DNS Local Overrides in a VPN Tunnel

Just figured this out and figured I'd tell you.

Warning: it's super hacky.

I've got an OPNsense network running multiple VLANs. Many of them are not VPN'd but one is, let's call that VLAN the TunnelNet.

My setup is as follows: I've got my NormalNet on 192.168.1.0/24 and my TunnelNet on 192.168.20.0/24. I've got Unbound running on the OPNsense box with DoT to Cloudflare and DNS blocking via Hagezi lists. I've got some local DNS overrides setup so that going to `myhome.com` will redirect to a local machine running Home Assistant on the network at 192.168.1.10/32.

I wanted to be able to access `myhome.com` from both my NormalNet and my TunnelNet, while keeping the DNS sealed over the TunnelNet network to Mullvad. 

----

Following the "out of the box" DNSmasq and Unbound setup in the OPNsense documentation I was easily able to get myhome.come DNS overrides setup on NormalNet, but TunnelNet was always a struggle because of the following:

TunnelNet's upstream is Mullvad, and I want it to not leak DNS. If traffic ever reaches unbound to resolve the DNS overrides, when a non-override domain request comes in, Unbound will use the Cloudflare DoT to resolve the name, which would leak DNS. To avoid leaks, I had a firewall rule setup to Pass DNS traffic but force it onto the WG_Tunnel gateway, which would go directly to the Mullvad upstream and bypass my DNS override. This fixes the DNS leaks, but it prevents TunnelNet from accessing the DNS overrides.

The fix was largely as follows:

Assuming Unbound on 53 and DNSmasq on 5335, where DNSmasq holds the actual DNS overrides, and Unbound just forwards to DNSmasq when `myhome.com` comes in:

Add `Domains` to DNSmasq that capture "*" and route it to the mullvad server IP `100.64.0.7/32` on port `53`. This means that ANY DNS request that hits DNSmasq and is NOT handled by the `myhome.com` override will hit this rule and attempt to use the WG internal Mullvad DNS to lookup. Great!

Add a static route to System -> Routes that ensures that 100.64.0.7/32 resolves over the correct WG interface just incase (though this may not be needed but it should not hurt)

Add a NAT Destination redirect rule for:

When a packet on interface TunnelNet targets ! This_Firewall on DNS port 53 -> redirect it to This_Firewall port :5335
When a packet on interface TunnelNet targets This_Firewall on DNS port 53 -> also redirect it to This_Firewall port :5335

The firewall pass rule must be updated to NOT force the WG_Tunnel gateway, and should instead use the "system default" gateway, and should instead accept traffic on :5335: instead of DNS port :53

This means that ANY DNS request sent on the TunnelNet VLAN will be directly redirected to port :5335 where DNSmasq is running, and will completely skip Unbound. Requests for `myhome.com` will be resolved via DNS overrides to 192.168.1.10/32, otherwise it will be sent upstream via the `Domains` override to the Mullvad DNS server.

Packet -> TunnelNet -> DNS(port:53) ->rdr-> 127.0.0.1:5335 -> Firewall pass::

  -> myhome.com --> DNS direct override

  -> any other website --> Mullvad DNS upstream

This allows connections on TunnelNet to avoid DNS leaks but will still correctly DNS resolve myhome.com, and NormalNet connections will go over Unbound as usual, except when they are forwarded to DNSmasq for `myhome.com`, in which case they will never hit the DNSmasq `Domains` upstream hit since the local name will be immediately resolved. Keeps a clean NormalNet and TunnelNet separation, but still ensures both can resolve local DNS names.

----

The current edge cases are:

DNS blocklist used by NormalNet will not be able to be used by TunnelNet since DNSmasq does not support blocklists at this time, but most VPN providers will have their own DNS blocklists so that is not a huge deal.

DNS caching will be duplicated between Unbound and DNSmasq, but that will not be a huge issue for most simple home networks. Yes its a problem, but in day to day practice this does not impact the wife-approval-factor.

-----

This was super nerdy, but I hope it may help you, or future me set this up again.

I am sure there will one day be a cleaner "non DNS Domains hack" way to do this, but for now, this works, keeping everything in the OPNsense GUI configuration with no custom conf.d overrides, so it's good enough for me.

----

TetherFuseNet is coming along and the new engine will be default soon.

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyamsoftapps@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

KWin Window Tiling

I recently switched from GNOME desktop to KDE 6.7 (hands up hands down motion) and almost immediately ran into an issue with window tiling.

KDE's KWin has built in window tiling, where on GNOME I had to survive using the Gnome Tiling Assistant extension. Tiling Assistant was great, easy to setup and simple to configure, but I ran into some issues where the extension was not updated for new GNOME versions in time. Having native quarter tiling supported in KWin would have been a great benefit to me.

Except!

KWin's quadrant tiling was "real tiling" based, meaning windows snapped into corners and multiple windows were tiled as a "group" which meant they would resize together and always take up the full screen once you started tiling them. Many people enjoy this which is why it is the default. I do not.

I want my windows to size where I want them and be placed where I want them and then I want the window manager to leave them alone forever and never move or ask or mention them ever again.

Since I was unable to find a setting knob to "turn off the tiling but keep the tiling placement behavior", which I know, sounds so niche and yet this is exactly how my workflow has grown; I needed a way to have the behavior I was used to.

So, coming full circle, I wrote my own KWin script (extension) because of course I did. It's a single file, written in Typescript, sets hotkeys by default to the way I do things on my desktop, and does absolutely nothing else.

--

Android stuff soon, I hope.

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyamsoftapps@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

TetherFutureNet (dropping support for older Android N versions)

Future versions of TetherFuseNet will bring support for a brand new proxy engine backed by the powerful Netty library. The engine will be opt-in by default at first, only for the brave, but will eventually be made the default engine and then even later become the only engine.

The by-hand written proxy code is decent but struggling to adapt to the modern web with new clients and modern behaviors. Netty is a well supported, battle tested library that should better serve users.

The downside is that the latest versions of Netty ONLY supports Android API 26 and up (Oreo). There are <1% of pyamsoft users stuck on Android 7 and 7.1 (which are just about a decade old at this point), so while this change will largely not impact anyone, it will impact this sub-1-percent group. Sadly, the reality of technology is that the quick pace of the world around us requires the adoption of generally newer and newer technologies.

Going forward all pyamsoft Android applications will require a minimum Android version of Oreo (26), or higher if the required core functionality expects a newer API version. All existing users who are still on Android 7/7.1 can continue to use existing versions of applications, but they can not be supported moving forward.

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyamsoftapps@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

TetherFuseNet

Over the weekend I was informed that the name TetherFi was potentially infringing on a trademark registered by a private company in India.

The company has issued a notification to Google Play, and Google Play has thus restricted TetherFi from being distributed to users in India. This unfortunately will not resolvable until the company that initially issued the takedown will allow the application to be reinstated for distribution in India.

To avoid further market confusion, the TetherFi app will be renamed to TetherFuseNet in the next version.

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyamsoftapps@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

Is This Still On?

Hey there, been a little while.

Life moves fast and sometimes we have less time than we want to for the fun things like projects and open source. And by "we", I mean "me".

I just submitted TetherFi version 54 to the Play Store today, which should bring some additional fixes to the experimental SOCKS proxy mode as well as improving speed and fixing a couple crashes. I plan to have it sit in beta for a bit just because its a larger update. If you are interested in testing, you can join the Open Beta program on the Play Store, otherwise just sit tight. Hopefully 53 is working well enough for now :)

Over the past few months I've been playing around with reproducible setups. I have a dotfiles repository that I recently converted to "install as an ArchLinux package" where the package keeps track of dependencies and installs system files into expected locations. So far, it's pretty nice, though not nearly as advanced (or complex) as something like an Ansible. For now, that's how I like it to be.

I bought a cheap box off of AliExpress to use as a Opnsense router (which would replace a Google Fiber Wi-Fi 5 router that is now 3 years old). Opnsense is super cool, and I had just gotten everything setup (VLANs directly to my Omada AP, IDS and DNS blocklists) when suddenly, the cheap box just refused to boot. Even messing with the CMOS battery did not fix it, it just suddenly, randomly decided to die. Not a nice thing to wake up to, given that the router needs to have 100% uptime in order to achieve maximum Wife-Approval-Factor. For now I've ordered a second box to play around with (from Amazon this time, instead of AliExpress so I have the amazing return policy), and when it gets here hopefully I can make it into something neat again :)

The other night I also tried installing clamav onto my home server to see how it could help keep an eye on files on my server machine, given that the server is used by multiple people and not all files are mine. Well as fate would have it, I had just purchased an external enclosure off Amazon (I think it was a Terramaster) and had just gotten around to sticking an empty IronWolf Pro 12TB inside it. Clamav started scanning, and all was fine, until suddenly, it started hitting my drive at 4500MBps reads, and it did this constantly. Overnight. While I slept. I woke up to two drive alarms and 2 dead drives. RIP my old hard drive, you had served me for 5 years before being unceremoniously killed by clamav.

Needless to say, I have uninstalled clamav for now. I did not realize the configuration would need to be so specific to not cause problems.

Thankfully, I was able to recover most of the drive by copying off of a previous test drive used for setting up an LVM cache. After about a day or so of tinkering around and cp mv over an SSH session, all of the data should have migrated smoothly. I guess, even when your server files are "not important" it's still nice to have backups - but how can you afford large backup drives in this economy!

Anyway, I'm starting to ramble so I will wrap things up here. The tl;dr is, I'm still here but just very busy. I've got updates I want to make, and projects I want to try, and set ups I want to start (Home Assistant!). I've got some now, and more later.

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyamsoftapps@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

Fork, Knife, TetherFi

Hey there, been a little bit.

A lot has happened in the world of pyamsoft, so lets get right down to business.

First thing's first, TetherFi is currently in version 49 beta on the Play Store. This release is particularly important as it brings new support for a few cool features:

1. Proxy over RNDIS: A long standing GitHub issue has been finally closed with this release - you can share your TetherFi proxy connection over USB Tethering/Ethernet instead of requiring Wi-Fi to be on and using Wi-Fi Direct. Currently this is an "Expert" level setting, so many people will not need to change it, especially if you do not know what it is. But, if this is a use-case you are interested in, the new 49 when it releases will support this.

2. Proxy over Cellular Data: Other past requests have wished that the proxy connection could use only cellular data while still ensuring that the device stays connected to a Wi-Fi network. With changes in 49 you will now be able to request that proxy connections go over cellular data strictly. To implement this, I had to do some interesting code changes in the KTOR library that TetherFi uses - more on that in a bit.

3. There has also been a long-standing crash issue on the Connection screen in the release 47 that I have been unable to pinpoint - it causes about 5% of users to crash sometimes and leads to instability (and reports from Google in the store Vitals). This release should fix the crash or at least lessen the chances of it occurring - but since I can't consistently reproduce it - who knows. I will keep looking.

Regarding forking KTOR - I have a simple fork of KTOR which applies 2 commits over the latest tagged release version and applies a single 1-line change. It is only supported for JVM, specifically for Android, and I will do absolutely zero support regarding the fork. This single line change added the ability for me to grab a socket BEFORE it was connected but AFTER it was built, so that I could then implement support on the Android side for binding a Socket to a Network connection.

If you are curious, see here and here

Future work on TetherFi will hopefully finally bring support for SOCKS connections. Like HTTP, SOCKS is just another way to connect devices together, but one important difference for SOCKS is that it has "generic" network support for just about anything - including UDP connections. A working SOCKS4/SOCKS4a/SOCKS5/SOCKS5H (at least for connect()) is currently on the developer mode branch for 49 and I look to release a version 50 with full production support. Finally after so many years, progress is being made on this issue

Other software of note these past few months have been the following for Linux systems

pstate-frequency gained support for the new amd-pstate driver's core-boost functionality. On supported Linux kernels (6.11+) you will be able to also set the turbo boost state for AMD CPU using amd-pstate as the driver.

I released iptables-geoblock, which is a simple shell script that uses an xtables DKMS module to block connections from IP addresses based on the country. I use this in my homelab/VPS setup to block connections from any countries that I do not reside in currently - because no legitimate users need access from outside of my friendship circle.

I released poke-monitor which I use on Linux to "wake up" my DP connected monitor after suspend. Before, after suspend, my DP monitor would just stay on a lit up black screen. Linux seems to have weird issues with this for whatever reason, but basically "poking" the monitor with something like xrandr to query the EDID seems to fix it. Though I don't run dual monitors anymore (1 large 34"), it was particularly helpful when I did.

I released adjust-pci-latency which is a micro-optimization tool that collects recommendations from the ArchLinux wiki around performance tuning for PCI devices and ships it as a simple script. You can use it to "finetune" your PCI devices for things like gaming (lower latency) or supposedly even realtime pro-audio production (though I lack the hardware for this and cannot actually confirm this).

Lots more changes in the future, and life gets busier and busier still. More to come.

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyam.soft@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

TetherFinally

Hey, it's been a little while.

Back in February I started a new full-time day job, so updates both code and blog have obviously been sparse and slower. I did finally manage to get some stuff released though.

For nerds, PYDroid 27 is published which brings support for Material3 UI. The Material2 days are behind us now, but the M3 widgets are basically the same. Material You is supported but optional.

This new M3 support is best reflected in the newly beta released update to TetherFi, version 41. This version brings full Material3 and Material You support, and adds some new features.

The "Stubborn Proxy" optional tweak is being made default, so it will be On unless you explicitly turn it off. In a future TetherFi version, this tweak will be removed completely, since I believe the option works very well. The "Bind to All Interfaces" tweak has been turned off, and will be removed in the next version, as the default configuration is now faster and more reliable than the tweak was.

One significant feature additional is the ability to track and monitor the amount of data used by connected devices. You will be able to monitor how much data the connected device sends to and receives from the Internet. This feature work is done in preparation of a future feature additional requested by a community member on GitHub to implement Bandwidth limits.

Now that this release is out the door I can continue work on my two other apps, which have still not been released public as I am trying to figure out the final few steps to take them from "cool toy" to actual "production product", which is always the most-fun-but-most-time-consuming step of the process. Having new commitments at a new job doesn't do me any favors here - but I digress.

We'll get there when we get there!

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyam.soft@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

Split Up Your bashrc

Have you ever found yourself in this situation?

You add a new line to your .bashrc to use some cool new something, you close your terminal, and then the next time you go to open your terminal, it crashes because something was invalid in your bashrc.

Bummer.

I'm here with a hot take today - you should split your bashrc up into individial "drop-in" config style files instead, so that you can:

1. Have cleanly separated responsibilities in each rc dropin file

2. Avoid killing your entire bashrc because of one bad line.

You can see how I use dropin config files as well as the contents of the dropins here.

By setting up my bashrc, bash_profile, and general environment files using the drop-in style, I can easily maintain and change one part of my configuration without worrying about it effecting another section - kind of like code.

More code stuff someday.

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyam.soft@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

PXE and XYZ

If you are a giant nerd like I am, you may have dabbled with PXE boot to launch systems off of network devices instead of installing an operating system on to a physical drive.

Nerd.

Anyway, if you manage a fleet of devices all via PXE or you have a virtualized cluster or do whatever else in your lab with a random set of machines, you've probably heard of netboot.xyz. If you haven't you may be making life more difficult than it has to be.

You can set the image up in a container on a central machine, host whatever your custom standard image packages are supposed to be, and then deploy image updates centrally through the xyz delivery so that way you don't need to carry and pass around a USB stick, or deal with mass email chains about what the latest PXE should be.

Plus it's fun.

If you like that kind of thing, you nerd.

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyam.soft@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================

TetherFi and the Older Devices

TetherFi supports "old" versions of Android, all the way down to Android N which was released in 2016! As far as developer toolchain is concerned, N is still "new enough" that most modern Android features work.

Recently though I was testing TetherFi on an Android N emulator and noticed that some visual differences made the app a little tricky to use on older versions.

For one thing, the bottom Navigation used in old versions of Android was showing as completely transparent in Light mode! White buttons on a white background are very hard to see. This is because TetherFi requests that the Navigation bar itself be completely transparent, and requests that the Navigation bar paint black icons using the new AndroidX compat edgeToEdge method.

What I didn't notice because I failed to read the documentation, or the documentation failed to note, is that while a Transparent Navigation bar works just fine on old Android N, the black-icon change does absolutely nothing! In the code it is intentionally left blank, a no-op. Thanks AndroidX.

A change in a developer version that should become the future version 41 will make the bar semi-transparent on older versions of Android to account for the fact that the dark icons do not show up.

Similarly, light status icons were not taking effect properly on old versions of Android, and various areas on screen which displayed some "fallback" text for unsupported features were very hard to read.

While modern Android feels like it is now at least Android 9 and above, all pyamsoft Android applications (currently only 1 public one :( ) will continue to support down to Android 7 (N) as long as it is feasibly possible.

The new TetherFi update will hopefully be arriving "soon TM".

Stay tuned!

========================
Follow pyamsoft around the Web for updates and announcements about the newest applications!
Like what I do?

Send me an email at: pyam.soft@gmail.com
Or find me online at: https://pyamsoft.blogspot.com

Follow my Facebook Page
Check out my code on GitHub
=========================