把 ArchLinux 当成无线路由器用

刚进货一台新服务器，有两个有线网口，只有四个 PCIe，插一个无线网卡太浪费。那么就让他走到另一台有无线网卡的机器上网吧！

sudo pacman -S nftables

-> % cat /etc/nftables.conf
#!/usr/bin/nft -f
# vim:set ts=2 sw=2 et:

# IPv4/IPv6 Simple & Safe firewall ruleset.
# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.

destroy table inet filter
table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    ct state invalid drop comment "early drop of invalid connections"
    ct state {established, related} accept comment "allow tracked connections"
    iif lo accept comment "allow from loopback"
    ip protocol icmp accept comment "allow icmp"
    meta l4proto ipv6-icmp accept comment "allow icmp v6"
    tcp dport ssh accept comment "allow sshd"
    pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
    counter
  }

  chain forward {
    type filter hook forward priority 0; policy drop;
    iifname "enp2s0" oifname "wlo1" accept
    ct state established,related accept
  }

  chain output {
        type filter hook output priority 0; policy accept;
  }
}

table ip nat {
    chain prerouting {
        type nat hook prerouting priority 0; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        oifname "wlo1" masquerade
    }
}

-> % sudo systemctl enable --now nftables.service

-> % cat /etc/sysctl.d/30-ipforward.conf
net.ipv4.ip_forward=1

-> % sudo sysctl --system