|
|
@@ -0,0 +1,62 @@
|
|
|
+#!/usr/sbin/nft -f
|
|
|
+
|
|
|
+table inet global {
|
|
|
+ flowtable f {
|
|
|
+ hook ingress priority 0;
|
|
|
+ devices = { ppp0, lan };
|
|
|
+ }
|
|
|
+
|
|
|
+ chain input {
|
|
|
+ type filter hook input priority filter; policy drop;
|
|
|
+
|
|
|
+ iifname lo accept
|
|
|
+ iifname lan counter accept
|
|
|
+
|
|
|
+ # iifname ppp0 udp dport { 546, 547 } accept # IPv6 PD
|
|
|
+ ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit counter accept
|
|
|
+ ip6 nexthdr icmpv6 icmpv6 type nd-router-advert counter accept
|
|
|
+ udp dport dhcpv6-client udp sport dhcpv6-server counter accept comment "IPv6 DHCP"
|
|
|
+ ct state { established, related } counter accept
|
|
|
+ iifname ppp0 counter drop
|
|
|
+ }
|
|
|
+
|
|
|
+ chain forward {
|
|
|
+ type filter hook forward priority filter; policy drop;
|
|
|
+ # clamp MSS to PMTU
|
|
|
+ ip6 nexthdr tcp tcp flags syn tcp option maxseg size set rt mtu
|
|
|
+
|
|
|
+ ip protocol { tcp, udp } flow offload @f
|
|
|
+ ip6 nexthdr { tcp, udp } flow offload @f
|
|
|
+
|
|
|
+ iifname lan counter accept comment "Allow lan -> *"
|
|
|
+ iifname ppp0 oifname lan ct state { established, related } counter accept comment "Allow established back to lan"
|
|
|
+ iifname ppp0 oifname lan counter drop
|
|
|
+ }
|
|
|
+
|
|
|
+ chain postrouting {
|
|
|
+ type nat hook postrouting priority filter; policy accept;
|
|
|
+ ip saddr 192.168.5.0/24 oifname ppp0 counter masquerade
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
+
|
|
|
+table ip clash {
|
|
|
+ chain prerouting {
|
|
|
+ type nat hook prerouting priority filter; policy accept;
|
|
|
+ meta skuid clash counter return
|
|
|
+ ip daddr 198.18.0.0/16 tcp dport 1-65535 counter redirect to :7893 comment "!chnroute -> clash (tcp)"
|
|
|
+ ip daddr 198.18.0.0/16 udp dport 1-65535 meta mark set 0x233 tproxy to :7894 counter accept comment "!chnroute -> clash (udp)"
|
|
|
+ }
|
|
|
+
|
|
|
+ chain output {
|
|
|
+ type nat hook output priority mangle; policy accept;
|
|
|
+ meta skuid clash counter return
|
|
|
+ ip daddr 198.18.0.0/16 tcp dport 1-65535 counter redirect to :7893 comment "!chnroute -> clash (tcp) [local]"
|
|
|
+ ip daddr 198.18.0.0/16 udp dport 1-65535 meta mark set 0x233 counter comment "!chnroute -> clash (udp) [local]"
|
|
|
+ }
|
|
|
+
|
|
|
+ chain divert {
|
|
|
+ type filter hook prerouting priority mangle; policy accept;
|
|
|
+ ip protocol tcp socket transparent 1 meta mark set 0x233 accept
|
|
|
+ }
|
|
|
+}
|
