gitproxy/pve_toss_notes
1
0
Fork 0
mirror of https://gitee.com/callmer/pve_toss_notes.git synced 2026-08-31 14:02:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

精简 TS 防火墙

Browse Source
This commit is contained in:
CallMeR
2025-01-07 13:25:40 +08:00
parent 17c0a3f87d
commit 90c7adc62d
1 changed files with 0 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/debian/debian_ts_nftables.conf
-44
View File
@@ -46,10 +46,6 @@ table inet router {
oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic" oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
} }
chain prerouting {
type filter hook prerouting priority filter; policy accept;
}
chain syn_flood { chain syn_flood {
limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit" limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
counter drop comment "defconf: drop excess new TCP connections" counter drop comment "defconf: drop excess new TCP connections"
@@ -81,7 +77,6 @@ table inet router {
chain accept_to_lan { chain accept_to_lan {
meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage" meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv4 leakage"
meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent LAN NATv6 leakage"
oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic" oifname "eth0" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
} }
@@ -130,45 +125,6 @@ table inet router {
chain srcnat_lan { chain srcnat_lan {
meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic" meta nfproto ipv4 counter masquerade comment "defconf: masquerade LAN IPv4 traffic"
meta nfproto ipv6 counter masquerade comment "defconf: masquerade LAN IPv6 traffic"
}
#
# Raw rules (notrack)
#
chain raw_prerouting {
type filter hook prerouting priority raw; policy accept;
}
chain raw_output {
type filter hook output priority raw; policy accept;
}
#
# Mangle rules
#
chain mangle_prerouting {
type filter hook prerouting priority mangle; policy accept;
}
chain mangle_postrouting {
type filter hook postrouting priority mangle; policy accept;
}
chain mangle_input {
type filter hook input priority mangle; policy accept;
}
chain mangle_output {
type route hook output priority mangle; policy accept;
}
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
} }
} }