Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-06-29 00:47:20 -04:00
Code Issues Projects Releases Packages Wiki Activity

merge synproxy rules

Browse source
This commit is contained in:
Daniel Micay 2024-03-31 22:25:38 -04:00
parent 9fcac6b105
commit 83bcc0b327
3 changed files with 3 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nftables-network.conf
View file

@ -71,10 +71,9 @@ table inet filter {
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport 7275 ip saddr @ip-connlimit-supl counter reject with tcp reset tcp dport 7275 ip saddr @ip-connlimit-supl counter reject with tcp reset
tcp dport 7275 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-supl counter reject with tcp reset tcp dport 7275 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-supl counter reject with tcp reset
tcp dport 7275 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport { 22, 7275 } synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-loopback { chain input-loopback {

3
nftables-ns1.conf
View file

@ -66,10 +66,9 @@ table inet filter {
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport { 53, 80, 443, 853 } ip saddr @ip-connlimit-main counter reject with tcp reset tcp dport { 53, 80, 443, 853 } ip saddr @ip-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 53, 80, 443, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport { 22, 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-loopback { chain input-loopback {

3
nftables-ns2.conf
View file

@ -71,10 +71,9 @@ table inet filter {
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport { 53, 80, 443, 853 } ip saddr @ip-connlimit-main counter reject with tcp reset tcp dport { 53, 80, 443, 853 } ip saddr @ip-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 53, 80, 443, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset
tcp dport { 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport { 22, 53, 80, 443, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-loopback { chain input-loopback {