local-tun VPN NetworkManager config

[Klaaktu]

Took a while to figure out, hope this helps~

{
  "locals": [
    {
      "protocol": "tun",
      "tun_interface_name": "ss-tun",
      "tun_interface_address": "10.1.0.3/24"
    }
  ],
  "servers": [
    {
      "address": ,
      "port": 8388,
      "method": "2022-blake3-aes-256-gcm",
      "password": 
    }
  ],
  "mode": "tcp_and_udp",
  "fast_open": true,
  "no_delay": true,
  "ipv6_first": true,
  "outbound_fwmark": 8388
}

> nmcli connection add type tun ifname ss-tun connection.id ss-tun
> nmcli connection modify ss-tun ipv4.method manual ipv4.address 10.1.0.3/24

> nmcli connection modify ss-tun connection.dns-over-tls 2
> nmcli connection modify ss-tun ipv4.dns "1.1.1.1#one.one.one.one, 9.9.9.9#dns.quad9.net"
> nmcli con mod ss-tun ipv4.dns-search '~.'

> nmcli con mod ss-tun ipv4.routes "0.0.0.0/0 table=8388"
> nmcli con mod ss-tun ipv4.routing-rules "priority 8387 table main suppress_prefixlength 0, priority 8388 not fwmark 0x20C4 table 8388"

This routes DNS into the ss-tun. The route & routing-rules are copied from what NM does for WireGuard. (If only there is a NM SS plugin...)

To run:

> sudo ssservice local -c ~/Downloads/ss-client.json
> nmcli con up ss-tun

(Don't really need sudo in this setup? But ssservice requires it...)
To close quit ssservice and use nmcli con down ss-tun.