added encrypted dns and worked on mullvad-tailscale compat (commnented out as of now)
This commit is contained in:
parent
8baffe0eae
commit
4422eef64a
|
@ -11,10 +11,54 @@
|
|||
systemd.services.NetworkManager-wait-online.enable = false; #disable wait online since it is broken
|
||||
hardware.bluetooth.enable = true;
|
||||
|
||||
# Enable encrypted DNS
|
||||
services.dnscrypt-proxy2 = {
|
||||
enable = true;
|
||||
settings = {
|
||||
ipv6_servers = true;
|
||||
require_dnssec = true;
|
||||
};
|
||||
};
|
||||
systemd.services.dnscrypt-proxy2.serviceConfig = {
|
||||
StateDirectory = "dnscrypt-proxy";
|
||||
};
|
||||
|
||||
# Enable mullvad vpn
|
||||
services.mullvad-vpn.package = pkgs.mullvad-vpn;
|
||||
#services.resolved.enable = true;
|
||||
#networking.resolvconf.enable = false;
|
||||
services.mullvad-vpn.enable = true;
|
||||
|
||||
# Enable tailscale
|
||||
services.tailscale.enable = true;
|
||||
|
||||
# exclude tailscale IPs from mullvad routing
|
||||
/* networking.nftables = {
|
||||
enable = true;
|
||||
ruleset = ''
|
||||
define TAILNET_DNS = {
|
||||
100.100.100.100
|
||||
}
|
||||
define TAILNET_IPV4 = {
|
||||
100.64.0.0/10
|
||||
}
|
||||
define TAILNET_IPV6 = {
|
||||
fd7a:115c:a1e0::/48
|
||||
}
|
||||
table inet excludeTraffic {
|
||||
chain excludeDns {
|
||||
type filter hook output priority -10; policy accept;
|
||||
ip daddr $TAILNET_DNS udp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
|
||||
ip daddr $TAILNET_DNS tcp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
|
||||
}
|
||||
}
|
||||
table inet excludeTraffic {
|
||||
chain excludeOutgoing {
|
||||
type route hook output priority 0; policy accept;
|
||||
ip daddr $TAILNET_IPV4 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
|
||||
ip6 daddr $TAILNET_IPV6 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
|
||||
}
|
||||
}
|
||||
'';
|
||||
}; */
|
||||
}
|
Loading…
Reference in New Issue
Block a user