nixos/nordvpn: add meshnet support by different-error · Pull Request #576413 · NixOS/nixpkgs

different-error · 2026-10-20T13:49:19Z

Adds libtelio and libdrop inside the nordvpn directory rather than as standalone packages.
nordvpn-linux's lib-versions.env pins exact versions, so an independent,
automated bump of either library could silently desync from the
bindings nordvpn expects. Keeping them local keeps that version a
hand-maintained property of the consumer, with no risk of a name
collision against an unrelated standalone package either.
Patches nordvpn-linux across nordvpnd, norduserd, and
nordfileshare to:
- add a --hosts-readonly flag, which prevents nordvpnd from
  writing to /etc/hosts
- chown the norduserd/nordfileshare sockets to the nordvpn
  group with permissions 0660, letting the unprivileged nordvpnd reach them
- upstream declined the --hosts-readonly flag, citing a UX
  cost from losing automatic hostname resolution for peers. See
  meshnet enable fails under unprivileged nordvpnd (NixOS module) NordSecurity/nordvpn-linux#1648.
Adds nordlynx to trusted interfaces.
Adds module tests covering the patched socket permissions, the
trusted-interface rule, and a non-member user's inability to reach
a group-gated norduserd (ty @novalkun).

Assisted-by: Claude Code (Claude Opus 5.5)

Manual Verification

configuration.nix

{
  pkgs,
  lib,
  ...
}:

{
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  networking.firewall.enable = true;
  #networking.firewall.checkReversePath = "loose";

  services.xserver.enable = true;
  services.displayManager.gdm.enable = true;
  services.desktopManager.plasma6.enable = true;

  services.timesyncd.enable = lib.mkForce true;
  services.timesyncd.servers = [
    "time.google.com"
    "pool.ntp.org"
  ];

  networking.hosts = {
    "1.2.3.4" = [ "my-alias" ];
  };

  services.nordvpn = {
    enable = true;
  };

  virtualisation.vmVariant = {
    virtualisation = {
      memorySize = 8192;
      cores = 3;
    };
  };
  users.groups.alice = { };
  users.users.alice = {
    isNormalUser = true;
    password = "alice";
    group = "alice";
    extraGroups = [
      "wheel"
      "nordvpn"
    ];
    shell = pkgs.bash;
    home = "/home/alice";
    createHome = true;
    packages = with pkgs; [
      dunst
      firefox
      libnotify
      nftables
      socat
      tmux
      tree
      vim
    ];
  };
  system.stateVersion = "24.11"; # Did you read the comment?
}

nixos-rebuild build-vm \
  -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/pull/576413/head.tar.gz \
  -I nixos-config=./path/to/configuration.nix

SSH-related configuration

  # SSH only over NordVPN.
  # Since we have nordlynx inside trusted interfaces,
  # we don't need to open port 22.
  services.openssh = {
    enable = true;
    openFirewall = false;
    settings = {
      PasswordAuthentication = false;
      KbdInteractiveAuthentication = false;
      PermitRootLogin = "no";
    };
  };

  users.users.<user>.openssh.authorizedKeys.keys = [
    "ssh-rsa ABCDE alice@nixos (meshnet: my-alias)"
  ];

Test protocol found in a below comment.

Things done

nixpkgs-ci

Thanks for contributing to the documentation.

Follow the documentation style guide, especially:

Show, don’t tell. Start with a minimal working example. Explain after the code.
Avoid meta-commentary. Don’t write "This section explains how to…".
Use present tense, imperative mood, and active voice. For example: "Run the command," not "The user should run the following command."
Avoid vague references like "this" when the referent is unclear. Write "This command creates a folder," not "This will create a folder."
Be direct. Avoid "should", "might", "typically", and "usually".
Cut filler words like "simply", "just", "easily", and "basically". Use "to" instead of "in order to".

For larger changes, such as adding or removing whole sections, ask the NixOS documentation team for review.

different-error · 2026-10-20T16:31:21Z

@andersonjoseph @dimkNevidimk @getreu @ruffsl

Hey folks, I can use your help. Meshnet has a lot of moving parts and I'd like to try to get this merged in sooner than later. If you don't mind, could you kindly test this PR and report back with your findings? Ty

different-error · 2026-10-21T13:02:17Z

@novalkun could you also kindly conduct a manual verification of the PR?

novalkun · 2026-10-21T14:37:32Z

@novalkun could you also kindly conduct a manual verification of the PR?

Tested 0656322 on real hardware (NixOS 26.05 + unstable): meshnet comes up, my iOS phone shows as a connected peer, ping by meshnet IP works, fileshare works both ways, and /etc/hosts stays untouched. nordvpn.cli build and nixosTests.nordvpn pass too.

different-error · 2026-10-24T14:09:58Z

@SuperSandro since you reviewed #564752, would you mind reviewing this PR as well? We would greatly appreciate your feedback, as your review could help move this toward a merge sooner. Thank you!

novalkun · 2026-10-27T11:46:54Z

Re-tested 273e920 (6.0.1) the same way: nordvpn.cli build and nixosTests.nordvpn pass, and on real hardware meshnet, peer ping and fileshare both ways work, /etc/hosts untouched.
really hope this PR also merged and go to stable release

novalkun

VM test passes with this PR's nordvpn files on nixpkgs-unstable 885ba4d. Live-tested at 273e920; the only functional change since is the socket ordering fix from #580056.

novalkun

Now that #582148 bumped nordvpn to 6.0.2, its lib-versions.env expects libtelio 6.2.5 (libdrop stays at 9.0.0), so this needs a rebase and a libtelio bump. 6.2.5 changes Cargo.lock and telio-proto, so cargoHash needs updating and it's worth checking llt-proto-rev.patch still applies.

different-error · 2026-11-10T16:45:20Z

Updated to libtelio 6.2.5. Verified the following:

Tests pass on x86_64
Connect via all three protocols using both cli and gui
List meshnet peers
Fileshare to and from VM
SSH from VM to another meshnet peer

@novalkun could you test the changes on your setup?

novalkun

Built with libtelio 6.2.5: checkPhase passes and libtelio.so has no test/mock symbols.

yipfluoric · 2026-11-11T19:47:34Z

This is broken potentially due to the pr related to #570938

       >   AWS_LC_SYS_USE_SYSTEM=1 requires a system-installed AWS-LC, but none was found.
       >   Set AWS_LC_SYS_SYSTEM_DIR to point at an install, provide OPENSSL_DIR, or unset AWS_LC_SYS_US

is what it spits out for libtelio currently but https://github.com/NixOS/nixpkgs/pull/537108/changes may be useful to pick out any other potential ones.

- build libdrop 9.0.0 from NordSecurity/libdrop Assisted-by: Claude Code (Claude Sonnet 5)

different-error · 2026-11-13T09:07:44Z

This is broken potentially due to the pr related to #570938

ty!!

- build libtelio 6.2.5 from NordSecurity/libtelio - pin llt-proto to an unmerged rev that ships ens.proto Assisted-by: Claude Code (Claude Sonnet 5)

- wire libdrop and libtelio into the cli build inputs - patch nordvpn-linux to keep /etc/hosts read-only and to allow nordvpnd to reach a user's norduserd/fileshare sockets - update meta documentation: remove statements on meshnet and firewall Assisted-by: Claude Code (Claude Sonnet 5)

- add nordlynx to firewall trustedInterfaces, grant CAP_NET_RAW - extend the NixOS test to verify trusted interfaces and the new socket permissions - update nordvpn documentation to include information regarding meshnet Co-authored-by: novalkun <[email protected]> Assisted-by: Claude Code (Claude Sonnet 5)

different-error · 2026-11-13T16:58:54Z

DEVICE: machine running this PR's changes
PEER: another nordvpn meshnet peer

Setup

On DEVICE: Set protocol to nordlynx, connect

nordvpn set protocol nordlynx
nordvpn connect

On DEVICE: Set meshnet on
```
nordvpn set mesh on
```
On DEVICE: List meshnet peers
```
nordvpn mesh peer list
```

On DEVICE: Turn off meshnet, verify list fails

nordvpn set mesh off
nordvpn mesh peer list
# error

On DEVICE: Turn meshnet back on, set alias, confirm alias

nordvpn set mesh on
nordvpn mesh set nick <DEVICE-ALIAS>
nordvpn mesh peer list
# shows <DEVICE-ALIAS>

(presumes DEVICE connected to meshnet)

On DEVICE: deny incoming, routing, local, fileshare for PEER

nordvpn mesh peer incoming deny <PEER>
nordvpn mesh peer routing deny <PEER>
nordvpn mesh peer local deny <PEER>
nordvpn mesh peer fileshare deny <PEER>

nordvpn mesh peer list
# verify all four show denied

Incoming (presumes DEVICE denies PEER for incoming)

On PEER: Attempt ping to DEVICE, should fail
```
ping <DEVICE-ALIAS>
# no reply
```

On DEVICE: Allow incoming PEER

nordvpn mesh peer incoming allow <PEER>

On PEER: ping DEVICE
```
ping <DEVICE-ALIAS>
```

Fileshare (presumes DEVICE denies PEER for fileshare)

On PEER: Attempt to send file to DEVICE, should fail

nordvpn fileshare send <DEVICE-ALIAS> <PATH>
# error

On DEVICE: Allow fileshare PEER

nordvpn mesh peer fileshare allow <PEER>

On PEER: Send file to DEVICE

nordvpn fileshare send <DEVICE-ALIAS> <PATH>

On DEVICE:

nordvpn fileshare list
nordvpn fileshare accept <transfer-id>

On PEER: Allow fileshare DEVICE

nordvpn mesh peer fileshare allow <DEVICE-ALIAS>

On DEVICE: Send file to PEER

nordvpn fileshare send <PEER> <PATH>

On PEER:

nordvpn fileshare list
nordvpn fileshare accept <transfer-id>

Routing (presumes DEVICE denies PEER for routing; PEER on a different network)

On PEER: Attempt connect to DEVICE, should fail

nordvpn mesh peer connect <DEVICE-ALIAS>
# error

On DEVICE: Allow routing PEER
```
nordvpn mesh peer routing allow <PEER>
```
On PEER: Check IP address
```
curl ifconfig.me
```
On DEVICE: Check IP address
```
curl ifconfig.me
```

On PEER: Connect to DEVICE

nordvpn mesh peer connect <DEVICE-ALIAS>

On PEER: Verify IP changed, matches DEVICE
```
curl ifconfig.me
```

Local network (presumes PEER connected to DEVICE)

On PEER: Attempt to access device on DEVICE's LAN (e.g. router), should fail
```
ping <local-device-ip>
# error
```

On DEVICE: Allow local PEER, set lan-discovery on

nordvpn mesh peer local allow <PEER>
nordvpn set lan-discovery on

On PEER: Verify access to device on DEVICE's LAN
```
ping <local-device-ip>
```

SSH

On DEVICE: ssh to PEER
```
ssh <user>@<PEER>
```
(Use sshd config snippet on PEER. See PR's description)

VPN Connection

Connect with OpenVPN and NordLynx via CLI

nordvpn set protocol openvpn_tcp && nordvpn c && curl ipinfo.io
nordvpn set protocol openvpn_udp && nordvpn c && curl ipinfo.io
nordvpn set protocol nordlynx && nordvpn c && curl ipinfo.io

Connect via nordvpn GUI

@novalkun @getreu please verify meshnet and basic nordvpn functionality using this test protocol. You do not need to include the entire document in your comment: stating that everything works when tested per the protocol should work, or mention any sections you skipped.

nixpkgs-ci Bot reviewed Oct 20, 2026

View reviewed changes

nixpkgs-ci Bot requested a review from novalkun October 20, 2026 13:56

novalkun mentioned this pull request Oct 20, 2026

nordvpn: add meshnet support #564752

Closed

6 of 13 tasks

different-error force-pushed the nordvpn-meshnet branch from add7cf4 to e09490b Compare October 20, 2026 14:07

novalkun reviewed Oct 20, 2026

View reviewed changes

Comment thread pkgs/by-name/no/nordvpn/cli.nix Resolved

different-error force-pushed the nordvpn-meshnet branch from e09490b to 0656322 Compare October 20, 2026 16:26

different-error mentioned this pull request Oct 21, 2026

nordvpn: init at 5.2.0 #406725

Closed

6 of 13 tasks

novalkun approved these changes Oct 21, 2026

View reviewed changes

nixpkgs-ci Bot added 12.approvals: 1 This PR was reviewed and approved by one person. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. labels Oct 21, 2026

different-error force-pushed the nordvpn-meshnet branch 2 times, most recently from da253de to 273e920 Compare October 27, 2026 10:32

different-error requested a review from novalkun October 27, 2026 10:32

novalkun approved these changes Oct 27, 2026

View reviewed changes

novalkun mentioned this pull request Oct 28, 2026

nixos/nordvpn: order nordvpnd after its socket #580056

Merged

4 of 13 tasks

different-error changed the title ~~NordVPN Meshnet~~ nordvpn: add meshnet support Oct 31, 2026

different-error force-pushed the nordvpn-meshnet branch 2 times, most recently from ef4f47a to 3d39402 Compare October 31, 2026 08:12

different-error changed the title ~~nordvpn: add meshnet support~~ nixos/nordvpn: add meshnet support Oct 31, 2026

different-error requested a review from novalkun October 31, 2026 08:17

novalkun approved these changes Oct 31, 2026

View reviewed changes

novalkun mentioned this pull request Nov 2, 2026

nixos/nordvpn: fix DNS leak outside the tunnel #582251

Open

4 of 13 tasks

novalkun suggested changes Nov 2, 2026

View reviewed changes

different-error force-pushed the nordvpn-meshnet branch from 3d39402 to 41e25c4 Compare November 10, 2026 16:38

novalkun approved these changes Nov 11, 2026

View reviewed changes

different-error mentioned this pull request Nov 11, 2026

Request: please support NixOS NordSecurity/nordvpn-linux#355

Open

nordvpn: add libdrop dependency

ccc3f49

- build libdrop 9.0.0 from NordSecurity/libdrop Assisted-by: Claude Code (Claude Sonnet 5)

different-error force-pushed the nordvpn-meshnet branch from 41e25c4 to 1f53f29 Compare November 13, 2026 15:23

different-error and others added 3 commits November 13, 2026 21:07

nordvpn: add libtelio dependency

b2d5934

- build libtelio 6.2.5 from NordSecurity/libtelio - pin llt-proto to an unmerged rev that ships ens.proto Assisted-by: Claude Code (Claude Sonnet 5)

different-error force-pushed the nordvpn-meshnet branch from 1f53f29 to ce7fbde Compare November 13, 2026 15:37

Conversation

different-error commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual Verification

Things done

Uh oh!

nixpkgs-ci Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

different-error commented Oct 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

different-error commented Oct 21, 2026

Uh oh!

novalkun commented Oct 21, 2026

Uh oh!

different-error commented Oct 24, 2026

Uh oh!

novalkun commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

novalkun left a comment

Choose a reason for hiding this comment

Uh oh!

novalkun left a comment

Choose a reason for hiding this comment

Uh oh!

different-error commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

novalkun left a comment

Choose a reason for hiding this comment

Uh oh!

yipfluoric commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

different-error commented Nov 13, 2026

Uh oh!

different-error commented Nov 13, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

different-error commented Oct 20, 2026 •

edited

Loading

different-error commented Oct 20, 2026 •

edited

Loading

novalkun commented Oct 27, 2026 •

edited

Loading

different-error commented Nov 10, 2026 •

edited

Loading

yipfluoric commented Nov 11, 2026 •

edited

Loading