From 8b35ac693c5c464c3a8bad9fde021a3870da64f3 Mon Sep 17 00:00:00 2001 From: loki5512344 Date: Mon, 24 Aug 2026 11:18:57 +0200 Subject: [PATCH] fix: universal default protected port range (was Minecraft 25565-25570) Verified on real kernel 5.15.0-186 (VDS, netns+veth, generic XDP): - verifier accepts program, all maps created (BTF ok) - legit TCP passes end-to-end; conntrack entry cleaned on close - stats counters increment correctly; prefix_stats /24 key populated - LPM blacklist ban blocks traffic with retransmit drops --- xdp/core/config.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/xdp/core/config.h b/xdp/core/config.h index 2f818d2..90982c8 100644 --- a/xdp/core/config.h +++ b/xdp/core/config.h @@ -6,8 +6,11 @@ // after loader writes to .rodata section // ── Port range ── -static volatile const __u16 G_START_PORT = 25565; -static volatile const __u16 G_END_PORT = 25570; +// Protected port range: packets to ports OUTSIDE this range bypass the +// filter (XDP_PASS before any counting/filtering). Default protects all +// TCP/UDP ports; narrow it via loader patching for dedicated-edge setups. +static volatile const __u16 G_START_PORT = 1; +static volatile const __u16 G_END_PORT = 65535; // ── SYN throttle ── static volatile const __u32 G_SYN_HIT_COUNT = 10; // max SYNs / window