|
|
|
@@ -1,7 +1,7 @@
|
|
|
|
|
#!/usr/sbin/nft -f
|
|
|
|
|
|
|
|
|
|
# This configuration file is customized by fox,
|
|
|
|
|
# Optimize nftables rules for Linux Router.
|
|
|
|
|
# Optimize nftables rules for local TS server.
|
|
|
|
|
|
|
|
|
|
table inet router
|
|
|
|
|
flush table inet router
|
|
|
|
@@ -29,7 +29,7 @@ table inet router {
|
|
|
|
|
ct state invalid counter drop comment "defconf: drop input flows with invalid conntrack state"
|
|
|
|
|
tcp flags & (fin | syn | rst | ack) == syn counter jump syn_flood comment "defconf: rate limit TCP-SYN packets"
|
|
|
|
|
iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
|
|
|
|
|
iifname "tailscale0" jump input_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 input traffic"
|
|
|
|
|
iifname "tailscale0" jump input_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 input traffic"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
chain forward {
|
|
|
|
@@ -38,7 +38,7 @@ table inet router {
|
|
|
|
|
ct state established,related accept comment "defconf: allow forwarded established and related flows"
|
|
|
|
|
ct state invalid counter drop comment "defconf: drop forward flows with invalid conntrack state"
|
|
|
|
|
iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
|
|
|
|
|
iifname "tailscale0" jump forward_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 forward traffic"
|
|
|
|
|
iifname "tailscale0" jump forward_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 forward traffic"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
chain output {
|
|
|
|
@@ -47,7 +47,7 @@ table inet router {
|
|
|
|
|
ct state established,related accept comment "defconf: allow outbound established and related flows"
|
|
|
|
|
ct state invalid counter drop comment "defconf: drop output flows with invalid conntrack state"
|
|
|
|
|
oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
|
|
|
|
|
oifname "tailscale0" jump output_tailscale comment "defconf: handle Tailscale IPv4 / IPv6 output traffic"
|
|
|
|
|
oifname "tailscale0" jump output_tailscale comment "tsconf: handle Tailscale IPv4 / IPv6 output traffic"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
chain prerouting {
|
|
|
|
@@ -66,7 +66,7 @@ table inet router {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
chain forward_lan {
|
|
|
|
|
jump accept_to_tailscale comment "lanconf: accept Tailscale forward"
|
|
|
|
|
jump accept_to_tailscale comment "tsconf: accept Tailscale forward"
|
|
|
|
|
ct status dnat counter accept comment "lanconf: accept port forward"
|
|
|
|
|
jump accept_to_lan
|
|
|
|
|
}
|
|
|
|
@@ -96,16 +96,16 @@ table inet router {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
chain forward_tailscale {
|
|
|
|
|
jump accept_to_lan comment "defconf: accept Tailscale to LAN forward"
|
|
|
|
|
jump accept_to_lan comment "tsconf: accept Tailscale to LAN forward"
|
|
|
|
|
jump accept_to_tailscale
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
chain accept_from_tailscale {
|
|
|
|
|
iifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic"
|
|
|
|
|
iifname "tailscale0" counter accept comment "tsconf: accept Tailscale IPv4 / IPv6 traffic"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
chain accept_to_tailscale {
|
|
|
|
|
oifname "tailscale0" counter accept comment "defconf: accept Tailscale IPv4 / IPv6 traffic"
|
|
|
|
|
oifname "tailscale0" counter accept comment "tsconf: accept Tailscale IPv4 / IPv6 traffic"
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|