rodrigo/server-mv
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix nftables

Browse Source
This commit is contained in:
Rodrigo Bertoldo de Sousa Martins committed 2026-09-13 20:53:23 -03:00
1 parent 01d7cb1a80
commit 8e4d62c615
2 files changed
+9 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

nftables.conf
+6 -6
View File
@@ -47,8 +47,8 @@ table inet filter {
# ICMP/ICMPv6: 2º maior volume medido no host, avaliado cedo # ICMP/ICMPv6: 2º maior volume medido no host, avaliado cedo
# de propósito (dados reais: ~66k pacotes/dia, ficava por # de propósito (dados reais: ~66k pacotes/dia, ficava por
# último na versão antiga em iptables). # último na versão antiga em iptables).
ip protocol icmp jump icmpv4 ip protocol icmp jump icmpv4_in
meta l4proto ipv6-icmp jump icmpv6 meta l4proto icmpv6 jump icmpv6_in
# Pacotes TCP malformados / scanners óbvios # Pacotes TCP malformados / scanners óbvios
tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|syn|rst|psh|ack|urg) \ tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|syn|rst|psh|ack|urg) \
@@ -93,22 +93,22 @@ table inet filter {
ct state established,related accept ct state established,related accept
iifname "tun0" accept iifname "tun0" accept
iifname "wg0" accept iifname "wg0" accept
tcp daddr 10.15.0.45 dport { 80, 443 } accept ip daddr 10.15.0.45 tcp dport { 80, 443 } accept
tcp ip6 daddr 2001:db8:15::45 dport { 80, 443 } accept ip6 daddr 2001:db8:15::45 tcp dport { 80, 443 } accept
} }
chain output { chain output {
type filter hook output priority filter; policy accept; type filter hook output priority filter; policy accept;
} }
chain icmpv4 { chain icmpv4_in {
icmp type echo-reply accept icmp type echo-reply accept
icmp type echo-request limit rate 1/second burst 3 packets accept icmp type echo-request limit rate 1/second burst 3 packets accept
icmp type echo-request drop icmp type echo-request drop
drop drop
} }
chain icmpv6 { chain icmpv6_in {
icmpv6 type destination-unreachable accept icmpv6 type destination-unreachable accept
icmpv6 type packet-too-big limit rate 5/minute accept icmpv6 type packet-too-big limit rate 5/minute accept
icmpv6 type time-exceeded limit rate 5/minute accept icmpv6 type time-exceeded limit rate 5/minute accept
rc.local
+3 -3
View File
@@ -45,11 +45,11 @@ touch /var/lock/subsys/local
# 3. XDP / eBPF # 3. XDP / eBPF
# ============================================================== # ==============================================================
ip link set enp0s6 mtu 1500 ip link set enp0s6 mtu 1500
ip link set dev enp0s6 xdp obj /home/rodrigo/xdp/xdp_ddos_filter.o sec xdp ip link set dev enp0s6 xdp obj /home/rodrigo/server-mv/xdp/xdp_ddos_filter.o sec xdp
ip link set dev wg0 xdp obj /home/rodrigo/xdp/xdp_wg_mtu_optimizer.o sec xdp ip link set dev wg0 xdp obj /home/rodrigo/server-mv/xdp/xdp_wg_mtu_optimizer.o sec xdp
# A bridge do Docker muda de nome a cada recriação da rede (hash do ID), # A bridge do Docker muda de nome a cada recriação da rede (hash do ID),
# então esse link precisa ser reaplicado se a rede "dockernet" for recriada. # então esse link precisa ser reaplicado se a rede "dockernet" for recriada.
ip link set dev br-02f7820020b4 xdp obj /home/rodrigo/xdp/bridge_xdp.o sec xdp ip link set dev br-02f7820020b4 xdp obj /home/rodrigo/server-mv/xdp/bridge_xdp.o sec xdp
cd /home/docker/ebpf-sockmap/ && make load cd /home/docker/ebpf-sockmap/ && make load