Nekoray Killswitch

[John-CPP]

Here is a step-by-step guide to make a nekoray killswitch.
This guide is initially for cachyOS (KDE+systemd) but I think other versions pf linux won't require much changes.

History:
I tried iptables and ufw = no solution there. If I block my wifi - VPN doesn't work, if I don't block wifi - it works even without VPN.

1. let's make nekoray run without asking for root privileges:

sudo EDITOR=nano visudo 
%user% ALL=(ALL) NOPASSWD: /usr/bin/nekoray

2. installing rfkill:
   sudo pacman -S util-linux
3. Killswitch Script: (to get names of interfaces type "ifconfig", wlan0 - wifi/lan)
   you can put it in some home folder (any).
   killswitch.sh:

#!/bin/bash

VPN_IF="nekoray-tun"
WIFI_IF="wlan0"

kill_wifi() {
    nmcli dev disconnect "$WIFI_IF" 2>/dev/null
    sudo ip link set "$WIFI_IF" down 2>/dev/null
    if command -v rfkill >/dev/null; then
        rfkill_id=$(rfkill list | awk -v iface="$WIFI_IF" '
            BEGIN {id=""}
            $0 ~ iface {id=prev}
            {prev=$1}
            END {gsub(":", "", id); print id}
        ')
        if [ -n "$rfkill_id" ]; then
            sudo rfkill block "$rfkill_id"
        fi
    fi
}

vpn_is_up() {
    ip link show "$VPN_IF" 2>/dev/null | grep -q '<.*UP.*>'
}

while true; do
    if ! vpn_is_up; then
        kill_wifi
    fi
    sleep 1
done

4. let's create system services directory:

mkdir -p ~/.config/systemd/user
cd  ~/.config/systemd/user/

5. kate nekoray.service:

[Unit]
Description=Nekoray VPN Client
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/usr/bin/nekoray
Restart=on-failure

[Install]
WantedBy=default.target

kate vpn-monitor.service

[Unit]
Description=VPN Kill Switch Monitor
After=network-online.target nekoray.service sys-devices-virtual-net-nekoray\x2dtun.device sys-subsystem-net-devices-nekoray\x2dtun.device
Requires=nekoray.service sys-devices-virtual-net-nekoray\x2dtun.device sys-subsystem-net-devices-nekoray\x2dtun.device

[Service]
ExecStart=/home/max/soft/killswitch_service.sh
Restart=always
RestartSec=1

[Install]
WantedBy=default.target

7. by the way, to get: sys-devices-virtual-net-nekoray\x2dtun.device sys-subsystem-net-devices-nekoray\x2dtun.device
   just run:

❯ sudo systemctl | grep nekoray-tun
  sys-devices-virtual-net-nekoray\x2dtun.device                                            loaded active plugged   /sys/devices/virtual/net/nekoray-tun
  sys-subsystem-net-devices-nekoray\x2dtun.device                                          loaded active plugged   /sys/subsystem/net/devices/nekoray-tun

replace my services with yours

sudo systemctl --user daemon-reload
sudo systemctl --user enable --now nekoray.service
sudo systemctl --user enable --now vpn-monitor.service

That's all folks. Comments/improvements are appreciated!