[!IMPORTANT]

为了“防止”DNS 泄漏，该模块仅仅使 NSCD 套接字对 systemd 服务不可访问。这可能会引发其他问题，且泄漏仅在通过 UDP 解析 DNS 时进行了测试。其他解析 DNS 的方式如 DoT 和 DoH 尚未测试，且 DNS 可能通过其他方式泄漏，因此建议你始终自行监控和测试 DNS 泄漏。

安装

Nix Flake

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    vpn-confinement.url = "github:Maroka-chan/VPN-Confinement";
  };
  outputs = { self, nixpkgs, vpn-confinement, ... }:
  {
    # Change hostname, system, etc. as needed
    nixosConfigurations.hostname = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        vpn-confinement.nixosModules.default
      ];
    };
  };
}

使用方法

定义 VPN 网络命名空间

vpnNamespaces. = { # The name is limited to 7 characters
  enable = true;
  wireguardConfigFile = ;
  accessibleFrom = [
    ""
  ];
  portMappings = [{
      from = ;
      to = ;
      protocol = ""; # protocol = "tcp"(default), "udp", or "both"
  }];
  openVPNPorts = [{
    port = ;
    protocol = ""; # protocol = "tcp"(default), "udp", or "both"
  }];
};

将 systemd 服务添加到 VPN 网络命名空间

systemd.services..vpnConfinement = {
  enable = true;
  vpnNamespace = "";
};

示例

# configuration.nix
{ pkgs, lib, config, ... }:
{
  # Define VPN network namespace
  vpnNamespaces.wg = {
    enable = true;
    wireguardConfigFile = /. + "/secrets/wg0.conf";
    accessibleFrom = [
      "192.168.0.0/24"
    ];
    portMappings = [
      { from = 9091; to = 9091; }
    ];
    openVPNPorts = [{
      port = 60729;
      protocol = "both";
    }];
  };
  # Add systemd service to VPN network namespace
  systemd.services.transmission.vpnConfinement = {
    enable = true;
    vpnNamespace = "wg";
  };
  services.transmission = {
    enable = true;
    settings = {
      "rpc-bind-address" = "192.168.15.1"; # Bind RPC/WebUI to VPN network namespace address
      # RPC-whitelist examples
      "rpc-whitelist" = "192.168.15.5"; # Access from default network namespace
      "rpc-whitelist" = "192.168.1.*";  # Access from other machines on specific subnet
      "rpc-whitelist" = "127.0.0.1";    # Access through loopback within VPN network namespace
    };
  };
}

[!注意]

从默认网络命名空间访问时使用VPN网络命名空间地址。\

curl 192.168.15.1:9091

请参阅模块文件中的所有选项及其描述。

--- Tranlated By Open Ai Tx | Last indexed: 2026-06-13 ---