1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162 |
- #!/usr/sbin/nft -f
- table inet global {
- flowtable f {
- hook ingress priority 0;
- devices = { ppp0, lan };
- }
- chain input {
- type filter hook input priority filter; policy drop;
- iifname lo accept
- iifname lan counter accept
- # iifname ppp0 udp dport { 546, 547 } accept # IPv6 PD
- ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit counter accept
- ip6 nexthdr icmpv6 icmpv6 type nd-router-advert counter accept
- udp dport dhcpv6-client udp sport dhcpv6-server counter accept comment "IPv6 DHCP"
- ct state { established, related } counter accept
- iifname ppp0 counter drop
- }
- chain forward {
- type filter hook forward priority filter; policy drop;
- # clamp MSS to PMTU
- ip6 nexthdr tcp tcp flags syn tcp option maxseg size set rt mtu
- ip protocol { tcp, udp } flow offload @f
- ip6 nexthdr { tcp, udp } flow offload @f
- iifname lan counter accept comment "Allow lan -> *"
- iifname ppp0 oifname lan ct state { established, related } counter accept comment "Allow established back to lan"
- iifname ppp0 oifname lan counter drop
- }
- chain postrouting {
- type nat hook postrouting priority filter; policy accept;
- ip saddr 192.168.5.0/24 oifname ppp0 counter masquerade
- }
- }
- table ip clash {
- chain prerouting {
- type nat hook prerouting priority filter; policy accept;
- meta skuid clash counter return
- ip daddr 198.18.0.0/16 tcp dport 1-65535 counter redirect to :7893 comment "!chnroute -> clash (tcp)"
- ip daddr 198.18.0.0/16 udp dport 1-65535 meta mark set 0x233 tproxy to :7894 counter accept comment "!chnroute -> clash (udp)"
- }
- chain output {
- type nat hook output priority mangle; policy accept;
- meta skuid clash counter return
- ip daddr 198.18.0.0/16 tcp dport 1-65535 counter redirect to :7893 comment "!chnroute -> clash (tcp) [local]"
- ip daddr 198.18.0.0/16 udp dport 1-65535 meta mark set 0x233 counter comment "!chnroute -> clash (udp) [local]"
- }
- chain divert {
- type filter hook prerouting priority mangle; policy accept;
- ip protocol tcp socket transparent 1 meta mark set 0x233 accept
- }
- }
|