From 7e62ab3012501e9c7e798987deaeb14f0791312e Mon Sep 17 00:00:00 2001
From: CallMeR <9463297+callmer@user.noreply.gitee.com>
Date: Sun, 29 Dec 2024 22:52:52 +0800
Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0=20TS=20=E9=98=B2=E7=81=AB?=
 =?UTF-8?q?=E5=A2=99?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/debian/debian_ts_nftables.conf | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index dedeba2..0ca4c04 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -76,13 +76,13 @@ table inet router {
     }
 
     chain accept_from_lan {
-        iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+        iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
     chain accept_to_lan {
         meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
         meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv6 leakage"
-        oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
+        oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
     chain input_tailscale {
@@ -99,13 +99,13 @@ table inet router {
     }
 
     chain accept_from_tailscale {
-        iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic"
+        meta nfproto ipv4 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
+        meta nfproto ipv6 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
     }
 
     chain accept_to_tailscale {
-        meta nfproto ipv4 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv4 leakage"
-        meta nfproto ipv6 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv6 leakage"
-        oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic"
+        meta nfproto ipv4 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
+        meta nfproto ipv6 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
     }
 
 
@@ -121,7 +121,6 @@ table inet router {
     chain srcnat {
         type nat hook postrouting priority srcnat; policy accept;
         oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
-        oifname "tailscale0" jump srcnat_tailscale comment "tsconf: handle TS IPv4 / IPv6 srcnat traffic"
     }
 
     chain dstnat_lan {
@@ -134,10 +133,6 @@ table inet router {
         meta nfproto ipv6 counter masquerade comment "defconf: masquerade LAN IPv6 traffic"
     }
 
-    chain srcnat_tailscale {
-        meta nfproto ipv4 counter masquerade comment "tsconf: masquerade TS IPv4 traffic"
-        meta nfproto ipv6 counter masquerade comment "tsconf: masquerade TS IPv6 traffic"
-    }
 
     #
     # Raw rules (notrack)