gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 22:12:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙

Browse Source
This commit is contained in:
CallMeR
2024-12-29 01:51:28 +08:00
parent 8738625ad9
commit 14022aebbf
1 changed files with 20 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+20 -21
View File
@@ -28,14 +28,14 @@ table inet router {
iif "lo" accept comment "defconf: accept traffic from loopback" iif "lo" accept comment "defconf: accept traffic from loopback"
ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections" ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic" iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
} }
chain forward { chain forward {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
ct state established,related goto handle_offload comment "defconf: handle forwarded flows" ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic" iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
} }
chain output { chain output {
@@ -43,13 +43,11 @@ table inet router {
ct state established,related accept comment "defconf: handle outbound flows" ct state established,related accept comment "defconf: handle outbound flows"
oif "lo" accept comment "defconf: accept traffic towards loopback" oif "lo" accept comment "defconf: accept traffic towards loopback"
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
} }
chain prerouting { chain prerouting {
type filter hook prerouting priority filter; policy accept; type filter hook prerouting priority filter; policy accept;
iifname "eth0" jump helper_lan comment "defconf: handle LAN IPv4 / IPv6 helper assignment"
iifname "tailscale0" jump helper_tailscale comment "tsconf: handle TS IPv4 / IPv6 helper assignment"
} }
chain syn_flood { chain syn_flood {
@@ -68,8 +66,8 @@ table inet router {
} }
chain forward_lan { chain forward_lan {
jump accept_to_tailscale comment "tsconf: accept LAN to TS forward" jump accept_to_tailscale comment "tsconf: accept LAN to TS forwarding"
ct status dnat accept comment "lanconf: accept port forward" ct status dnat accept comment "lanconf: accept port forwards"
jump accept_to_lan jump accept_to_lan
} }
@@ -77,16 +75,13 @@ table inet router {
jump accept_to_lan jump accept_to_lan
} }
chain helper_lan {
}
chain accept_from_lan { chain accept_from_lan {
iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }
chain accept_to_lan { chain accept_to_lan {
meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NATv4 leakage" meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NATv6 leakage" meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv6 leakage"
oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic" oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }
@@ -95,15 +90,12 @@ table inet router {
} }
chain forward_tailscale { chain forward_tailscale {
counter jump accept_to_lan comment "tsconf: accept TS to LAN forward" jump accept_to_lan comment "tsconf: accept TS to LAN forwarding"
counter jump accept_to_tailscale jump accept_to_tailscale
} }
chain output_tailscale { chain output_tailscale {
counter jump accept_to_tailscale jump accept_to_tailscale
}
chain helper_tailscale {
} }
chain accept_from_tailscale { chain accept_from_tailscale {
@@ -111,6 +103,8 @@ table inet router {
} }
chain accept_to_tailscale { chain accept_to_tailscale {
meta nfproto ipv4 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv4 leakage"
meta nfproto ipv6 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv6 leakage"
oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic" oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic"
} }
@@ -127,6 +121,7 @@ table inet router {
chain srcnat { chain srcnat {
type nat hook postrouting priority srcnat; policy accept; type nat hook postrouting priority srcnat; policy accept;
oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic" oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
oifname "tailscale0" jump srcnat_tailscale comment "tsconf: handle TS IPv4 / IPv6 srcnat traffic"
} }
chain dstnat_lan { chain dstnat_lan {
@@ -135,10 +130,14 @@ table inet router {
} }
chain srcnat_lan { chain srcnat_lan {
meta nfproto ipv4 counter masquerade comment "defconf: masquerade IPv4 LAN traffic" meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
meta nfproto ipv6 counter masquerade comment "defconf: masquerade IPv6 LAN traffic" meta nfproto ipv6 counter masquerade comment "defconf: masquerade LAN IPv6 traffic"
} }
chain srcnat_tailscale {
meta nfproto ipv4 counter masquerade comment "tsconf: masquerade TS IPv4 traffic"
meta nfproto ipv6 counter masquerade comment "tsconf: masquerade TS IPv6 traffic"
}
# #
# Raw rules (notrack) # Raw rules (notrack)