gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 05:52:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙

Browse Source
This commit is contained in:
CallMeR
2025-04-18 09:57:03 +08:00
parent 1dd2c5ae24
commit 509e328c03
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+8 -7
View File
@@ -25,31 +25,32 @@ table inet router {
chain input { chain input {
type filter hook input priority filter; policy drop; type filter hook input priority filter; policy drop;
ct state established,related accept comment "defconf: handle inbound flows"
iif "lo" accept comment "defconf: accept traffic from loopback" iif "lo" accept comment "defconf: accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "defconf: rate limit new TCP connections"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic" iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic" iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
} }
chain forward { chain forward {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
ct state established,related goto handle_offload comment "defconf: handle forwarded flows" ct state established,related flow add @ft;
ct state invalid counter drop comment "defconf: drop packets in invalid flow state" ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows"
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic" iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic" iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
} }
chain output { chain output {
type filter hook output priority filter; policy accept; type filter hook output priority filter; policy accept;
ct state established,related accept comment "defconf: handle outbound flows"
oif "lo" accept comment "defconf: accept traffic towards loopback" oif "lo" accept comment "defconf: accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows"
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic" oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
} }
chain handle_offload { chain syn_flood {
flow add @ft accept comment "defconf: track forwarded flows" limit rate 50/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
accept counter drop comment "defconf: drop excess new TCP connections"
} }
chain input_lan { chain input_lan {