {
         type filter hook output priority filter; policy accept;
         oif "lo" accept comment "defconf: accept traffic towards loopback"
-        ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows"
+        ct state established,related accept comment "defconf: handle outbound flows"
-        oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
+        oifname "eth0" goto accept_to_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
-        oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
+        oifname "tailscale0" goto accept_to_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
     }
 
     chain syn_flood {
@@ -53,51 +52,30 @@ table inet router {
         counter drop comment "defconf: drop excess new TCP connections"
     }
 
-    chain input_lan {
-        ct status dnat accept comment "lanconf: accept port redirect"
-        jump accept_from_lan
-    }
-
     chain forward_lan {
-        jump accept_to_tailscale comment "tsconf: accept LAN to TS forwarding"
+        oifname "tailscale0" goto accept_to_tailscale comment "tsconf: accept LAN to TS forwarding"
         ct status dnat accept comment "lanconf: accept port forwards"
-        jump accept_to_lan
+        oifname "eth0" goto accept_to_lan
-    }
-
-    chain output_lan {
-        jump accept_to_lan
-    }
-
-    chain accept_from_lan {
-        iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
-    }
-
-    chain accept_to_lan {
-        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
-        oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
-    }
-
-    chain input_tailscale {
-        jump accept_from_tailscale
     }
 
     chain forward_tailscale {
-        jump accept_to_lan comment "tsconf: accept TS to LAN forwarding"
+        oifname "eth0" goto accept_to_lan comment "tsconf: accept TS to LAN forwarding"
-        jump accept_to_tailscale
+        oifname "tailscale0" goto accept_to_tailscale
     }
 
-    chain output_tailscale {
+    chain accept_to_lan {
-        jump accept_to_tailscale
+        meta nfproto ipv4 ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
+        accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
     chain accept_from_tailscale {
-        meta nfproto ipv4 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
+        meta nfproto ipv4 counter accept comment "tsconf: accept TS IPv4 traffic"
-        meta nfproto ipv6 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
+        meta nfproto ipv6 counter accept comment "tsconf: accept TS IPv6 traffic"
     }
 
     chain accept_to_tailscale {
-        meta nfproto ipv4 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
+        meta nfproto ipv4 counter accept comment "tsconf: accept TS IPv4 traffic"
-        meta nfproto ipv6 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
+        meta nfproto ipv6 counter accept comment "tsconf: accept TS IPv6 traffic"
     }
 
 
@@ -107,21 +85,17 @@ table inet router {
 
     chain dstnat {
         type nat hook prerouting priority dstnat; policy accept;
-        iifname { "eth0", "tailscale0" } meta l4proto { tcp, udp } th dport domain jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
+        iifname { "eth0", "tailscale0" } meta l4proto { tcp, udp } th dport domain goto redirect_dns comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
     }
 
     chain srcnat {
         type nat hook postrouting priority srcnat; policy accept;
-        oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
+        oifname "eth0" meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
     }
 
-    chain dstnat_lan {
+    chain redirect_dns {
-        meta nfproto ipv4 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv4 DNS redirect"
+        meta nfproto ipv4 counter redirect comment "lanconf: LAN IPv4 DNS redirect"
-        meta nfproto ipv6 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv6 DNS redirect"
+        meta nfproto ipv6 counter redirect comment "lanconf: LAN IPv6 DNS redirect"
-    }
-
-    chain srcnat_lan {
-        meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
     }
 
 
@@ -131,12 +105,12 @@ table inet router {
 
     chain mangle_postrouting {
         type filter hook postrouting priority mangle; policy accept;
-        oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
+        oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
     }
 
     chain mangle_forward {
         type filter hook forward priority mangle; policy accept;
-        iifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
+        iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
     }
 
 }