elars/copnix
1
0 Fork 0
mirror of https://github.com/elwrcl/copnix.git synced 2026-10-31 14:28:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

network

Browse Source
This commit is contained in:
elwrcl committed 2026-08-13 19:37:27 +03:00
1 parent 13c046ec97
commit 56d8a82299
4 files changed
+99 -53
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

modules/nixos/net/net-dpi-evasion.ulu.nix
+58
View File
@@ -0,0 +1,58 @@
{ ... }:
{
flake.nixosModules.net-dpi-evasion =
{ ... }:
{
environment.etc."zapret/exclude.txt".text = ''
turkiye.gov.tr
sahibinden.com
gov.tr
edevlet.gov.tr
'';
services.zapret = {
enable = true;
configureFirewall = false;
params = [
"--filter-tcp=80"
"--hostlist-exclude=/etc/zapret/exclude.txt"
"--dpi-desync=fake,multisplit"
"--dpi-desync-split-pos=method+2"
"--dpi-desync-fooling=md5sig"
"--new"
"--filter-tcp=443"
"--hostlist-exclude=/etc/zapret/exclude.txt"
"--dpi-desync=fake,multidisorder"
"--dpi-desync-split-pos=1,midsld"
"--dpi-desync-fooling=badseq,md5sig"
"--new"
"--filter-udp=443"
"--hostlist-exclude=/etc/zapret/exclude.txt"
"--dpi-desync=fake"
"--dpi-desync-repeats=6"
];
};
networking.enableIPv6 = true;
networking.firewall.extraCommands = ''
iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
iptables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
iptables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN
ip6tables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
ip6tables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
ip6tables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN
'';
networking.firewall.extraStopCommands = ''
iptables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
iptables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
iptables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true
ip6tables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
ip6tables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
ip6tables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true
'';
};
}
modules/nixos/net/net-network-manager.ulu.nix
+40 -13
View File
@@ -1,25 +1,52 @@
{ ... }:
{
flake.nixosModules.net-network-manager =
{ ... }:
{ lib, ... }:
let
inherit (lib.modules) mkDefault;
in
{
networking.hostName = "copland";
networking.networkmanager.enable = true;
networking.networkmanager = {
enable = true;
dns = "systemd-resolved";
ethernet.macAddress = mkDefault "stable";
wifi.macAddress = mkDefault "random";
wifi.scanRandMacAddress = true;
connectionConfig = {
"ipv6.addr-gen-mode" = "stable-privacy";
"ipv6.ip6-privacy" = 2;
"ipv4.ignore-auto-dns" = true;
"ipv6.ignore-auto-dns" = true;
};
};
boot.kernel.sysctl = {
"net.ipv6.conf.all.use_tempaddr" = 2;
"net.ipv6.conf.default.use_tempaddr" = 2;
};
services.resolved = {
enable = true;
settings.Resolve = {
DNS = [
"9.9.9.9#dns.quad9.net"
"149.112.112.112#dns.quad9.net"
"2620:fe::fe#dns.quad9.net"
"2620:fe::9#dns.quad9.net"
];
settings = {
Resolve = {
DNS = "1.1.1.1";
DNSOverTLS = "yes";
DNSSEC = "false";
Domains = [ "~." ];
FallbackDNS = [
"1.1.1.1"
"8.8.8.8"
];
};
FallbackDNS = [
"194.242.2.2#dns.mullvad.net"
"2a07:e340::2#dns.mullvad.net"
];
DNSOverTLS = "yes";
DNSSEC = "true";
Domains = [ "~." ];
LLMNR = "false";
MulticastDNS = "false";
};
};
};
modules/nixos/net/net-vpn.ulu.nix
-39
View File
@@ -1,39 +0,0 @@
{ ... }:
{
flake.nixosModules.net-vpn =
{ ... }:
{
services.zapret = {
enable = true;
params = [
"--filter-tcp=80"
"--dpi-desync=fake,multisplit"
"--dpi-desync-split-pos=method+2"
"--dpi-desync-fooling=md5sig"
"--new"
"--filter-tcp=443"
"--dpi-desync=fake,multidisorder"
"--dpi-desync-split-pos=1,midsld"
"--dpi-desync-fooling=badseq,md5sig"
"--new"
"--filter-udp=443"
"--dpi-desync=fake"
"--dpi-desync-repeats=6"
];
};
networking.enableIPv6 = false;
networking.firewall.extraCommands = ''
iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
iptables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
iptables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN
'';
networking.firewall.extraStopCommands = ''
iptables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
iptables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
iptables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true
'';
};
}