更新 TS 测试配置

src/debian/debian_ts_nftables.conf

@@ -0,0 +1,176 @@
+#!/usr/sbin/nft -f
+
+# This configuration file is customized by fox,
+# Optimize nftables rules for Linux Router.
+
+table inet router
+flush table inet router
+
+table inet router {
+    #
+    # Flowtable
+    #
+
+    flowtable ft {
+        hook ingress priority filter;
+        devices = { eth0 };
+        counter;
+    }
+
+
+    #
+    # Filter rules
+    #
+
+    chain input {
+        type filter hook input priority filter; policy drop;
+        iifname "lo" accept comment "defconf: accept traffic from loopback"
+        ct state established,related accept comment "defconf: allow inbound established and related flows"
+        ct state invalid counter drop comment "defconf: drop input flows with invalid conntrack state"
+        tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
+        iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
+        iifname "tailscale0" jump input_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 input traffic"
+    }
+
+    chain forward {
+        type filter hook forward priority filter; policy drop;
+        meta l4proto { tcp, udp } flow offload @ft comment "defconf: track forwarded flows"
+        ct state established,related accept comment "defconf: allow forwarded established and related flows"
+        ct state invalid counter drop comment "defconf: drop forward flows with invalid conntrack state"
+        iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
+        iifname "tailscale0" jump forward_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 forward traffic"
+    }
+
+    chain output {
+        type filter hook output priority filter; policy accept;
+        oifname "lo" accept comment "defconf: accept traffic towards loopback"
+        ct state established,related accept comment "defconf: allow outbound established and related flows"
+        ct state invalid counter drop comment "defconf: drop output flows with invalid conntrack state"
+        oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
+        oifname "tailscale0" jump output_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 output traffic"
+    }
+
+    chain prerouting {
+        type filter hook prerouting priority filter; policy accept;
+        iifname "eth0" jump helper_lan comment "defconf: handle LAN IPv4 / IPv6 helper assignment"
+    }
+
+    chain syn_flood {
+        limit rate 200/second burst 100 packets return comment "defconf: accept SYN packets below rate-limit"
+        counter drop comment "defconf: drop excess packets"
+    }
+
+    chain input_lan {
+        ct status dnat counter accept comment "lanconf: accept port redirect"
+        jump accept_from_lan
+    }
+
+    chain forward_lan {
+        jump accept_to_tailscale comment "lanconf: accept Tailscale forward"
+        ct status dnat counter accept comment "lanconf: accept port forward"
+        jump accept_to_lan
+    }
+
+    chain output_lan {
+        jump accept_to_lan
+    }
+
+    chain helper_lan {
+    }
+
+    chain accept_from_lan {
+        iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+    }
+
+    chain accept_to_lan {
+        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NAT leakage"
+        oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+    }
+
+    chain input_tailscale {
+        jump accept_from_tailscale
+    }
+
+    chain output_tailscale {
+        jump accept_to_tailscale
+    }
+
+    chain forward_tailscale {
+        jump accept_to_lan comment "defconf: accept Tailscale to LAN forward"
+        jump accept_to_tailscale
+    }
+
+    chain accept_from_tailscale {
+        iifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic"
+    }
+
+    chain accept_to_tailscale {
+        oifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic"
+    }
+
+
+    #
+    # NAT rules
+    #
+
+    chain dstnat {
+        type nat hook prerouting priority dstnat; policy accept;
+        iifname "eth0" meta l4proto { tcp, udp } th dport domain counter jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
+    }
+
+    chain srcnat {
+        type nat hook postrouting priority srcnat; policy accept;
+        oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
+    }
+
+    chain dstnat_lan {
+        meta nfproto ipv4 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: Lan IPv4 DNS redirect"
+        meta nfproto ipv6 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: Lan IPv6 DNS redirect"
+    }
+
+    chain srcnat_lan {
+        meta nfproto ipv4 masquerade comment "defconf: masquerade IPv4 LAN traffic"
+    }
+
+
+    #
+    # Raw rules (notrack)
+    #
+
+    chain raw_prerouting {
+        type filter hook prerouting priority raw; policy accept;
+    }
+
+    chain raw_output {
+        type filter hook output priority raw; policy accept;
+    }
+
+
+    #
+    # Mangle rules
+    #
+
+    chain mangle_prerouting {
+        type filter hook prerouting priority mangle; policy accept;
+    }
+
+    chain mangle_postrouting {
+        type filter hook postrouting priority mangle; policy accept;
+    }
+
+    chain mangle_input {
+        type filter hook input priority mangle; policy accept;
+    }
+
+    chain mangle_output {
+        type route hook output priority mangle; policy accept;
+    }
+
+    chain mangle_forward {
+        type filter hook forward priority mangle; policy accept;
+        iifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
+        oifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
+    }
+
+}
+