From 48f854bc81f67e73c78734f4f33dfa70dc6a7f73 Mon Sep 17 00:00:00 2001
From: tslil clingman <>
Date: Thu, 15 Feb 2024 18:45:38 +0100
Subject: fix_work_dns.sh: what it says on the tin

---
 fix_work_dns.sh | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100755 fix_work_dns.sh

diff --git a/fix_work_dns.sh b/fix_work_dns.sh
new file mode 100755
index 0000000..73a125a
--- /dev/null
+++ b/fix_work_dns.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+
+interface="$1"
+event="$2"
+
+logger="/usr/bin/logger -s -t fix_work_vpn"
+
+$logger "Received $event for $interface"
+
+case $interface in
+    tun0) case $event in
+              up) $logger "Setting dnsovertls false"
+                  resolvectl dnsovertls $interface false;
+                  openconnet_pid=$(pgrep -f openconnect)
+                  $logger "Setting openconnect PID $openconnet_pid to run outside VPN"
+                  mullvad split-tunnel add $openconnet_pid;
+                  dns_servers=$(resolvectl dns tun0 | cut -d: -f2- | sed 's/^ *//;s/ /, /')
+                  $logger "Found DNS endpoints $dns_servers and setting exemptions in nftables"
+                  nft -f - <<< "define RESOLVER_ADDRS = {$dns_servers}
+table inet excludeTraffic {
+  chain excludeDns {
+    type filter hook output priority -10; policy accept;
+    ip daddr \$RESOLVER_ADDRS udp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
+    ip daddr \$RESOLVER_ADDRS tcp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
+  }
+}"
+                  ;;
+              down) $logger "Removing nftables exemptions for DNS entries";
+                    nft delete table inet excludeTraffic;;
+    esac;;
+esac
-- 
cgit v1.2.3