local-tun VPN NetworkManager config

[Klaaktu]

Took a while to figure out, hope this helps~

{
  "locals": [
    {
      "protocol": "tun",
      "tun_interface_name": "shadowsocks",
      "tun_interface_address": "10.1.0.3/24"
    }
  ],
  "servers": [
    {
      "address": ,
      "port": 8388,
      "method": "2022-blake3-aes-256-gcm",
      "password": 
    }
  ],
  "mode": "tcp_and_udp",
  "outbound_fwmark": 8388
}

> nmcli connection add type tun ifname shadowsocks connection.id shadowsocks
> nmcli connection modify shadowsocks ipv4.method manual ipv4.address 10.1.0.3/24

> nmcli connection modify shadowsocks connection.dns-over-tls 2
> nmcli connection modify shadowsocks ipv4.dns "1.1.1.1#one.one.one.one" ipv4.dns-search '~.'

> nmcli con mod shadowsocks ipv4.routes "0.0.0.0/0 table=8388"
> nmcli con mod shadowsocks ipv4.routing-rules "priority 8387 table main suppress_prefixlength 0, priority 8388 not fwmark 0x20C4 table 8388"

This routes DNS into the shadowsocks interface. The route & routing-rules are copied from what NM does for WireGuard. (If only there is a NM SS plugin...)

To run:

> sudo -E capsh --user="$USER" --caps=CAP_NET_ADMIN+ip --addamb=CAP_NET_ADMIN -- -c "ssservice local -c ~/Downloads/ss-client.json"
> nmcli con up shadowsocks

The capsh command runs the program with temporay capabilities without running it as root.
To close quit ssservice and use nmcli con down shadowsocks.

[zonyitoo]

Linux's tun/tap requires CAP_NET_ADMIN.

[Klaaktu]

I saw this so I thought it might be possible, but this setup uses fwmark which requires the CAP_NET_ADMIN privilege anyway...
EDIT: Modified the command to add the capability instead of running as sudo.