jsimonetti / sniqueue Goto Github PK

flush ruleset

table inet filter {
	flowtable f {
		hook ingress priority 0;
	}

	chain input {
		type filter hook input priority filter; policy accept;
	}

	chain sniqueue {
		type filter hook forward priority -2; policy accept;

		ct mark 101 accept comment "Accept known good SNI not yet offloaded"
		tcp dport 443 ct mark 100 reject with tcp reset comment "Reject known bad TCP SNI"
		udp dport 443 ct mark 100 reject with icmp type port-unreachable comment "Reject known bad QUIC SNI"
		tcp dport 443 ct mark set 102 comment "Mark all unjudged packets"
		udp dport 443 ct mark set 102 comment "Mark all unjudged packets"
		meta mark set ct mark
		tcp dport 443 ct original packets <20 queue num 100 bypass
		udp dport 443 ct original packets <20 queue num 100 bypass
	}

	chain sniqueue_block {
		type filter hook forward priority -1; policy accept;
		ct mark set meta mark
		ct mark 102 accept comment "Accept packets without verdict"
		tcp dport 443 ct mark 100 reject with tcp reset comment "Reject known bad TCP"
		udp dport 443 ct mark 100 reject with icmp type port-unreachable comment "Reject known bad QUIC"
		ct mark 101 flow offload @f comment "Offload known good SNI"
	}

	chain forward {
		type filter hook forward priority filter; policy accept;
		ct mark != 102 flow offload @f comment "Offload packets not sent to SNIqueue"
	}

	chain output {
		type filter hook output priority filter; policy accept;
	}
}
table ip filter {
	chain INPUT {
		type filter hook input priority filter; policy accept;
	}

	chain FORWARD {
		type filter hook forward priority filter; policy accept;
	}

	chain OUTPUT {
		type filter hook output priority filter; policy accept;
	}
}
table ip nat {
	chain PREROUTING {
		type nat hook prerouting priority dstnat; policy accept;
	}

	chain INPUT {
		type nat hook input priority 100; policy accept;
	}

	chain OUTPUT {
		type nat hook output priority -100; policy accept;
	}

	chain POSTROUTING {
		type nat hook postrouting priority srcnat; policy accept;
		ct state new,related,established counter packets 91 bytes 6939 masquerade
	}
}