hacker07/NeoTachyon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(nft): разрешать TPROXY-трафик с меткой в цепочке input fw4 для работы в изолированных зонах (Guest/VLAN)

Browse Source
This commit is contained in:
Dushnilin
2026-08-18 14:22:38 +03:00
parent 5fc9dda229
commit 3fb6a4b643
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tachyon/files/usr/lib/nft/apply.uc
+12
View File
@@ -1751,6 +1751,18 @@ function ensure_tproxy_route_rule(table, mark, rt_tables_path) {
if (index(fw4_forward_out, "meta mark " + as_string(mark)) < 0) {
run_args([ "nft", "insert", "rule", "inet", "fw4", "forward", "meta", "mark", as_string(mark), "return" ]);
}
let fw4_input_out = command_output_from_args([ "nft", "list", "chain", "inet", "fw4", "input" ]);
if (index(fw4_input_out, "meta mark & " + as_string(mark)) < 0 && index(fw4_input_out, "meta mark " + as_string(mark)) < 0) {
run_args([ "nft", "insert", "rule", "inet", "fw4", "input", "meta", "mark", "&", as_string(mark), "==", as_string(mark), "accept", "comment", "\"Allow Tachyon TPROXY marked traffic\"" ]);
}
let fw4_include_dir = "/usr/share/nftables.d/chain-pre/input";
let fw4_include_file = fw4_include_dir + "/10-tachyon.nft";
if (fs.stat("/usr/share/nftables.d") != null) {
system(sprintf("mkdir -p %s >/dev/null 2>&1", shell_quote(fw4_include_dir)));
write_text_file(fw4_include_file, sprintf("meta mark & %s == %s accept comment \"Allow Tachyon TPROXY marked traffic\"\n", as_string(mark), as_string(mark)));
}
return true;
}
uninstall.sh
+1
View File
@@ -199,6 +199,7 @@ if command -v nft >/dev/null 2>&1; then
nft delete table inet tachyon >/dev/null 2>&1 || true
nft delete table ip tachyon >/dev/null 2>&1 || true
nft delete table ip6 tachyon >/dev/null 2>&1 || true
rm -f /usr/share/nftables.d/chain-pre/input/10-tachyon.nft 2>/dev/null || true
tui_ok "Таблицы nftables (TachyonTable) успешно удалены"
fi