···
+
{ config, lib, pkgs, ... }:
+
cfg = config.services.redsocks;
+
description = "Whether to enable redsocks.";
+
description = "Log connection progress.";
+
description = "Log start and end of client sessions.";
+
- syslog:FACILITY where FACILITY is any of "daemon", "local0",
+
type = with types; nullOr str;
+
Chroot under which to run redsocks. Log file is opened before
+
chroot, but if logging to syslog /etc/localtime may be required.
+
Local port to proxy associations to be performed.
+
The example shows how to configure a proxy to handle port 80 as HTTP
+
relay, and all other ports as HTTP connect.
+
{ port = 23456; proxy = "1.2.3.4:8080"; type = "http-relay";
+
redirectCondition = "--dport 80";
+
doNotRedirect = [ "-d 1.2.0.0/16" ];
+
{ port = 23457; proxy = "1.2.3.4:8080"; type = "http-connect";
+
redirectCondition = true;
+
doNotRedirect = [ "-d 1.2.0.0/16" ];
+
type = types.listOf (types.submodule { options = {
+
IP on which redsocks should listen. Defaults to 127.0.0.1 for
+
description = "Port on which redsocks should listen.";
+
Proxy through which redsocks should forward incoming traffic.
+
Example: "example.org:8080"
+
type = types.enum [ "socks4" "socks5" "http-connect" "http-relay" ];
+
description = "Type of proxy.";
+
type = with types; nullOr str;
+
description = "Login to send to proxy.";
+
type = with types; nullOr str;
+
Password to send to proxy. WARNING, this will end up
+
world-readable in the store! Awaiting
+
https://github.com/NixOS/nix/issues/8 to be able to fix.
+
disclose_src = mkOption {
+
type = types.enum [ "false" "X-Forwarded-For" "Forwarded_ip"
+
Way to disclose client IP to the proxy.
+
- "false": do not disclose
+
http-connect supports the following ways:
+
- "X-Forwarded-For": add header "X-Forwarded-For: IP"
+
- "Forwarded_ip": add header "Forwarded: for=IP" (see RFC7239)
+
- "Forwarded_ipport": add header 'Forwarded: for="IP:port"'
+
redirectInternetOnly = mkOption {
+
description = "Exclude all non-globally-routable IPs from redsocks";
+
doNotRedirect = mkOption {
+
type = with types; listOf str;
+
Iptables filters that if matched will get the packet off of
+
example = [ "-d 1.2.3.4" ];
+
redirectCondition = mkOption {
+
type = with types; either bool str;
+
Conditions to make outbound packets go through this redsocks
+
If set to false, no packet will be forwarded. If set to true,
+
all packets will be forwarded (except packets excluded by
+
If set to a string, this is an iptables filter that will be
+
matched against packets before getting them into redsocks. For
+
example, setting it to "--dport 80" will only send
+
packets to port 80 to redsocks. Note "-p tcp" is always
+
implicitly added, as udp can only be proxied through redudp or
+
# TODO: Add support for redudp and dnstc
+
redsocks_blocks = concatMapStrings (block:
+
let proxy = splitString ":" block.proxy; in
+
local_ip = ${block.ip};
+
local_port = ${toString block.port};
+
ip = ${elemAt proxy 0};
+
port = ${elemAt proxy 1};
+
${optionalString (block.login != null) "login = \"${block.login}\";"}
+
${optionalString (block.password != null) "password = \"${block.password}\";"}
+
disclose_src = ${block.disclose_src};
+
configfile = pkgs.writeText "redsocks.conf"
+
log_debug = ${if cfg.log_debug then "on" else "off" };
+
log_info = ${if cfg.log_info then "on" else "off" };
+
${optionalString (cfg.chroot != null) "chroot = ${cfg.chroot};"}
+
internetOnly = [ # TODO: add ipv6-equivalent
+
optionalString (isString block.redirectCondition) block.redirectCondition;
+
iptables = concatImapStrings (idx: block:
+
let chain = "REDSOCKS${toString idx}"; doNotRedirect =
+
concatMapStringsSep "\n"
+
(f: "ip46tables -t nat -A ${chain} ${f} -j RETURN 2>/dev/null || true")
+
(block.doNotRedirect ++ (optionals block.redirectInternetOnly internetOnly));
+
optionalString (block.redirectCondition != false)
+
ip46tables -t nat -F ${chain} 2>/dev/null || true
+
ip46tables -t nat -N ${chain} 2>/dev/null || true
+
ip46tables -t nat -A ${chain} -p tcp -j REDIRECT --to-ports ${toString block.port}
+
# TODO: show errors, when it will be easily possible by a switch to
+
ip46tables -t nat -A OUTPUT -p tcp ${redCond block} -j ${chain} 2>/dev/null || true
+
users.groups.redsocks = {};
+
users.users.redsocks = {
+
description = "Redsocks daemon";
+
systemd.services.redsocks = {
+
description = "Redsocks";
+
after = [ "network.target" ];
+
wantedBy = [ "multi-user.target" ];
+
script = "${pkgs.redsocks}/bin/redsocks -c ${configfile}";
+
networking.firewall.extraCommands = iptables;
+
networking.firewall.extraStopCommands =
+
concatImapStringsSep "\n" (idx: block:
+
let chain = "REDSOCKS${toString idx}"; in
+
optionalString (block.redirectCondition != false)
+
"ip46tables -t nat -D OUTPUT -p tcp ${redCond block} -j ${chain} 2>/dev/null || true"
pyrox.dev