Initial LisgloSIPS V2 implementation

2026-06-22 10:56:38 +08:00
commit 5fa1bd35e9
303 changed files with 35644 additions and 0 deletions
@@ -0,0 +1,2 @@
+server ntp.aliyun.com iburst prefer minpoll 4 maxpoll 10
+server time1.cloud.tencent.com iburst minpoll 4 maxpoll 10
@@ -0,0 +1,11 @@
+[DEFAULT]
+backend = systemd
+bantime = 1h
+findtime = 10m
+maxretry = 5
+
+[sshd]
+enabled = true
+port = 22
+banaction = nftables-multiport
+ignoreip = 127.0.0.1/8 ::1 100.91.249.119
@@ -0,0 +1,27 @@
+destroy table inet lisglosips_filter
+
+table inet lisglosips_filter {
+    set admin_ipv4 {
+        type ipv4_addr
+        elements = { 100.91.249.119, 100.98.167.119 }
+    }
+
+    chain input {
+        type filter hook input priority 10; policy drop;
+
+        ct state invalid counter drop
+        ct state established,related counter accept
+        iifname "lo" counter accept
+
+        ip protocol icmp counter accept
+        ip6 nexthdr ipv6-icmp counter accept
+
+        udp dport 41641 counter accept comment "Tailscale direct transport"
+
+        iifname "tailscale0" ip saddr @admin_ipv4 tcp dport { 22, 443 } counter accept comment "Admin SSH and HTTPS"
+        iifname "tailscale0" ip saddr 100.90.90.90 tcp dport 6379 counter accept comment "Server A to Redis"
+        iifname "tailscale0" ip saddr 100.90.90.90 udp dport 9060 counter accept comment "Server A to HEP"
+
+        counter drop
+    }
+}
@@ -0,0 +1,2 @@
+#!/usr/sbin/nft -f
+include "/etc/nftables.d/lisglosips.nft"
@@ -0,0 +1,3 @@
+d /run/lisglosips 0750 lisglosips lisglosips -
+d /run/lisglo-recorder 0750 lisglo-recorder lisglosips -
+d /run/lisglo-monitor 0750 lisglo-monitor lisglosips -