Maroka-chan / VPN-Confinement

A NixOS module which lets you route traffic from systemd services through a VPN while preventing DNS leaks.
GNU General Public License v3.0
64 stars 2 forks source link

add `ip link set up dev veth-${name}-br` #6

Closed mlyxshi closed 5 months ago

Maroka-chan commented 5 months ago

@mlyxshi and I tried to debug the problem this PR is supposed to fix. Here are the findings:

The module seems to break with this configuration

networking.useNetworkd = true;
networking.useDHCP = false;
systemd.network.wait-online.anyInterface = true;
systemd.network.networks.ethernet-default-dhcp = {
  matchConfig = { Name = [ "en*" "eth*" "veth-wg-br" "wg-br"]; };
  networkConfig = { DHCP = "yes"; };
};

It causes the wg-br bridge to be down, but running ip link set up dev veth-wg-br seems to bring it up. If only useNetworkd is set

networking.useNetworkd = true;

then ip link set up dev veth-wg-br does not bring the bridge up. Instead ip link set veth-wg-br master wg-br brings it up even though this command is already run in the module script.

The bridge is normally brought up together with veth-wg because they are linked ip link add veth-wg-br type veth peer name veth-wg netns wg ip -n ${name} link set dev veth-${name} up

I think the conclusion is to not use systemd-networkd, as the description for the option even says it is experimental and should be used at your own risk.

Closing for now.

Maroka-chan commented 3 months ago

I looked a bit more into this. When dhcp is disabled veth-wg-br is not brought up automatically, and it also never gets an ipv6 address. Bringing the interface up manually assigns it an address and all seems to work. Regarding the problem when only networking.useNetworkd is enabled, in this case dhcp is also enabled and I think this causes problems because they are both trying to manage the same interfaces. Enabling both gives a warning, so this should not be a concern. The conclusion was not completely correct as I noticed that while networking.useNetworkd might be experimental, systemd.network.enable is not. I added the suggested line from this PR and made some other fixes, so hopefully all should work now.