From 14022aebbfe67873857e1b07d89940ff7055c6f6 Mon Sep 17 00:00:00 2001
From: CallMeR <9463297+callmer@user.noreply.gitee.com>
Date: Sun, 29 Dec 2024 01:51:28 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20TS=20=E9=98=B2=E7=81=AB?=
 =?UTF-8?q?=E5=A2=99?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/debian/debian_ts_nftables.conf | 41 +++++++++++++++---------------
 1 file changed, 20 insertions(+), 21 deletions(-)

diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 15f8775..dedeba2 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -28,14 +28,14 @@ table inet router {
         iif "lo" accept comment "defconf: accept traffic from loopback"
         ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
         iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
-        iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
+        iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
     }
 
     chain forward {
         type filter hook forward priority filter; policy drop;
         ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
         iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
-        iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
+        iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
     }
 
     chain output {
@@ -43,13 +43,11 @@ table inet router {
         ct state established,related accept comment "defconf: handle outbound flows"
         oif "lo" accept comment "defconf: accept traffic towards loopback"
         oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
-        oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
+        oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
     }
 
     chain prerouting {
         type filter hook prerouting priority filter; policy accept;
-        iifname "eth0" jump helper_lan comment "defconf: handle LAN IPv4 / IPv6 helper assignment"
-        iifname "tailscale0" jump helper_tailscale comment "tsconf: handle TS IPv4 / IPv6 helper assignment"
     }
 
     chain syn_flood {
@@ -68,8 +66,8 @@ table inet router {
     }
 
     chain forward_lan {
-        jump accept_to_tailscale comment "tsconf: accept LAN to TS forward"
-        ct status dnat accept comment "lanconf: accept port forward"
+        jump accept_to_tailscale comment "tsconf: accept LAN to TS forwarding"
+        ct status dnat accept comment "lanconf: accept port forwards"
         jump accept_to_lan
     }
 
@@ -77,16 +75,13 @@ table inet router {
         jump accept_to_lan
     }
 
-    chain helper_lan {
-    }
-
     chain accept_from_lan {
-        iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+        iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
     chain accept_to_lan {
-        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NATv4 leakage"
-        meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NATv6 leakage"
+        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
+        meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv6 leakage"
         oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
@@ -95,15 +90,12 @@ table inet router {
     }
 
     chain forward_tailscale {
-        counter jump accept_to_lan comment "tsconf: accept TS to LAN forward"
-        counter jump accept_to_tailscale
+        jump accept_to_lan comment "tsconf: accept TS to LAN forwarding"
+        jump accept_to_tailscale
     }
 
     chain output_tailscale {
-        counter jump accept_to_tailscale
-    }
-
-    chain helper_tailscale {
+        jump accept_to_tailscale
     }
 
     chain accept_from_tailscale {
@@ -111,6 +103,8 @@ table inet router {
     }
 
     chain accept_to_tailscale {
+        meta nfproto ipv4 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv4 leakage"
+        meta nfproto ipv6 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv6 leakage"
         oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic"
     }
 
@@ -127,6 +121,7 @@ table inet router {
     chain srcnat {
         type nat hook postrouting priority srcnat; policy accept;
         oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
+        oifname "tailscale0" jump srcnat_tailscale comment "tsconf: handle TS IPv4 / IPv6 srcnat traffic"
     }
 
     chain dstnat_lan {
@@ -135,10 +130,14 @@ table inet router {
     }
 
     chain srcnat_lan {
-        meta nfproto ipv4 counter masquerade comment "defconf: masquerade IPv4 LAN traffic"
-        meta nfproto ipv6 counter masquerade comment "defconf: masquerade IPv6 LAN traffic"
+        meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
+        meta nfproto ipv6 counter masquerade comment "defconf: masquerade LAN IPv6 traffic"
     }
 
+    chain srcnat_tailscale {
+        meta nfproto ipv4 counter masquerade comment "tsconf: masquerade TS IPv4 traffic"
+        meta nfproto ipv6 counter masquerade comment "tsconf: masquerade TS IPv6 traffic"
+    }
 
     #
     # Raw rules (notrack)