From 88f3503ff471c8379bd04e5ac23caa0069d808ba Mon Sep 17 00:00:00 2001 From: elwrcl Date: Tue, 31 Mar 2026 01:14:06 +0300 Subject: [PATCH] fix: zapret firewall rules --- nixos/networking/network-manager/default.nix | 13 ++++++++++++- nixos/networking/vpn/default.nix | 9 +++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/nixos/networking/network-manager/default.nix b/nixos/networking/network-manager/default.nix index e333f7e..135ca97 100644 --- a/nixos/networking/network-manager/default.nix +++ b/nixos/networking/network-manager/default.nix @@ -3,4 +3,15 @@ { networking.hostName = "copland"; networking.networkmanager.enable = true; -} + + services.resolved = { + enable = true; + dnssec = "false"; + domains = [ "~." ]; + fallbackDns = [ "1.1.1.1" "8.8.8.8" ]; + extraConfig = '' + DNS=1.1.1.1 + DNSOverTLS=yes + ''; + }; +} \ No newline at end of file diff --git a/nixos/networking/vpn/default.nix b/nixos/networking/vpn/default.nix index ef07a36..ee97a68 100644 --- a/nixos/networking/vpn/default.nix +++ b/nixos/networking/vpn/default.nix @@ -34,5 +34,14 @@ iptables -D OUTPUT -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true iptables -D OUTPUT -p udp --dport 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9 -j NFQUEUE --queue-num 200 --queue-bypass || true iptables -D OUTPUT -m mark --mark 0x40000000/0x40000000 -j RETURN || true + + services.resolved = { + enable = true; + dnssec = "false"; + domains = [ "~." ]; + fallbackDns = [ "1.1.1.1" "8.8.8.8" ]; + extraConfig = '' + DNS=1.1.1.1 + DNSOverTLS=yes ''; } \ No newline at end of file