Use udp2raw to traverse UPD-blocking networks

flake.nix

@@ -99,6 +99,7 @@
           emacs-overlay.overlay
           (self: super: {
             tetris = tetris.packages.${self.system}.default;
+            udp2raw = self.callPackage ./packages/udp2raw { };
           })
           nur.overlay
           www-chvp-be.overlay
@@ -131,6 +132,9 @@
               nameToValue = name: import (./shells + "/${name}.nix") { inherit pkgs inputs; };
             in
             builtins.listToAttrs (builtins.map (name: { inherit name; value = nameToValue name; }) shellNames);
+          packages = {
+            udp2raw = pkgs.callPackage ./packages/udp2raw { };
+          };
         };
     };
 }

machines/kharbranth/default.nix

@@ -12,13 +12,16 @@
     stateVersion = "20.09";
     base = {
       bluetooth.enable = true;
-      network.mobile = {
+      network = {
+        mobile = {
           enable = true;
           wireless-interface = "wlp0s20f3";
           wired-interfaces = {
             "enp0s13f0u2u2" = { };
           };
         };
+        wireguard.onCorporate = true;
+      };
       zfs = {
         encrypted = true;
         backups = [

modules/base/network/wireguard.nix

@@ -36,10 +36,17 @@ in
       default = false;
       example = true;
     };
+    onCorporate = lib.mkOption {
+      default = false;
+      example = true;
+    };
   };
   config = {
-    networking.firewall.allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
+    networking.firewall = {
-    networking.firewall.trustedInterfaces = [ "wg0" ];
+      allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
+      allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
+      trustedInterfaces = [ "wg0" ];
+    };
     boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
     services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
       enable = true;
@@ -68,12 +75,14 @@ in
         };
       };
     };
-    systemd.network = {
+    systemd = {
+      network = {
         netdevs.wg0 = {
           enable = true;
           netdevConfig = {
             Name = "wg0";
             Kind = "wireguard";
+            MTUBytes = "1342";
           };
           wireguardConfig =
             if config.chvp.base.network.wireguard.server then {
@@ -98,7 +107,10 @@ in
                 wireguardPeerConfig = {
                   PublicKey = data.lasting-integrity.pubkey;
                   AllowedIPs = subnet;
-                Endpoint = "lasting-integrity.vanpetegem.me:51820";
+                  Endpoint =
+                    if config.chvp.base.network.wireguard.onCorporate
+                    then "127.0.0.1:51820"
+                    else "lasting-integrity.vanpetegem.me:51820";
                   PresharedKeyFile = pskFile;
                   PersistentKeepalive = 25;
                 };
@@ -110,6 +122,7 @@ in
           address = [ "${data.${config.networking.hostName}.ip}/32" ];
           domains = [ "local" ];
           dns = [ data.lasting-integrity.ip ];
+          linkConfig.MTUBytes = "1342";
           routes = [{
             routeConfig =
               if config.chvp.base.network.wireguard.server then {
@@ -123,6 +136,21 @@ in
           }];
         };
       };
+      services = {
+        udp2raw-server = lib.mkIf config.chvp.base.network.wireguard.server {
+          description = "UDP tunnel over TCP for wireguard";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          script = "${pkgs.udp2raw}/bin/udp2raw -s -l 0.0.0.0:8080 -r 127.0.0.1:51820 -k 'secret'";
+        };
+        udp2raw-client = lib.mkIf config.chvp.base.network.wireguard.onCorporate {
+          description = "UDP tunnel over TCP for wireguard";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" ];
+          script = "${pkgs.udp2raw}/bin/udp2raw -c -l 127.0.0.1:51820 -r 54.38.222.69:8080 -k 'secret'";
+        };
+      };
+    };
     age.secrets."files/wireguard/psk" = {
       file = ../../../secrets/files/wireguard/psk.age;
       owner = "systemd-network";

packages/udp2raw/default.nix

@@ -0,0 +1,26 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, iptables
+}:
+
+stdenv.mkDerivation rec {
+  pname = "udp2raw";
+  version = "20200818.0";
+  src = fetchFromGitHub {
+    owner = "wangyu-";
+    repo = "udp2raw";
+    rev = version;
+    hash = "sha256-TkTOfF1RfHJzt80q0mN4Fek3XSFY/8jdeAVtyluZBt8=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildPhase = "make dynamic";
+  installPhase = ''
+    mkdir -p $out/bin
+    cp udp2raw_dynamic $out/bin/udp2raw
+    wrapProgram $out/bin/udp2raw --prefix PATH : "${lib.makeBinPath [ iptables ]}"
+  '';
+}