tun2socks: replace per-app proxy hacks with transparent tunnel for all traffic

modules/xray.nix

@@ -1,6 +1,9 @@
-# Xray VLESS+Reality proxy with system-wide proxy settings
+# Xray VLESS+Reality with tun2socks transparent proxy (all traffic)
 { config, pkgs, lib, ... }:
 
+let
+  xrayServer = "172.232.216.157";
+in
 {
   # Xray systemd service
   systemd.services.xray = {
@@ -13,56 +16,54 @@
       Restart = "on-failure";
       RestartSec = 5;
       DynamicUser = true;
-      CapabilityBoundingSet = "";
       NoNewPrivileges = true;
       ProtectSystem = "strict";
       ReadOnlyPaths = [ "/etc/xray" ];
     };
   };
 
-  # System-wide proxy environment variables
+  # tun2socks — creates TUN device routing all traffic through SOCKS5
-  networking.proxy = {
+  systemd.services.tun2socks = {
-    default = "http://127.0.0.1:10809";
+    description = "tun2socks transparent proxy";
-    noProxy = "127.0.0.1,localhost,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16";
+    after = [ "xray.service" ];
+    wants = [ "xray.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      ExecStartPre = pkgs.writeShellScript "tun2socks-setup" ''
+        ${pkgs.iproute2}/bin/ip tuntap add mode tun dev tun0 2>/dev/null || true
+        ${pkgs.iproute2}/bin/ip addr add 198.18.0.1/15 dev tun0 2>/dev/null || true
+        ${pkgs.iproute2}/bin/ip link set dev tun0 up
+      '';
+      ExecStart = "${pkgs.tun2socks}/bin/tun2socks -device tun0 -proxy socks5://127.0.0.1:10808 -interface lo";
+      ExecStartPost = pkgs.writeShellScript "tun2socks-routes" ''
+        # Get current default gateway
+        GW=$(${pkgs.iproute2}/bin/ip route show default | ${pkgs.gawk}/bin/awk '{print $3; exit}')
+        DEV=$(${pkgs.iproute2}/bin/ip route show default | ${pkgs.gawk}/bin/awk '{print $5; exit}')
+
+        # Route xray server traffic directly (avoid loop)
+        ${pkgs.iproute2}/bin/ip route add ${xrayServer}/32 via $GW dev $DEV 2>/dev/null || true
+
+        # Route everything else through tun0
+        ${pkgs.iproute2}/bin/ip route add default dev tun0 metric 1 2>/dev/null || true
+      '';
+      ExecStopPost = pkgs.writeShellScript "tun2socks-teardown" ''
+        ${pkgs.iproute2}/bin/ip route del default dev tun0 2>/dev/null || true
+        ${pkgs.iproute2}/bin/ip route del ${xrayServer}/32 2>/dev/null || true
+        ${pkgs.iproute2}/bin/ip link set dev tun0 down 2>/dev/null || true
+        ${pkgs.iproute2}/bin/ip tuntap del mode tun dev tun0 2>/dev/null || true
+      '';
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
   };
 
-  # Firefox proxy via enterprise policy
+  # DNS through tunnel — use public DNS that will go through tun0
+  networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
+
+  # Firefox — disable WebRTC leak
   programs.firefox = {
     enable = true;
     package = pkgs.firefox-devedition;
-    policies = {
+    policies = {};
-      Proxy = {
-        Mode = "manual";
-        SOCKSProxy = "127.0.0.1:10808";
-        SOCKSVersion = 5;
-        Passthrough = "127.0.0.1,localhost";
-        UseProxyForDNS = true;
-      };
-    };
   };
-
-  # SSH through SOCKS5 proxy
-  programs.ssh.extraConfig = ''
-    Host *
-      ProxyCommand ${pkgs.netcat-openbsd}/bin/nc -X 5 -x 127.0.0.1:10808 %h %p
-  '';
-
-  # GNOME proxy settings via dconf
-  programs.dconf.profiles.user.databases = [{
-    settings."org/gnome/system/proxy" = {
-      mode = "manual";
-    };
-    settings."org/gnome/system/proxy/http" = {
-      host = "127.0.0.1";
-      port = lib.gvariant.mkUint32 10809;
-    };
-    settings."org/gnome/system/proxy/https" = {
-      host = "127.0.0.1";
-      port = lib.gvariant.mkUint32 10809;
-    };
-    settings."org/gnome/system/proxy/socks" = {
-      host = "127.0.0.1";
-      port = lib.gvariant.mkUint32 10808;
-    };
-  }];
 }