Initial LisgloSIPS V2 implementation

2026-06-22 10:56:38 +08:00
commit 5fa1bd35e9
303 changed files with 35644 additions and 0 deletions
@@ -0,0 +1,27 @@
+destroy table inet lisglosips_filter
+
+table inet lisglosips_filter {
+    set admin_ipv4 {
+        type ipv4_addr
+        elements = { 100.91.249.119, 100.98.167.119 }
+    }
+
+    chain input {
+        type filter hook input priority 10; policy drop;
+
+        ct state invalid counter drop
+        ct state established,related counter accept
+        iifname "lo" counter accept
+
+        ip protocol icmp counter accept
+        ip6 nexthdr ipv6-icmp counter accept
+
+        udp dport 41641 counter accept comment "Tailscale direct transport"
+
+        iifname "tailscale0" ip saddr @admin_ipv4 tcp dport { 22, 443 } counter accept comment "Admin SSH and HTTPS"
+        iifname "tailscale0" ip saddr 100.90.90.90 tcp dport 6379 counter accept comment "Server A to Redis"
+        iifname "tailscale0" ip saddr 100.90.90.90 udp dport 9060 counter accept comment "Server A to HEP"
+
+        counter drop
+    }
+}