From 19f5d89152365b67ca1a4c68b96654ddcf94d12a Mon Sep 17 00:00:00 2001
From: CallMeR <9463297+callmer@user.noreply.gitee.com>
Date: Tue, 15 Apr 2025 17:29:38 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20TS=20=E9=98=B2=E7=81=AB?=
 =?UTF-8?q?=E5=A2=99=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/debian/debian_ts_nftables.conf | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index cd6790a..a1c73ad 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -41,7 +41,7 @@ table inet router {
 
     chain output {
         type filter hook output priority filter; policy accept;
-        ct state established,related accept comment "defconf: handle outbound flows"
+        ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle outbound flows"
         oif "lo" accept comment "defconf: accept traffic towards loopback"
         oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
         oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
@@ -77,7 +77,6 @@ table inet router {
     }
 
     chain accept_to_lan {
-        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
         oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
@@ -133,6 +132,11 @@ table inet router {
     # Mangle rules
     #
 
+    chain mangle_prerouting {
+        type filter hook prerouting priority mangle; policy accept;
+        ct state invalid counter drop comment "defconf: drop packets in invalid flow state"
+    }
+
     chain mangle_postrouting {
         type filter hook postrouting priority mangle; policy accept;
         oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"