network

hosts/copland.ulu.nix

@@ -82,7 +82,7 @@ in
       config.flake.nixosModules.hw-graphics
       config.flake.nixosModules.hw-udev
       config.flake.nixosModules.net-network-manager
-      config.flake.nixosModules.net-vpn
+      config.flake.nixosModules.net-dpi-evasion
       config.flake.nixosModules.service-appimage
       config.flake.nixosModules.service-flatpak
       config.flake.nixosModules.service-fwupd

modules/nixos/net/net-dpi-evasion.ulu.nix

@@ -0,0 +1,58 @@
+{ ... }:
+{
+  flake.nixosModules.net-dpi-evasion =
+    { ... }:
+    {
+      environment.etc."zapret/exclude.txt".text = ''
+        turkiye.gov.tr
+        sahibinden.com
+        gov.tr
+        edevlet.gov.tr
+      '';
+
+      services.zapret = {
+        enable = true;
+        configureFirewall = false;
+
+        params = [
+          "--filter-tcp=80"
+          "--hostlist-exclude=/etc/zapret/exclude.txt"
+          "--dpi-desync=fake,multisplit"
+          "--dpi-desync-split-pos=method+2"
+          "--dpi-desync-fooling=md5sig"
+          "--new"
+          "--filter-tcp=443"
+          "--hostlist-exclude=/etc/zapret/exclude.txt"
+          "--dpi-desync=fake,multidisorder"
+          "--dpi-desync-split-pos=1,midsld"
+          "--dpi-desync-fooling=badseq,md5sig"
+          "--new"
+          "--filter-udp=443"
+          "--hostlist-exclude=/etc/zapret/exclude.txt"
+          "--dpi-desync=fake"
+          "--dpi-desync-repeats=6"
+        ];
+      };
+
+      networking.enableIPv6 = true;
+      networking.firewall.extraCommands = ''
+        iptables  -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
+        iptables  -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
+        iptables  -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN
+
+        ip6tables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
+        ip6tables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
+        ip6tables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN
+      '';
+
+      networking.firewall.extraStopCommands = ''
+        iptables  -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
+        iptables  -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
+        iptables  -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true
+
+        ip6tables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
+        ip6tables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
+        ip6tables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true
+      '';
+    };
+}

modules/nixos/net/net-network-manager.ulu.nix

@@ -1,25 +1,52 @@
 { ... }:
 {
   flake.nixosModules.net-network-manager =
-    { ... }:
+    { lib, ... }:
+    let
+      inherit (lib.modules) mkDefault;
+    in
     {
       networking.hostName = "copland";
-      networking.networkmanager.enable = true;
+
+      networking.networkmanager = {
+        enable = true;
+        dns = "systemd-resolved";
+        ethernet.macAddress = mkDefault "stable";
+        wifi.macAddress = mkDefault "random";
+        wifi.scanRandMacAddress = true;
+        connectionConfig = {
+          "ipv6.addr-gen-mode" = "stable-privacy";
+          "ipv6.ip6-privacy" = 2;
+          "ipv4.ignore-auto-dns" = true;
+          "ipv6.ignore-auto-dns" = true;
+        };
+      };
+
+      boot.kernel.sysctl = {
+        "net.ipv6.conf.all.use_tempaddr" = 2;
+        "net.ipv6.conf.default.use_tempaddr" = 2;
+      };
 
       services.resolved = {
         enable = true;
+        settings.Resolve = {
+          DNS = [
+            "9.9.9.9#dns.quad9.net"
+            "149.112.112.112#dns.quad9.net"
+            "2620:fe::fe#dns.quad9.net"
+            "2620:fe::9#dns.quad9.net"
+          ];
 
-        settings = {
+          FallbackDNS = [
-          Resolve = {
+            "194.242.2.2#dns.mullvad.net"
-            DNS = "1.1.1.1";
+            "2a07:e340::2#dns.mullvad.net"
-            DNSOverTLS = "yes";
+          ];
-            DNSSEC = "false";
+
-            Domains = [ "~." ];
+          DNSOverTLS = "yes";
-            FallbackDNS = [
+          DNSSEC = "true";
-              "1.1.1.1"
+          Domains = [ "~." ];
-              "8.8.8.8"
+          LLMNR = "false";
-            ];
+          MulticastDNS = "false";
-          };
         };
       };
     };

modules/nixos/net/net-vpn.ulu.nix

@@ -1,39 +0,0 @@
-{ ... }:
-{
-  flake.nixosModules.net-vpn =
-    { ... }:
-    {
-      services.zapret = {
-        enable = true;
-        params = [
-          "--filter-tcp=80"
-          "--dpi-desync=fake,multisplit"
-          "--dpi-desync-split-pos=method+2"
-          "--dpi-desync-fooling=md5sig"
-          "--new"
-          "--filter-tcp=443"
-          "--dpi-desync=fake,multidisorder"
-          "--dpi-desync-split-pos=1,midsld"
-          "--dpi-desync-fooling=badseq,md5sig"
-          "--new"
-          "--filter-udp=443"
-          "--dpi-desync=fake"
-          "--dpi-desync-repeats=6"
-        ];
-      };
-
-      networking.enableIPv6 = false;
-
-      networking.firewall.extraCommands = ''
-        iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
-        iptables -I OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass
-        iptables -I OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN
-      '';
-
-      networking.firewall.extraStopCommands = ''
-        iptables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
-        iptables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true
-        iptables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true
-      '';
-    };
-}