Allow all private IPv4 traffic by default in Debian initialization firewall

2026-11-04 22:46:18 +08:00
parent 56b506e54d
commit db1bd78bec
3 changed files with 22 additions and 5 deletions
--- a/firewall.sh
+++ b/firewall.sh
@@ -36,6 +36,8 @@ table inet platform_host {
    iifname != "tailscale0" ip saddr 100.64.0.0/10 drop
    ct state invalid drop
    ct state established,related accept
+    iifname "tailscale0" ip saddr 100.64.0.0/10 accept
+    iifname != "tailscale0" ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 } accept
    meta l4proto icmp accept
    meta l4proto ipv6-icmp accept
    udp sport 67 udp dport 68 accept