blob: 73a125a65b9c909bfe3ab0cd15baf626f58c0f1a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
#!/bin/sh
interface="$1"
event="$2"
logger="/usr/bin/logger -s -t fix_work_vpn"
$logger "Received $event for $interface"
case $interface in
tun0) case $event in
up) $logger "Setting dnsovertls false"
resolvectl dnsovertls $interface false;
openconnet_pid=$(pgrep -f openconnect)
$logger "Setting openconnect PID $openconnet_pid to run outside VPN"
mullvad split-tunnel add $openconnet_pid;
dns_servers=$(resolvectl dns tun0 | cut -d: -f2- | sed 's/^ *//;s/ /, /')
$logger "Found DNS endpoints $dns_servers and setting exemptions in nftables"
nft -f - <<< "define RESOLVER_ADDRS = {$dns_servers}
table inet excludeTraffic {
chain excludeDns {
type filter hook output priority -10; policy accept;
ip daddr \$RESOLVER_ADDRS udp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
ip daddr \$RESOLVER_ADDRS tcp dport 53 ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
}
}"
;;
down) $logger "Removing nftables exemptions for DNS entries";
nft delete table inet excludeTraffic;;
esac;;
esac
|
