gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 14:02:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新 TS 防火墙

Browse Source
This commit is contained in:
CallMeR
2025-04-16 17:46:22 +08:00
parent 7c6c92d7ed
commit 8a6bdbe207
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
+6 -7
View File
@@ -25,17 +25,16 @@ table inet router {
chain input {
type filter hook input priority filter; policy drop;
ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle inbound flows"
ct state established,related accept comment "defconf: handle inbound flows"
iif "lo" accept comment "defconf: accept traffic from loopback"
ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state established,related flow add @ft comment "defconf: track forwarded flows"
ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle forwarded flows"
ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
ct state invalid counter drop comment "defconf: drop invalid forwarded flows"
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
}
@@ -48,9 +47,9 @@ table inet router {
oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
}
chain syn_flood {
limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
counter drop comment "defconf: drop excess new TCP connections"
chain handle_offload {
flow add @ft accept comment "defconf: track forwarded flows"
accept
}
chain input_lan {