更新 TS 测试配置

2026-08-31 14:02:53 +08:00 · 2023-11-28 19:01:35 +08:00
parent 554b2bd6d4
commit 07d5ea174a
10 changed files with 618 additions and 4 deletions
@@ -1,5 +1,5 @@
-# This configuration file is customized by fox
-# Optimize system parameters
+# This configuration file is customized by fox,
+# Optimize sysctl parameters for local DNS server.

 kernel.panic = 20
 kernel.panic_on_oops = 1
@@ -0,0 +1,5 @@
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "10";
+APT::Periodic::AutocleanInterval "1";
+APT::Periodic::CleanInterval "1";
+
@@ -0,0 +1,178 @@
+// Unattended-Upgrade::Origins-Pattern controls which packages are
+// upgraded.
+//
+// Lines below have the format "keyword=value,...".  A
+// package will be upgraded only if the values in its metadata match
+// all the supplied keywords in a line.  (In other words, omitted
+// keywords are wild cards.) The keywords originate from the Release
+// file, but several aliases are accepted.  The accepted keywords are:
+//   a,archive,suite (eg, "stable")
+//   c,component     (eg, "main", "contrib", "non-free")
+//   l,label         (eg, "Debian", "Debian-Security")
+//   o,origin        (eg, "Debian", "Unofficial Multimedia Packages")
+//   n,codename      (eg, "jessie", "jessie-updates")
+//     site          (eg, "http.debian.net")
+// The available values on the system are printed by the command
+// "apt-cache policy", and can be debugged by running
+// "unattended-upgrades -d" and looking at the log file.
+//
+// Within lines unattended-upgrades allows 2 macros whose values are
+// derived from /etc/debian_version:
+//   ${distro_id}            Installed origin.
+//   ${distro_codename}      Installed codename (eg, "buster")
+Unattended-Upgrade::Origins-Pattern {
+        // Codename based matching:
+        // This will follow the migration of a release through different
+        // archives (e.g. from testing to stable and later oldstable).
+        // Software will be the latest available for the named release,
+        // but the Debian release itself will not be automatically upgraded.
+        "origin=Debian,codename=${distro_codename}-updates";
+//      "origin=Debian,codename=${distro_codename}-proposed-updates";
+        "origin=Debian,codename=${distro_codename},label=Debian";
+        "origin=Debian,codename=${distro_codename},label=Debian-Security";
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+        "origin=Tailscale,codename=${distro_codename},label=Tailscale";
+
+        // Archive or Suite based matching:
+        // Note that this will silently match a different release after
+        // migration to the specified archive (e.g. testing becomes the
+        // new stable).
+//      "o=Debian,a=stable";
+//      "o=Debian,a=stable-updates";
+//      "o=Debian,a=proposed-updates";
+//      "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports";
+};
+
+// Python regular expressions, matching packages to exclude from upgrading
+Unattended-Upgrade::Package-Blacklist {
+    // The following matches all packages starting with linux-
+//  "linux-";
+
+    // Use $ to explicitely define the end of a package name. Without
+    // the $, "libc6" would match all of them.
+//  "libc6$";
+//  "libc6-dev$";
+//  "libc6-i686$";
+
+    // Special characters need escaping
+//  "libstdc\+\+6$";
+
+    // The following matches packages like xen-system-amd64, xen-utils-4.1,
+    // xenstore-utils and libxenstore3.0
+//  "(lib)?xen(store)?";
+
+    // For more information about Python regular expressions, see
+    // https://docs.python.org/3/howto/regex.html
+};
+
+// This option allows you to control if on a unclean dpkg exit
+// unattended-upgrades will automatically run
+//   dpkg --force-confold --configure -a
+// The default is true, to ensure updates keep getting installed
+//Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+
+// Split the upgrade into the smallest possible chunks so that
+// they can be interrupted with SIGTERM. This makes the upgrade
+// a bit slower but it has the benefit that shutdown while a upgrade
+// is running is possible (with a small delay)
+//Unattended-Upgrade::MinimalSteps "true";
+
+// Install all updates when the machine is shutting down
+// instead of doing it in the background while the machine is running.
+// This will (obviously) make shutdown slower.
+// Unattended-upgrades increases logind's InhibitDelayMaxSec to 30s.
+// This allows more time for unattended-upgrades to shut down gracefully
+// or even install a few packages in InstallOnShutdown mode, but is still a
+// big step back from the 30 minutes allowed for InstallOnShutdown previously.
+// Users enabling InstallOnShutdown mode are advised to increase
+// InhibitDelayMaxSec even further, possibly to 30 minutes.
+//Unattended-Upgrade::InstallOnShutdown "false";
+
+// Send email to this address for problems or packages upgrades
+// If empty or unset then no email is sent, make sure that you
+// have a working mail setup on your system. A package that provides
+// 'mailx' must be installed. E.g. "user@example.com"
+//Unattended-Upgrade::Mail "";
+
+// Set this value to one of:
+//    "always", "only-on-error" or "on-change"
+// If this is not set, then any legacy MailOnlyOnError (boolean) value
+// is used to chose between "only-on-error" and "on-change"
+//Unattended-Upgrade::MailReport "on-change";
+
+// Remove unused automatically installed kernel-related packages
+// (kernel images, kernel headers and kernel version locked tools).
+//Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+
+// Do automatic removal of newly unused dependencies after the upgrade
+//Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+
+// Do automatic removal of unused packages after the upgrade
+// (equivalent to apt-get autoremove)
+//Unattended-Upgrade::Remove-Unused-Dependencies "false";
+
+// Automatically reboot *WITHOUT CONFIRMATION* if
+//  the file /var/run/reboot-required is found after the upgrade
+//Unattended-Upgrade::Automatic-Reboot "false";
+
+// Automatically reboot even if there are users currently logged in
+// when Unattended-Upgrade::Automatic-Reboot is set to true
+//Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
+
+// If automatic reboot is enabled and needed, reboot at the specific
+// time instead of immediately
+//  Default: "now"
+//Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+
+// Use apt bandwidth limit feature, this example limits the download
+// speed to 70kb/sec
+//Acquire::http::Dl-Limit "70";
+
+// Enable logging to syslog. Default is False
+// Unattended-Upgrade::SyslogEnable "false";
+
+// Specify syslog facility. Default is daemon
+// Unattended-Upgrade::SyslogFacility "daemon";
+
+// Download and install upgrades only on AC power
+// (i.e. skip or gracefully stop updates on battery)
+// Unattended-Upgrade::OnlyOnACPower "true";
+
+// Download and install upgrades only on non-metered connection
+// (i.e. skip or gracefully stop updates on a metered connection)
+// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";
+
+// Verbose logging
+// Unattended-Upgrade::Verbose "false";
+
+// Print debugging information both in unattended-upgrades and
+// in unattended-upgrade-shutdown
+// Unattended-Upgrade::Debug "false";
+
+// Allow package downgrade if Pin-Priority exceeds 1000
+// Unattended-Upgrade::Allow-downgrade "false";
+
+// When APT fails to mark a package to be upgraded or installed try adjusting
+// candidates of related packages to help APT's resolver in finding a solution
+// where the package can be upgraded or installed.
+// This is a workaround until APT's resolver is fixed to always find a
+// solution if it exists. (See Debian bug #711128.)
+// The fallback is enabled by default, except on Debian's sid release because
+// uninstallable packages are frequent there.
+// Disabling the fallback speeds up unattended-upgrades when there are
+// uninstallable packages at the expense of rarely keeping back packages which
+// could be upgraded or installed.
+// Unattended-Upgrade::Allow-APT-Mark-Fallback "true";
+
+Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+
+Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+
+Unattended-Upgrade::Automatic-Reboot "true";
+
+Unattended-Upgrade::Automatic-Reboot-Time "03:00";
+
@@ -0,0 +1,65 @@
+# This configuration file is customized by fox,
+# Optimize sysctl parameters for Linux Router.
+
+kernel.panic = 20
+kernel.panic_on_oops = 1
+
+net.core.default_qdisc = fq_codel
+net.ipv4.tcp_congestion_control = bbr
+
+net.ipv4.ip_forward = 1
+
+net.ipv6.conf.all.forwarding = 1
+net.ipv6.conf.default.forwarding = 1
+
+# Other adjustable system parameters
+
+net.core.netdev_budget = 600
+net.core.netdev_budget_usecs = 20000
+
+net.core.rps_sock_flow_entries = 32768
+
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+
+net.ipv4.conf.all.arp_ignore = 1
+net.ipv4.conf.default.arp_ignore = 1
+
+net.ipv4.conf.all.rp_filter = 2
+net.ipv4.conf.default.rp_filter = 2
+
+net.ipv4.conf.all.log_martians = 1
+
+net.ipv4.igmp_max_memberships = 256
+
+net.ipv4.route.error_burst = 500
+net.ipv4.route.error_cost = 100
+
+net.ipv4.route.redirect_load = 2
+net.ipv4.route.redirect_silence = 2048
+
+net.ipv4.tcp_challenge_ack_limit = 1000
+net.ipv4.tcp_fin_timeout = 30
+net.ipv4.tcp_keepalive_time = 120
+net.ipv4.tcp_syncookies = 1
+
+net.ipv6.conf.all.accept_ra = 0
+net.ipv6.conf.default.accept_ra = 0
+
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+
+net.ipv6.conf.all.accept_source_route = 0
+net.ipv6.conf.default.accept_source_route = 0
+
+net.ipv6.conf.all.use_tempaddr = 0
+net.ipv6.conf.default.use_tempaddr = 0
+
+net.netfilter.nf_conntrack_acct = 1
+net.netfilter.nf_conntrack_tcp_timeout_established = 7440
+net.netfilter.nf_conntrack_udp_timeout = 60
+net.netfilter.nf_conntrack_udp_timeout_stream = 180
+
@@ -0,0 +1,45 @@
+# This configuration file is customized by fox,
+# Optimize dnsmasq parameters for local DNS server.
+
+# Main Config
+
+conf-dir=/etc/dnsmasq.d/,*.conf
+conf-file=/etc/dnsmasq.conf
+
+log-facility=/var/log/dnsmasq.log
+log-async=20
+
+cache-size=1024
+edns-packet-max=1232
+rebind-domain-ok=/fox.home.arpa/
+
+bind-dynamic
+bogus-priv
+domain-needed
+localise-queries
+local-service
+no-hosts
+no-negcache
+rebind-localhost-ok
+stop-dns-rebind
+
+# DNS Filter
+
+server=/alt/
+server=/home.arpa/
+server=/ipv4only.arpa/
+server=/resolver.arpa/
+server=/example/
+server=/bind/
+server=/invalid/
+server=/local/
+server=/localhost/
+server=/onion/
+server=/test/
+
+# DNS Server
+
+server=/fox.home.arpa/172.16.1.1
+server=/ts.net/100.100.100.100
+server=172.16.1.1
+
@@ -0,0 +1,125 @@
+# This configuration file is customized by fox,
+# Optimize for lo network.
+
+[Match]
+Name=lo
+
+# rfc6890
+[Route]
+Destination=0.0.0.0/8
+Type=unreachable
+[Route]
+Destination=10.0.0.0/8
+Type=unreachable
+[Route]
+Destination=100.64.0.0/10
+Type=unreachable
+[Route]
+Destination=127.0.0.0/8
+Type=unreachable
+[Route]
+Destination=169.254.0.0/16
+Type=unreachable
+[Route]
+Destination=172.16.0.0/12
+Type=unreachable
+[Route]
+Destination=192.0.0.0/24
+Type=unreachable
+[Route]
+Destination=192.0.0.0/29
+Type=unreachable
+[Route]
+Destination=192.0.2.0/24
+Type=unreachable
+[Route]
+Destination=192.88.99.0/24
+Type=unreachable
+[Route]
+Destination=192.168.0.0/16
+Type=unreachable
+[Route]
+Destination=198.18.0.0/15
+Type=unreachable
+[Route]
+Destination=198.51.100.0/24
+Type=unreachable
+[Route]
+Destination=203.0.113.0/24
+Type=unreachable
+[Route]
+Destination=240.0.0.0/4
+Type=unreachable
+[Route]
+Destination=255.255.255.255/32
+Type=unreachable
+[Route]
+Destination=::1/128
+Type=unreachable
+[Route]
+Destination=::/128
+Type=unreachable
+[Route]
+Destination=64:ff9b::/96
+Type=unreachable
+[Route]
+Destination=::ffff:0:0/96
+Type=unreachable
+[Route]
+Destination=100::/64
+Type=unreachable
+[Route]
+Destination=2001::/23
+Type=unreachable
+[Route]
+Destination=2001::/32
+Type=unreachable
+[Route]
+Destination=2001:2::/48
+Type=unreachable
+[Route]
+Destination=2001:db8::/32
+Type=unreachable
+[Route]
+Destination=2001:20::/28
+Type=unreachable
+[Route]
+Destination=2002::/16
+Type=unreachable
+[Route]
+Destination=fc00::/7
+Type=unreachable
+[Route]
+Destination=fe80::/10
+Type=unreachable
+
+[Route]
+Table=1024
+Destination=fc00::/7
+Type=throw
+[Route]
+Table=1024
+Destination=::/0
+Type=prohibit
+[Route]
+Table=1024
+Destination=10.0.0.0/10
+Type=throw
+[Route]
+Table=1024
+Destination=172.16.0.0/12
+Type=throw
+[Route]
+Table=1024
+Destination=192.168.0.0/16
+Type=throw
+[Route]
+Table=1024
+Destination=0.0.0.0/0
+Type=prohibit
+
+[RoutingPolicyRule]
+Priority=10000
+From=fc00::/7
+Table=1024
+
@@ -0,0 +1,176 @@
+#!/usr/sbin/nft -f
+
+# This configuration file is customized by fox,
+# Optimize nftables rules for Linux Router.
+
+table inet router
+flush table inet router
+
+table inet router {
+    #
+    # Flowtable
+    #
+
+    flowtable ft {
+        hook ingress priority filter;
+        devices = { eth0 };
+        counter;
+    }
+
+
+    #
+    # Filter rules
+    #
+
+    chain input {
+        type filter hook input priority filter; policy drop;
+        iifname "lo" accept comment "defconf: accept traffic from loopback"
+        ct state established,related accept comment "defconf: allow inbound established and related flows"
+        ct state invalid counter drop comment "defconf: drop input flows with invalid conntrack state"
+        tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
+        iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
+        iifname "tailscale0" jump input_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 input traffic"
+    }
+
+    chain forward {
+        type filter hook forward priority filter; policy drop;
+        meta l4proto { tcp, udp } flow offload @ft comment "defconf: track forwarded flows"
+        ct state established,related accept comment "defconf: allow forwarded established and related flows"
+        ct state invalid counter drop comment "defconf: drop forward flows with invalid conntrack state"
+        iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
+        iifname "tailscale0" jump forward_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 forward traffic"
+    }
+
+    chain output {
+        type filter hook output priority filter; policy accept;
+        oifname "lo" accept comment "defconf: accept traffic towards loopback"
+        ct state established,related accept comment "defconf: allow outbound established and related flows"
+        ct state invalid counter drop comment "defconf: drop output flows with invalid conntrack state"
+        oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
+        oifname "tailscale0" jump output_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 output traffic"
+    }
+
+    chain prerouting {
+        type filter hook prerouting priority filter; policy accept;
+        iifname "eth0" jump helper_lan comment "defconf: handle LAN IPv4 / IPv6 helper assignment"
+    }
+
+    chain syn_flood {
+        limit rate 200/second burst 100 packets return comment "defconf: accept SYN packets below rate-limit"
+        counter drop comment "defconf: drop excess packets"
+    }
+
+    chain input_lan {
+        ct status dnat counter accept comment "lanconf: accept port redirect"
+        jump accept_from_lan
+    }
+
+    chain forward_lan {
+        jump accept_to_tailscale comment "lanconf: accept Tailscale forward"
+        ct status dnat counter accept comment "lanconf: accept port forward"
+        jump accept_to_lan
+    }
+
+    chain output_lan {
+        jump accept_to_lan
+    }
+
+    chain helper_lan {
+    }
+
+    chain accept_from_lan {
+        iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+    }
+
+    chain accept_to_lan {
+        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NAT leakage"
+        oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+    }
+
+    chain input_tailscale {
+        jump accept_from_tailscale
+    }
+
+    chain output_tailscale {
+        jump accept_to_tailscale
+    }
+
+    chain forward_tailscale {
+        jump accept_to_lan comment "defconf: accept Tailscale to LAN forward"
+        jump accept_to_tailscale
+    }
+
+    chain accept_from_tailscale {
+        iifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic"
+    }
+
+    chain accept_to_tailscale {
+        oifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic"
+    }
+
+
+    #
+    # NAT rules
+    #
+
+    chain dstnat {
+        type nat hook prerouting priority dstnat; policy accept;
+        iifname "eth0" meta l4proto { tcp, udp } th dport domain counter jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
+    }
+
+    chain srcnat {
+        type nat hook postrouting priority srcnat; policy accept;
+        oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
+    }
+
+    chain dstnat_lan {
+        meta nfproto ipv4 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: Lan IPv4 DNS redirect"
+        meta nfproto ipv6 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: Lan IPv6 DNS redirect"
+    }
+
+    chain srcnat_lan {
+        meta nfproto ipv4 masquerade comment "defconf: masquerade IPv4 LAN traffic"
+    }
+
+
+    #
+    # Raw rules (notrack)
+    #
+
+    chain raw_prerouting {
+        type filter hook prerouting priority raw; policy accept;
+    }
+
+    chain raw_output {
+        type filter hook output priority raw; policy accept;
+    }
+
+
+    #
+    # Mangle rules
+    #
+
+    chain mangle_prerouting {
+        type filter hook prerouting priority mangle; policy accept;
+    }
+
+    chain mangle_postrouting {
+        type filter hook postrouting priority mangle; policy accept;
+    }
+
+    chain mangle_input {
+        type filter hook input priority mangle; policy accept;
+    }
+
+    chain mangle_output {
+        type route hook output priority mangle; policy accept;
+    }
+
+    chain mangle_forward {
+        type filter hook forward priority mangle; policy accept;
+        iifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
+        oifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
+    }
+
+}
+
@@ -0,0 +1,15 @@
+# This configuration file is customized by fox,
+# Optimize system resolve parameters for Linux Router.
+#
+# For use local domain,
+# please modify 'search' parameter according to
+# your network environment.
+#
+# eg:
+#       search fox.home.arpa
+
+nameserver 127.0.0.1
+nameserver 172.16.1.1
+options edns0 timeout:1 trust-ad
+search fox.home.arpa
+
@@ -0,0 +1,5 @@
+# This configuration file is customized by fox,
+# Optimize netfilter related modules at system boot.
+
+nf_conntrack
+