From a03e816d9d49c7f23be39f3cda19e02b37237832 Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Sun, 29 Dec 2024 10:12:50 +0000 Subject: Better ns0 network namespace configs Enable nft. Use different nft config for ns0. Host open emails port. ns0 open wireguard and qbt ports. ns0 configure wireguard. host not configure wiregurad, so also no need ip forwarding sysctl kernel parameters. ns0 use /etc/netns/ns0/nftables.conf that will bind mount to ns0. Host and ns0 both run dnsmasq for dns cache. ns0 dnsmasq I disable dbus because it will conficts with host dnsmasq dbus. Dnsmasq use dbus for config cahnge? I disable systemd-resolved and switch to dnsmasq because systemd-resolved use dbus for dns query? which is maybe easy for dns leak, e.g., when systemd-resolved is only running on host, ns0 with different /etc/resolv.conf still get dns from host open public ip when run resolvectl query, although drill does not leak. sye add enabled systemd units --- home/xyz/.config/myconf/sye | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'home/xyz/.config/myconf') diff --git a/home/xyz/.config/myconf/sye b/home/xyz/.config/myconf/sye index 07c19548..d7692c8f 100644 --- a/home/xyz/.config/myconf/sye +++ b/home/xyz/.config/myconf/sye @@ -1,8 +1,11 @@ UNIT FILE STATE PRESET +dnsmasq-ns0.service enabled disabled +dnsmasq.service enabled disabled dovecot.service enabled disabled getty@.service enabled enabled jackett.service enabled disabled nftables.service enabled disabled +ns0.service enabled disabled opendkim.service enabled disabled opendmarc.service enabled disabled postfix.service enabled disabled @@ -11,7 +14,6 @@ swgp-go.service enabled disabled systemd-network-generator.service enabled enabled systemd-networkd-wait-online.service enabled enabled systemd-networkd.service enabled enabled -systemd-resolved.service enabled enabled systemd-time-wait-sync.service enabled disabled systemd-timesyncd.service enabled enabled systemd-networkd.socket enabled disabled @@ -21,4 +23,4 @@ acme.sh.timer enabled disabled paccache.timer enabled disabled pacman-filesdb-refresh.timer enabled disabled -21 unit files listed. +23 unit files listed. -- cgit v1.2.3-70-g09d2