From 56d8a82299f2cb86949111d302d9d3ee21c6bc2f Mon Sep 17 00:00:00 2001 From: elwrcl Date: Thu, 13 Aug 2026 19:37:27 +0300 Subject: [PATCH] network --- hosts/copland.ulu.nix | 2 +- modules/nixos/net/net-dpi-evasion.ulu.nix | 58 +++++++++++++++++++ modules/nixos/net/net-network-manager.ulu.nix | 53 ++++++++++++----- modules/nixos/net/net-vpn.ulu.nix | 39 ------------- 4 files changed, 99 insertions(+), 53 deletions(-) create mode 100644 modules/nixos/net/net-dpi-evasion.ulu.nix delete mode 100644 modules/nixos/net/net-vpn.ulu.nix diff --git a/hosts/copland.ulu.nix b/hosts/copland.ulu.nix index 530fe55..f1bca99 100644 --- a/hosts/copland.ulu.nix +++ b/hosts/copland.ulu.nix @@ -82,7 +82,7 @@ in config.flake.nixosModules.hw-graphics config.flake.nixosModules.hw-udev config.flake.nixosModules.net-network-manager - config.flake.nixosModules.net-vpn + config.flake.nixosModules.net-dpi-evasion config.flake.nixosModules.service-appimage config.flake.nixosModules.service-flatpak config.flake.nixosModules.service-fwupd diff --git a/modules/nixos/net/net-dpi-evasion.ulu.nix b/modules/nixos/net/net-dpi-evasion.ulu.nix new file mode 100644 index 0000000..b28d7cc --- /dev/null +++ b/modules/nixos/net/net-dpi-evasion.ulu.nix @@ -0,0 +1,58 @@ +{ ... }: +{ + flake.nixosModules.net-dpi-evasion = + { ... }: + { + environment.etc."zapret/exclude.txt".text = '' + turkiye.gov.tr + sahibinden.com + gov.tr + edevlet.gov.tr + ''; + + services.zapret = { + enable = true; + configureFirewall = false; + + params = [ + "--filter-tcp=80" + "--hostlist-exclude=/etc/zapret/exclude.txt" + "--dpi-desync=fake,multisplit" + "--dpi-desync-split-pos=method+2" + "--dpi-desync-fooling=md5sig" + "--new" + "--filter-tcp=443" + "--hostlist-exclude=/etc/zapret/exclude.txt" + "--dpi-desync=fake,multidisorder" + "--dpi-desync-split-pos=1,midsld" + "--dpi-desync-fooling=badseq,md5sig" + "--new" + "--filter-udp=443" + "--hostlist-exclude=/etc/zapret/exclude.txt" + "--dpi-desync=fake" + "--dpi-desync-repeats=6" + ]; + }; + + networking.enableIPv6 = true; + networking.firewall.extraCommands = '' + iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass + iptables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass + iptables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN + + ip6tables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass + ip6tables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass + ip6tables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN + ''; + + networking.firewall.extraStopCommands = '' + iptables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true + iptables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true + iptables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true + + ip6tables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true + ip6tables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true + ip6tables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true + ''; + }; +} diff --git a/modules/nixos/net/net-network-manager.ulu.nix b/modules/nixos/net/net-network-manager.ulu.nix index 3a47cdd..4a1cf3f 100644 --- a/modules/nixos/net/net-network-manager.ulu.nix +++ b/modules/nixos/net/net-network-manager.ulu.nix @@ -1,25 +1,52 @@ { ... }: { flake.nixosModules.net-network-manager = - { ... }: + { lib, ... }: + let + inherit (lib.modules) mkDefault; + in { networking.hostName = "copland"; - networking.networkmanager.enable = true; + + networking.networkmanager = { + enable = true; + dns = "systemd-resolved"; + ethernet.macAddress = mkDefault "stable"; + wifi.macAddress = mkDefault "random"; + wifi.scanRandMacAddress = true; + connectionConfig = { + "ipv6.addr-gen-mode" = "stable-privacy"; + "ipv6.ip6-privacy" = 2; + "ipv4.ignore-auto-dns" = true; + "ipv6.ignore-auto-dns" = true; + }; + }; + + boot.kernel.sysctl = { + "net.ipv6.conf.all.use_tempaddr" = 2; + "net.ipv6.conf.default.use_tempaddr" = 2; + }; services.resolved = { enable = true; + settings.Resolve = { + DNS = [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + "2620:fe::fe#dns.quad9.net" + "2620:fe::9#dns.quad9.net" + ]; - settings = { - Resolve = { - DNS = "1.1.1.1"; - DNSOverTLS = "yes"; - DNSSEC = "false"; - Domains = [ "~." ]; - FallbackDNS = [ - "1.1.1.1" - "8.8.8.8" - ]; - }; + FallbackDNS = [ + "194.242.2.2#dns.mullvad.net" + "2a07:e340::2#dns.mullvad.net" + ]; + + DNSOverTLS = "yes"; + DNSSEC = "true"; + Domains = [ "~." ]; + LLMNR = "false"; + MulticastDNS = "false"; }; }; }; diff --git a/modules/nixos/net/net-vpn.ulu.nix b/modules/nixos/net/net-vpn.ulu.nix deleted file mode 100644 index 31db182..0000000 --- a/modules/nixos/net/net-vpn.ulu.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ ... }: -{ - flake.nixosModules.net-vpn = - { ... }: - { - services.zapret = { - enable = true; - params = [ - "--filter-tcp=80" - "--dpi-desync=fake,multisplit" - "--dpi-desync-split-pos=method+2" - "--dpi-desync-fooling=md5sig" - "--new" - "--filter-tcp=443" - "--dpi-desync=fake,multidisorder" - "--dpi-desync-split-pos=1,midsld" - "--dpi-desync-fooling=badseq,md5sig" - "--new" - "--filter-udp=443" - "--dpi-desync=fake" - "--dpi-desync-repeats=6" - ]; - }; - - networking.enableIPv6 = false; - - networking.firewall.extraCommands = '' - iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass - iptables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass - iptables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN - ''; - - networking.firewall.extraStopCommands = '' - iptables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true - iptables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true - iptables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true - ''; - }; -}