gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 22:12:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙配置

Browse Source
This commit is contained in:
CallMeR
2025-04-15 17:29:38 +08:00
parent 5e228452ec
commit 19f5d89152
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+6 -2
View File
@@ -41,7 +41,7 @@ table inet router {
chain output { chain output {
type filter hook output priority filter; policy accept; type filter hook output priority filter; policy accept;
ct state established,related accept comment "defconf: handle outbound flows" ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle outbound flows"
oif "lo" accept comment "defconf: accept traffic towards loopback" oif "lo" accept comment "defconf: accept traffic towards loopback"
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
@@ -77,7 +77,6 @@ table inet router {
} }
chain accept_to_lan { chain accept_to_lan {
meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }
@@ -133,6 +132,11 @@ table inet router {
# Mangle rules # Mangle rules
# #
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
ct state invalid counter drop comment "defconf: drop packets in invalid flow state"
}
chain mangle_postrouting { chain mangle_postrouting {
type filter hook postrouting priority mangle; policy accept; type filter hook postrouting priority mangle; policy accept;
oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing" oifname "eth0" tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"