asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

dpi-tunnel: add an Xray Reality PQ full-tunnel client

Browse source 
DPI on some uplinks throttles WireGuard. Tunnel everything through Xray
VLESS + REALITY with post-quantum VLESS Encryption on tun1. Routes in
the main table that are more specific than the default (LAN, wg*
prefixes) keep priority; prefixes listed in the routes secret are
forced through the tunnel. The client's own uplink is fwmarked so it
never loops back into tun1.

UDP sessions on the tun device stay pinned to a dead mux link after
suspend or Wi-Fi loss, so restart the client on resume and whenever
NetworkManager brings up a new uplink. Stopping the unit removes all
the rules and routes.

Secrets come from secrets/dpi-tunnel.yaml through sops. Only the
.example skeleton is tracked.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-08 05:08:45 +04:00
commit ffb7554594
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
3 changed files with 156 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
secrets/dpi-tunnel.yaml.example Normal file
View file

@ -0,0 +1,10 @@
# sops-encrypted; generate with scripts/gen-secrets.sh in the dpi-tunnel repo
server: 203.0.113.10
server_name: www.microsoft.com
uuid: 00000000-0000-0000-0000-000000000000
short_id: 0123456789abcdef
reality_private_key: <server only>
reality_password: <x25519 public key>
vless_decryption: <server only>
vless_encryption: mlkem768x25519plus.native.0rtt.<...>
routes: '["198.51.100.1/32"]' # forced via tun1 even over specific wg* routes