Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2024-12-22 13:45:02 -05:00
Code Issues Packages Projects Releases Wiki Activity

merge synproxy rules

Browse Source
This commit is contained in:
Daniel Micay 2024-03-31 22:25:38 -04:00
parent 9fcac6b105
commit 83bcc0b327
3 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nftables-network.conf
View File

@ -71,10 +71,9 @@ table inet filter {
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport 7275 ip saddr @ip-connlimit-supl counter reject with tcp reset
tcp dport 7275 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-supl counter reject with tcp reset
tcp dport 7275 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport { 22, 7275 } synproxy mss 1460 wscale 7 timestamp sack-perm
}
chain input-loopback {

3
nftables-ns1.conf
View File

@ -66,10 +66,9 @@ table inet filter {
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport { 53, 80, 443, 853 } ip saddr @ip-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport { 22, 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
}
chain input-loopback {

3
nftables-ns2.conf
View File

@ -71,10 +71,9 @@ table inet filter {
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport { 53, 80, 443, 853 } ip saddr @ip-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport { 22, 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
}
chain input-loopback {