diff options
| -rwxr-xr-x | fix_work_dns.sh | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/fix_work_dns.sh b/fix_work_dns.sh new file mode 100755 index 0000000..73a125a --- /dev/null +++ b/fix_work_dns.sh @@ -0,0 +1,31 @@ +#!/bin/sh + +interface="$1" +event="$2" + +logger="/usr/bin/logger -s -t fix_work_vpn" + +$logger "Received $event for $interface" + +case $interface in + tun0) case $event in + up) $logger "Setting dnsovertls false" + resolvectl dnsovertls $interface false; + openconnet_pid=$(pgrep -f openconnect) + $logger "Setting openconnect PID $openconnet_pid to run outside VPN" + mullvad split-tunnel add $openconnet_pid; + dns_servers=$(resolvectl dns tun0 | cut -d: -f2- | sed 's/^ *//;s/ /, /') + $logger "Found DNS endpoints $dns_servers and setting exemptions in nftables" + nft -f - <<< "define RESOLVER_ADDRS = {$dns_servers} +table inet excludeTraffic { + chain excludeDns { + type filter hook output priority -10; policy accept; + ip daddr \$RESOLVER_ADDRS udp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65; + ip daddr \$RESOLVER_ADDRS tcp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65; + } +}" + ;; + down) $logger "Removing nftables exemptions for DNS entries"; + nft delete table inet excludeTraffic;; + esac;; +esac |