From ddbc04dfd2c9967828b982f824a1a7774f68abd2 Mon Sep 17 00:00:00 2001
From: clerie <git@clerie.de>
Date: Tue, 25 Jul 2023 21:31:22 +0200
Subject: [PATCH] modules/wg-clerie: select VPN endpoint based on IP protocol
 availability

---
 modules/wg-clerie/default.nix | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/modules/wg-clerie/default.nix b/modules/wg-clerie/default.nix
index 1aea196..3a6b69e 100644
--- a/modules/wg-clerie/default.nix
+++ b/modules/wg-clerie/default.nix
@@ -36,14 +36,30 @@ in
 
     petabyte.policyrouting = {
       enable = true;
-      rules6 = concatMap (ip: [
-        { rule = "from ${ip} lookup wg-clerie"; prio = 20000; }
-        { rule = "from ${ip} unreachable"; prio = 20001; }
-      ]) cfg.ipv6s;
-      rules4 = concatMap (ip: [
-        { rule = "from ${ip} lookup wg-clerie"; prio = 20000; }
-        { rule = "from ${ip} unreachable"; prio = 20001; }
-      ]) cfg.ipv4s;
+      rules6 = (concatMap (ip: [
+        { rule = "from ${ip} lookup wg-clerie"; prio = 19000; }
+        { rule = "from ${ip} unreachable"; prio = 19001; }
+      ]) cfg.ipv6s) ++ [
+        # Do not reach VPN server via VPN
+        { rule = "to 2a01:4f8:c0c:15f1::1/128 ipproto udp dport 51820 lookup main"; prio = 20000; }
+        { rule = "to 2a01:4f8:c0c:15f1::1/128 ipproto udp dport 51820 unreachable"; prio = 20001; }
+        # Try direct routing first, fallback to VPN
+        { rule = "lookup main"; prio = 21000; }
+        { rule = "lookup wg-clerie"; prio = 21001; }
+        { rule = "unreachable"; prio = 22000; }
+      ];
+      rules4 = (concatMap (ip: [
+        { rule = "from ${ip} lookup wg-clerie"; prio = 19000; }
+        { rule = "from ${ip} unreachable"; prio = 19001; }
+      ]) cfg.ipv4s) ++ [
+        # Do not reach VPN server via VPN
+        { rule = "to 78.47.183.82/32 ipproto udp dport 51820 lookup main"; prio = 20000; }
+        { rule = "to 78.47.183.82/32 ipproto udp dport 51820 unreachable"; prio = 20001; }
+        # Try direct routing first, fallback to VPN
+        { rule = "lookup main"; prio = 21000; }
+        { rule = "lookup wg-clerie"; prio = 21001; }
+        { rule = "unreachable"; prio = 22000; }
+      ];
     };
 
     networking.wireguard.enable = true;
@@ -54,7 +70,8 @@ in
         table = "wg-clerie";
         peers = [
           {
-            endpoint = "vpn.clerie.de:51820";
+            # Fallback to legacy IP if there is no route to VPN server
+            endpoint = "$(ip route get 2a01:4f8:c0c:15f1::1 ipproto udp dport 51820 &>/dev/null && echo '[2a01:4f8:c0c:15f1::1]:51820' || echo '78.47.183.82:51820')";
             persistentKeepalive = 25;
             dynamicEndpointRefreshSeconds = 5;
             allowedIPs = [ "0.0.0.0/0" "::/0" "10.20.30.0/24" "2a01:4f8:c0c:15f1::/113" ];