Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-07-21 06:03:11 -04:00
Code Issues Projects Releases Packages Wiki Activity

scale synproxy threshold based on conntrack max

Browse source
This commit is contained in:
Daniel Micay 2025-06-22 22:06:29 -04:00
parent bb797f412b
commit 8b87654075
10 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
deploy-initial
View file

@ -58,7 +58,9 @@ sed -i "s/{{ssh_users}}/${hosts_ssh_users[$host]:-root}/g" etc/ssh/sshd_config.t
rsync -cv etc/ssh/sshd_config.tmp $remote:/mnt/etc/ssh/sshd_config
rm etc/ssh/sshd_config.tmp
rsync -cv etc/nftables/nftables-${hosts_firewall[$host]:-web}.conf $remote:/mnt/etc/nftables.conf
synproxy_threshold=$(( ${hosts_conntrack_size[$host]} / 64 ))
sed "s/{{synproxy_threshold}}/$synproxy_threshold/g" etc/nftables/nftables-${hosts_firewall[$host]:-web}.conf >tmp
rsync -cv tmp $remote:/mnt/etc/nftables.conf
ssh $remote "arch-chroot /mnt systemctl enable chronyd.service fstrim.timer logrotate.timer nftables.service systemd-networkd.service systemd-oomd.service sshd.service sysstat.service unbound.service"
ssh $remote "arch-chroot /mnt systemctl disable remote-fs.target systemd-network-generator.service systemd-userdbd.socket"

2
etc/nftables/nftables-attestation.conf
View file

@ -38,7 +38,7 @@ table inet filter {
fib daddr . iif type != { local, broadcast, multicast } counter drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 80, 443 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 80, 443 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept

2
etc/nftables/nftables-discuss.conf
View file

@ -38,7 +38,7 @@ table inet filter {
fib daddr . iif type != { local, broadcast, multicast } counter drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 80, 443 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 80, 443 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept

2
etc/nftables/nftables-mail.conf
View file

@ -50,7 +50,7 @@ table inet filter {
fib daddr . iif type != { local, broadcast, multicast } counter drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 25, 80, 443, 465, 993 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 25, 80, 443, 465, 993 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept

2
etc/nftables/nftables-matrix.conf
View file

@ -38,7 +38,7 @@ table inet filter {
fib daddr . iif type != { local, broadcast, multicast } counter drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 80, 443 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 80, 443 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept

2
etc/nftables/nftables-network.conf
View file

@ -46,7 +46,7 @@ table inet filter {
fib daddr . iif type != { local, broadcast, multicast } counter drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 80, 443, 7275 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 80, 443, 7275 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
udp dport 123 notrack accept

2
etc/nftables/nftables-ns1.conf
View file

@ -54,7 +54,7 @@ table inet filter {
tcp dport 22 ip6 daddr $ip6-anycast drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 53, 80, 443, 853 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 53, 80, 443, 853 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept

2
etc/nftables/nftables-ns2.conf
View file

@ -52,7 +52,7 @@ table inet filter {
tcp dport 22 ip daddr $ip-anycast drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 53, 80, 443, 853 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 53, 80, 443, 853 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept

2
etc/nftables/nftables-social.conf
View file

@ -38,7 +38,7 @@ table inet filter {
fib daddr . iif type != { local, broadcast, multicast } counter drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 80, 443 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 80, 443 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept

2
etc/nftables/nftables-web.conf
View file

@ -48,7 +48,7 @@ table inet filter {
fib daddr . iif type != { local, broadcast, multicast } counter drop
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 80, 443 } tcp flags syn limit rate over 1024/second burst 1024 packets counter notrack accept
tcp dport { 22, 80, 443 } tcp flags syn limit rate over {{synproxy_threshold}}/second burst {{synproxy_threshold}} packets counter notrack accept
meta l4proto { tcp, udp } accept
icmp type { echo-reply, destination-unreachable, echo-request, time-exceeded, parameter-problem } notrack accept