gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 14:02:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙

Browse Source
This commit is contained in:
CallMeR
2023-11-29 13:48:55 +08:00
parent 5b65602c07
commit 2407555015
1 changed files with 8 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+8 -10
View File
@@ -29,7 +29,7 @@ table inet router {
ct state invalid counter drop comment "defconf: drop input flows with invalid conntrack state" ct state invalid counter drop comment "defconf: drop input flows with invalid conntrack state"
tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets" tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
iifname "tailscale0" jump input_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 input traffic" iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 input traffic"
} }
chain forward { chain forward {
@@ -38,7 +38,7 @@ table inet router {
ct state established,related accept comment "defconf: allow forwarded established and related flows" ct state established,related accept comment "defconf: allow forwarded established and related flows"
ct state invalid counter drop comment "defconf: drop forward flows with invalid conntrack state" ct state invalid counter drop comment "defconf: drop forward flows with invalid conntrack state"
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
iifname "tailscale0" jump forward_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 forward traffic" iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 forward traffic"
} }
chain output { chain output {
@@ -47,7 +47,7 @@ table inet router {
ct state established,related accept comment "defconf: allow outbound established and related flows" ct state established,related accept comment "defconf: allow outbound established and related flows"
ct state invalid counter drop comment "defconf: drop output flows with invalid conntrack state" ct state invalid counter drop comment "defconf: drop output flows with invalid conntrack state"
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
oifname "tailscale0" jump output_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 output traffic" oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 output traffic"
} }
chain prerouting { chain prerouting {
@@ -92,12 +92,12 @@ table inet router {
} }
chain forward_tailscale { chain forward_tailscale {
jump accept_to_lan comment "tsconf: accept Tailscale to LAN forward" counter jump accept_to_lan comment "tsconf: accept Tailscale to LAN forward"
jump accept_to_tailscale counter jump accept_to_tailscale
} }
chain output_tailscale { chain output_tailscale {
jump accept_to_tailscale counter jump accept_to_tailscale
} }
chain accept_from_tailscale { chain accept_from_tailscale {
@@ -115,7 +115,7 @@ table inet router {
chain dstnat { chain dstnat {
type nat hook prerouting priority dstnat; policy accept; type nat hook prerouting priority dstnat; policy accept;
iifname "eth0" meta l4proto { tcp, udp } th dport domain counter jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic" iifname "eth0" meta l4proto { tcp, udp } th dport domain jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
} }
chain srcnat { chain srcnat {
@@ -129,7 +129,7 @@ table inet router {
} }
chain srcnat_lan { chain srcnat_lan {
meta nfproto ipv4 masquerade comment "defconf: masquerade IPv4 LAN traffic" meta nfproto ipv4 counter masquerade comment "defconf: masquerade IPv4 LAN traffic"
} }
@@ -168,8 +168,6 @@ table inet router {
chain mangle_forward { chain mangle_forward {
type filter hook forward priority mangle; policy accept; type filter hook forward priority mangle; policy accept;
iifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 ingress MTU fixing"
oifname "eth0" tcp flags syn tcp option maxseg size set rt mtu comment "defconf: zone LAN IPv4 / IPv6 egress MTU fixing"
} }
} }