PrivSec-dev/privsec.dev
1
0
Fork 0
mirror of https://github.com/PrivSec-dev/privsec.dev synced 2024-12-22 04:41:33 -05:00
Code

Fix systemd-resolved restart ratelimiting

Browse Source 
Signed-off-by: Tommy <contact@tommytran.io>
This commit is contained in:
Tommy 2024-05-21 11:54:13 -07:00
parent 36f9afbe98
commit ceec9636d2
Signed by: Tomster
GPG Key ID: 555C902A34EC968F
2 changed files with 16 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
content/posts/qubes/Using IVPN on Qubes OS.md
View File

@ -31,22 +31,7 @@ sudo dnf config-manager --add-repo https://repo.ivpn.net/stable/fedora/generic/i
sudo dnf install -y ivpn-ui
```
IVPN needs to restart `systemd-resolved` and run `/usr/lib/qubes/qubes-setup-dnat-to-ns` at boot to work properly, especially if you want to chain ProxyVMs. `/usr/lib/qubes/qubes-setup-dnat-to-ns` also needs to be run every time IVPN modifies `/etc/resolv.conf`. Create the following files:
- `/etc/systemd/system/dnat-to-ns-boot.service`
```
[Unit]
Description=Run /usr/lib/qubes/qubes-setup-dnat-to-ns 10 seconds after boot
[Service]
Type=oneshot
ExecStart=/usr/bin/sleep 10
ExecStart=/usr/bin/systemctl restart systemd-resolved
ExecStart=/usr/lib/qubes/qubes-setup-dnat-to-ns
[Install]
WantedBy=multi-user.target
```
IVPN needs to restart `systemd-resolved` and run `/usr/lib/qubes/qubes-setup-dnat-to-ns` every time IVPN modifies `/etc/resolv.conf`. Create the following files:
- `/etc/systemd/system/dnat-to-ns.service`
```
@ -74,10 +59,16 @@ Unit=dnat-to-ns.service
WantedBy=multi-user.target
```
Next, enable both the systemd service and the systemd path:
Create `/etc/systemd/system/systemd-resolved.conf.d/override.conf` to disable rate limiting on systemd-resolved restarting:
```
[Unit]
StartLimitIntervalSec=0
```
Next, enable the systemd path:
```bash
sudo systemctl enable dnat-to-ns-boot.service
sudo systemctl enable dnat-to-ns.path
```

7
content/posts/qubes/Using Mullvad VPN on Qubes OS.md
View File

@ -59,6 +59,13 @@ Unit=dnat-to-ns.service
WantedBy=multi-user.target
```
Create `/etc/systemd/system/systemd-resolved.conf.d/override.conf` to disable rate limiting on systemd-resolved restarting:
```
[Unit]
StartLimitIntervalSec=0
```
Next, enable the systemd path:
```bash