gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 22:12:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 Nftables 规则

Browse Source
This commit is contained in:
CallMeR
2024-09-27 14:01:18 +08:00
parent ddc60fd6f1
commit 4bf1e1d523
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+3 -3
View File
@@ -26,7 +26,7 @@ table inet router {
type filter hook input priority filter; policy drop; type filter hook input priority filter; policy drop;
iif "lo" accept comment "defconf: accept traffic from loopback" iif "lo" accept comment "defconf: accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows" ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
tcp flags syn / fin,syn,rst,ack counter jump syn_flood comment "defconf: rate limit TCP-SYN packets" ct state new meta l4proto tcp counter jump syn_flood comment "defconf: rate limit new TCP connections"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic" iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
} }
@@ -54,8 +54,8 @@ table inet router {
} }
chain syn_flood { chain syn_flood {
limit rate 200/second burst 100 packets return comment "defconf: accept SYN packets below rate-limit" limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
counter drop comment "defconf: drop excess packets" counter drop comment "defconf: drop excess new TCP connections"
} }
chain input_lan { chain input_lan {