From 8e4d62c6151a325ad50f64cc2cad2d1a4d655d60 Mon Sep 17 00:00:00 2001 From: Rodrigo Bertoldo de Sousa Martins Date: Sun, 13 Sep 2026 20:53:23 -0300 Subject: [PATCH] fix nftables --- nftables.conf | 12 ++++++------ rc.local | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/nftables.conf b/nftables.conf index 160d581..8c23b37 100644 --- a/nftables.conf +++ b/nftables.conf @@ -47,8 +47,8 @@ table inet filter { # ICMP/ICMPv6: 2º maior volume medido no host, avaliado cedo # de propósito (dados reais: ~66k pacotes/dia, ficava por # último na versão antiga em iptables). - ip protocol icmp jump icmpv4 - meta l4proto ipv6-icmp jump icmpv6 + ip protocol icmp jump icmpv4_in + meta l4proto icmpv6 jump icmpv6_in # Pacotes TCP malformados / scanners óbvios tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|syn|rst|psh|ack|urg) \ @@ -93,22 +93,22 @@ table inet filter { ct state established,related accept iifname "tun0" accept iifname "wg0" accept - tcp daddr 10.15.0.45 dport { 80, 443 } accept - tcp ip6 daddr 2001:db8:15::45 dport { 80, 443 } accept + ip daddr 10.15.0.45 tcp dport { 80, 443 } accept + ip6 daddr 2001:db8:15::45 tcp dport { 80, 443 } accept } chain output { type filter hook output priority filter; policy accept; } - chain icmpv4 { + chain icmpv4_in { icmp type echo-reply accept icmp type echo-request limit rate 1/second burst 3 packets accept icmp type echo-request drop drop } - chain icmpv6 { + chain icmpv6_in { icmpv6 type destination-unreachable accept icmpv6 type packet-too-big limit rate 5/minute accept icmpv6 type time-exceeded limit rate 5/minute accept diff --git a/rc.local b/rc.local index a9d2575..170a0ca 100755 --- a/rc.local +++ b/rc.local @@ -45,11 +45,11 @@ touch /var/lock/subsys/local # 3. XDP / eBPF # ============================================================== ip link set enp0s6 mtu 1500 -ip link set dev enp0s6 xdp obj /home/rodrigo/xdp/xdp_ddos_filter.o sec xdp -ip link set dev wg0 xdp obj /home/rodrigo/xdp/xdp_wg_mtu_optimizer.o sec xdp +ip link set dev enp0s6 xdp obj /home/rodrigo/server-mv/xdp/xdp_ddos_filter.o sec xdp +ip link set dev wg0 xdp obj /home/rodrigo/server-mv/xdp/xdp_wg_mtu_optimizer.o sec xdp # A bridge do Docker muda de nome a cada recriação da rede (hash do ID), # então esse link precisa ser reaplicado se a rede "dockernet" for recriada. -ip link set dev br-02f7820020b4 xdp obj /home/rodrigo/xdp/bridge_xdp.o sec xdp +ip link set dev br-02f7820020b4 xdp obj /home/rodrigo/server-mv/xdp/bridge_xdp.o sec xdp cd /home/docker/ebpf-sockmap/ && make load