diff options
| author | Xiao Pan <gky44px1999@gmail.com> | 2023-12-03 10:12:33 +0000 |
|---|---|---|
| committer | Xiao Pan <gky44px1999@gmail.com> | 2023-12-03 10:12:33 +0000 |
| commit | 392092019bfb3266c7596c857ce01bc5e49eb0bd (patch) | |
| tree | c157e057e252ff667f90dfbd1ddca9cf16fc93b7 /etc | |
| parent | f1131958e4d6579724c42e114620328d2414824e (diff) | |
maybe prevent ipv6 leak
Diffstat (limited to 'etc')
| -rw-r--r-- | etc/nftables.conf | 4 | ||||
| -rw-r--r-- | etc/sysctl.d/99-sysctl.conf | 3 |
2 files changed, 4 insertions, 3 deletions
diff --git a/etc/nftables.conf b/etc/nftables.conf index 2dba5a76..7132abfd 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -58,7 +58,9 @@ table inet my_table { # https://wiki.gentoo.org/wiki/Nftables/Examples#Basic_NAT # needed by wireguard? -table ip nat { +# Need inet to masquerade both ipv4 and ipv6? If use ip it will only masquerade ipv4? If use ip6 it will only masquerade ipv6? +# https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families +table inet nat { chain prerouting { type nat hook prerouting priority 0; policy accept; } diff --git a/etc/sysctl.d/99-sysctl.conf b/etc/sysctl.d/99-sysctl.conf index 00f01949..b9677c02 100644 --- a/etc/sysctl.d/99-sysctl.conf +++ b/etc/sysctl.d/99-sysctl.conf @@ -4,5 +4,4 @@ # https://wiki.archlinux.org/title/Nftables#NAT_with_port_forwarding # https://github.com/teddysun/across/blob/acef6b00a6ad062c0e99286ea136d1a246def644/wireguard.sh#L514-L522 net.ipv4.ip_forward = 1 -# ka no ipv6. Test shows if enable this, it will expose my workstation's ipv6. If it has ipv6, maybe also need `table ip6 nat` in nftables.conf to hide workstation's ipv6? -#net.ipv6.conf.all.forwarding = 1 +net.ipv6.conf.all.forwarding = 1 |