diff --git a/nixos/modules/services/networking/mullvad-vpn.nix b/nixos/modules/services/networking/mullvad-vpn.nix index 0a339cefd3f0..4c0abb9b8942 100644 --- a/nixos/modules/services/networking/mullvad-vpn.nix +++ b/nixos/modules/services/networking/mullvad-vpn.nix @@ -10,7 +10,6 @@ with lib; default = false; description = '' This option enables Mullvad VPN daemon. - This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security. ''; }; @@ -36,12 +35,6 @@ with lib; environment.systemPackages = [ cfg.package ]; - # mullvad-daemon writes to /etc/iproute2/rt_tables - networking.iproute2.enable = true; - - # See https://github.com/NixOS/nixpkgs/issues/113589 - networking.firewall.checkReversePath = "loose"; - # See https://github.com/NixOS/nixpkgs/issues/176603 security.wrappers.mullvad-exclude = mkIf cfg.enableExcludeWrapper { setuid = true; @@ -59,13 +52,9 @@ with lib; "NetworkManager.service" "systemd-resolved.service" ]; - path = [ - pkgs.iproute2 - # Needed for ping - "/run/wrappers" - # See https://github.com/NixOS/nixpkgs/issues/262681 - ] ++ (lib.optional config.networking.resolvconf.enable - config.networking.resolvconf.package); + # See https://github.com/NixOS/nixpkgs/issues/262681 + path = lib.optional config.networking.resolvconf.enable + config.networking.resolvconf.package; startLimitBurst = 5; startLimitIntervalSec = 20; serviceConfig = {