From 6497efb00abe605382e38e8544df84a7f71017d3 Mon Sep 17 00:00:00 2001
From: CallMeR <9463297+callmer@user.noreply.gitee.com>
Date: Sat, 6 Jan 2024 14:59:35 +0800
Subject: [PATCH] =?UTF-8?q?=E5=90=8C=E6=AD=A5=E4=B8=8A=E6=B8=B8=E6=9B=B4?=
 =?UTF-8?q?=E6=96=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/debian/debian_ts_nftables.conf | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 8742ccc..fb377b1 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -24,25 +24,25 @@ table inet router {
 
     chain input {
         type filter hook input priority filter; policy drop;
-        iifname "lo" accept comment "defconf: accept traffic from loopback"
-        ct state established,related accept comment "defconf: allow inbound established and related flows"
-        tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
+        iif "lo" accept comment "defconf: accept traffic from loopback"
+        ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
+        tcp flags syn / fin,syn,rst,ack counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
         iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
         iifname "tailscale0" counter jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
     }
 
     chain forward {
         type filter hook forward priority filter; policy drop;
-        meta l4proto { tcp, udp } flow offload @ft comment "defconf: track forwarded flows"
-        ct state established,related accept comment "defconf: allow forwarded established and related flows"
+        meta l4proto { tcp, udp } flow add @ft comment "defconf: track forwarded flows"
+        ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows"
         iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
         iifname "tailscale0" counter jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
     }
 
     chain output {
         type filter hook output priority filter; policy accept;
-        oifname "lo" accept comment "defconf: accept traffic towards loopback"
-        ct state established,related accept comment "defconf: allow outbound established and related flows"
+        oif "lo" accept comment "defconf: accept traffic towards loopback"
+        ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows"
         oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
         oifname "tailscale0" counter jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
     }