gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-09-01 06:22:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙配置

Browse Source
This commit is contained in:
CallMeR
2025-04-16 14:08:04 +08:00
parent 6d5693a73a
commit 01f00f4bc7
1 changed files with 2 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+2 -7
View File
@@ -34,7 +34,8 @@ table inet router {
chain forward { chain forward {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
ct state established,related goto handle_offload comment "defconf: handle forwarded flows" ct state established,related flow add @ft comment "defconf: track forwarded flows"
ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle forwarded flows"
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic" iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
} }
@@ -52,11 +53,6 @@ table inet router {
counter drop comment "defconf: drop excess new TCP connections" counter drop comment "defconf: drop excess new TCP connections"
} }
chain handle_offload {
flow add @ft accept comment "defconf: track forwarded flows"
accept
}
chain input_lan { chain input_lan {
ct status dnat accept comment "lanconf: accept port redirect" ct status dnat accept comment "lanconf: accept port redirect"
jump accept_from_lan jump accept_from_lan
@@ -77,7 +73,6 @@ table inet router {
} }
chain accept_to_lan { chain accept_to_lan {
meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }