gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 22:12:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙

Browse Source
This commit is contained in:
CallMeR
2024-12-29 22:52:52 +08:00
parent 14022aebbf
commit 7e62ab3012
1 changed files with 6 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+6 -11
View File
@@ -76,13 +76,13 @@ table inet router {
} }
chain accept_from_lan { chain accept_from_lan {
iifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic" iifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }
chain accept_to_lan { chain accept_to_lan {
meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage" meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv6 leakage" meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv6 leakage"
oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic" oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }
chain input_tailscale { chain input_tailscale {
@@ -99,13 +99,13 @@ table inet router {
} }
chain accept_from_tailscale { chain accept_from_tailscale {
iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic" meta nfproto ipv4 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
meta nfproto ipv6 iifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
} }
chain accept_to_tailscale { chain accept_to_tailscale {
meta nfproto ipv4 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv4 leakage" meta nfproto ipv4 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 traffic"
meta nfproto ipv6 oifname "tailscale0" ct state invalid counter drop comment "tsconf: prevent TS NATv6 leakage" meta nfproto ipv6 oifname "tailscale0" counter accept comment "tsconf: accept TS IPv6 traffic"
oifname "tailscale0" counter accept comment "tsconf: accept TS IPv4 / IPv6 traffic"
} }
@@ -121,7 +121,6 @@ table inet router {
chain srcnat { chain srcnat {
type nat hook postrouting priority srcnat; policy accept; type nat hook postrouting priority srcnat; policy accept;
oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic" oifname "eth0" jump srcnat_lan comment "defconf: handle LAN IPv4 / IPv6 srcnat traffic"
oifname "tailscale0" jump srcnat_tailscale comment "tsconf: handle TS IPv4 / IPv6 srcnat traffic"
} }
chain dstnat_lan { chain dstnat_lan {
@@ -134,10 +133,6 @@ table inet router {
meta nfproto ipv6 counter masquerade comment "defconf: masquerade LAN IPv6 traffic" meta nfproto ipv6 counter masquerade comment "defconf: masquerade LAN IPv6 traffic"
} }
chain srcnat_tailscale {
meta nfproto ipv4 counter masquerade comment "tsconf: masquerade TS IPv4 traffic"
meta nfproto ipv6 counter masquerade comment "tsconf: masquerade TS IPv6 traffic"
}
# #
# Raw rules (notrack) # Raw rules (notrack)