Savely Krasovsky's blog

Using nix-darwin on macOS

savely@krasovs.ky (Savely Krasovsky) — Sun, 28 Jun 2026 18:54:00 +0200

I am not a regular macOS user, but I have never liked brew for some reason. Recently I got a MacBook for personal projects and occasional work. Almost immediately I needed to use brew, because the built-in OpenSSH doesn’t really work with FIDO2 SSH keys. Installing it from brew feels wrong to me, I don’t really know why; call it personal preference.

Then I tried to google the alternatives and found out that there is a nix-darwin project! Turns out you can enjoy nixpkgs repositories on macOS and nix’s declarative way of configuring your system.

I don’t want to describe the pros and cons of that approach, but for me it’s much more preferable to using plain brew.

I still use brew for all GUI apps as casks, because it’s a legitimate case, in my opinion. 90% of packages are part of my independent Home Manager configuration (so I could use it on the Linux machine as well), and the other 10% are system-wide packages like openssh and libfido2 and something like podman.

Here is a small guide for someone who has never used nix and nix-darwin before. A few years ago nix installation was pretty invasive. It was a simple bash script, and if you wanted to remove it later, it was an interesting quest, I would say.

Today you can just use nix-installer; I prefer the one provided by the NixOS community.

Install nix-installer

Use the following command from their README:

curl -sSfL https://artifacts.nixos.org/nix-installer | sh -s -- install --enable-flakes

Follow the instructions, it should be pretty straightforward.

Install nix-darwin

We can break down this process into these steps:

Create the /etc/nix-darwin directory and set proper permissions
Initialize a flake using the nix you installed using nix-installer
Replace the simple configuration with your hostname.

Why? Because when you build or switch to the configuration, nix by default searches for the configuration for your current machine based on the hostname. It’s common for people to use a single config across a fleet of their machines.
Install nix-darwin using nix itself.
Edit the configuration to your liking.
Switch your machine to that configuration.

Those steps are described in detail in the nix-darwin README.

Example configuration

Since /etc/nix-darwin is owned by your user, you can open that directory in your favorite editor and start building your configuration. You can check my personal configuration here.

As of 2026, it’s pretty basic:

flake.nix - flake entry point and host outputs.
hosts/ - machine-specific system configurations.
modules/ - system-level modules grouped by platform.
home/ - Home Manager user configurations.
home/common/ - shared Home Manager modules for shell, git, ssh, fzf, starship, and user packages.

You can use it as an entry point for your own configuration.

Nvidia Arch Linux minimal setup

savely@krasovs.ky (Savely Krasovsky) — Thu, 31 Oct 2024 09:53:39 +0100

I was struggling with Nvidia driver a lot on my Arch Linux setup, but I’ve finally resolved most of the problems.

Basically I had those problems:

Sleep didn’t work. I was getting black screen most of the time after trying to wake up the machine.
HDR was working, but colors were washed out.
HDMI 2.1 didn’t work either. OS was losing monitor signal for some reason.

I’ve resolved all the problems after release of the new 565.57.01 beta driver which is already available in extra-testing repo.

Key points

Those points are applicable only for default linux core, other may require additional tuning.
Since 560.35.03-5 you don’t set kernel parameters to use driver. Both nvidia_drm.modeset and nvidia_drm.fbdev are enabled by default, you can remove.
nvidia-suspend.service is disabled by default while Arch wiki says it’s should be enabled by default. Same with nvidia-hibernate.service. Please check the status and enable it, e.g. systemctl enable nvidia-suspend.service.
nvidia-resume.service is also disabled by default, but you need to enable it only under GDM.
Without those services your GPU will be unable to use deep S3 sleep and hibernation.
You don’t need to manually enable NVreg_PreserveVideoMemoryAllocations=1 and NVreg_TemporaryFilePath=/var/tmp modprobe options. They are already enabled by default.
HDR was completely disabled for Nvidia GPUs in KDE Plasma 6.2 due to bug. You need to re-enable it manually using KWIN_DRM_ALLOW_NVIDIA_COLORSPACE=1 environment variable, e.g. adding it to /etc/environment and re-logging.
You need to use version 565 and higher if your colors are washed out and pale after enabling it (you will notice it if they are, believe me).
SDDM launched under X11 for some reason broke HDMI 2.1 in my case. Switching to Wayland solved the problem. As a nice bonus I also now have HDR enabled in SDDM because it now matches the Plasma configuration.

Summary

You don’t need to enable most of the options by hand, it’s now enabled by default.
You still need to enable nvidia-suspend (and nvidia-hibernate if you use hibernation) for sleep to work.
You need to re-enable HDR in KDE Plasma using environment variable.
Switch SDDM to Wayland if you have problems with HDMI 2.1.

Update from 21.11.2024

Unfortunately it didn’t resolve sleep/suspend problems completely. You also need Linux 6.12, it contains additional suspend patch.

However, I noticed another issue: nvidia-open suffers from occasional stuttering and various lags across OS interface: scrolling browser, moving windows, etc. Those symptoms disappear if GPU is under some kind of constant load: video recoding, large video decoding, gaming, etc. Unfortunately there is no fix for this, because bug is in GSP firmware which cannot be disabled in open modules. You can switch to proprietary nvidia and disable GSP using modprobe option:

options nvidia NVreg_EnableGpuFirmware=0

Notes about compact and powerful PC and server builds

savely@krasovs.ky (Savely Krasovsky) — Sun, 13 Oct 2024 22:54:27 +0200

I wanted to build a decently powerful server for all my self-hosted staff for a long time, but after Russo-Ukrainian had been started priorities obviously shifted, so I put this idea on hold.

Since then, I moved to the Serbia, but I am not sure if I will stay here for years, so both main PC and server should be as compact as it’s possible and also as powerful.

Main desktop PC

I built my new desktop PC in May, and I am still impressed! Couldn’t imagine that 10L case could hold so much power.

CPU: AMD Ryzen 9 7950X3D
GPU: ASUS ProArt GeForce RTX 4080 Super OC
Motherboard: ASUS ROG X670E-I
RAM: CORSAIR Vengeance 96GB DDR5-6000 CL30
PSU: Phanteks Revolt SFX 850W
Cooling: Fractal Design Lumen S24 с Noctua NF-A12x25 и SilverStone Air Slimmer 120
Case: FormD T1 v2.1 + Essentials Pack (USB Type-C front panel addon) + Fitting Pack (just for fun)
Storage: Crucial T705 4TB
Additional: Noctua NA-FG1-12 fan grill

More photos

I can even put it inside Kanken 2.0:

Server

Completed the build in March 2025, server has 5.8L volume. Very small, but powerful! All disks have Power Loss Protection (PLP). Low draw while in idle (58W in package C2).

CPU: Intel Core i9-14900K
Motherboard: ASRock Rack W680D4ID-2T/G5/X550
RAM: Kingston Server Premier 96GB DDR5-5600 CL46 (ECC)
GPU: ASRock Intel Arc A380 Low Profile 6GB
PSU: HDPLEX 250W GaN
Cooling: Noctua NH-L9x65
Case: Custom Mod SL3 modified to fit Deep mini-ITX
Storage:
- 2 x M.2 (Kingston DC2000B 960GB)
- 5 x SATA (Samsung SM863 1.96TB).

Simple Waybar module that checks Arch Linux system updates

savely@krasovs.ky (Savely Krasovsky) — Sun, 07 May 2023 11:45:20 +0300

I’ve released simple but yet effective module for the Waybar that checks Arch Linux system updates. There are some features that I think you would like.

Features

Sends notifications about updates.
Supports GNU gettext localization (contribute new po-files!)
Checks updates from AUR using Aurweb RPC, so works independently.
Shows updates in the tooltip.
Supports two states: pending-updates and updated to use different icons or hide module.
Uses infinite loop to supply Waybar JSON updates.
Configurable interval between checks.

You can easily install it from AUR: yay -S waybar-updates

I use it with this config:

"custom/pacman": {
  "format": "{icon}{}",
  "return-type": "json",
  "format-icons": {
    "pending-updates": " ",
    "updated": ""
  },
  "exec-if": "which waybar-updates",
  "exec": "waybar-updates"
}

In that case you will also need Nerd fonts (I personally use ttf-jetbrains-mono-nerd).

I’ve also added lite blinking effect to it:

@keyframes blink-update {
	to {
		background-color: dodgerblue;
	}
}

#custom-pacman {
	animation-timing-function: linear;
	animation-iteration-count: infinite;
	animation-direction: alternate;
}
#custom-pacman.pending-updates {
	animation-name: blink-update;
	animation-duration: 3s;
}

Screenshots

There should have been a video here but your browser does not seem to support it.

If you like it, please consider to give it a star!

Flipper Zero: writing and debugging in CLion

savely@krasovs.ky (Savely Krasovsky) — Tue, 01 Nov 2022 00:00:00 +0000

A while ago I got my own Flipper Zero and immediately tried to write own simple application. Unfortunately they officially support only one editor — VS Code.

I like JetBrains products and use them every day: from GoLand and PhpStorm to Rider and PyCharm. So why would I don’t use CLion to write and debug Flipper Zero’s apps?

CLion is a cross-platform IDE for C and C++ from JetBrains. And while it does support some features for embedded development, there are still some caveats, especially with debugging.

Setup core functionality

CLion syntax highlighting and autocomplete engine works out of the box only with CMake, but it supports compilation database, which fbt can generate. So to start:

Clone Flipper Zero firmware repo:

git clone --recursive https://github.com/flipperdevices/flipperzero-firmware.git

Build firmware, FAPs and create compile database:
```
./fbt
./fbt faps
./fbt firmware_cdb
```
Copy compile_commands.json from build/latest to the project root.
Open this file with CLion.
Go and find compile_commands.json file at build/latest again, then click right mouse button and choose Load Compilation Database Project.
Remove compile_commands.json from the project root.
Go to File -> Settings -> Build, Execution, Deployment -> Toolchains and create toolkit:
- C Compiler: toolchain/x86_64-linux/bin/arm-none-eabi-gcc
- С++ Compiler: toolchain/x86_64-linux/bin/arm-none-eabi-g++
- Debugger: toolchain/x86_64-linux/bin/arm-none-eabi-gdb-py
It should try to sync a project at Build tab successfully.

Possible problems and their solutions

CLion does not understand ccache.

Solution 1: remove ccache from system and regenerate compilation database.

Solution 2: just remove it from file:
```
cd built/target
sed -i 's/ccache\ //g' compile_commands.json
```

CLion cannot find stdlib.

Solution 1: Launch CLion under fbt environment:

source scripts/toolchain/fbtenv.sh
gtk-launch jetbrains-clion.desktop

Solution 2: Replace path to compiler with absolute ones:

cd built/target
sed -i 's/arm-none-eabi-gcc/\/home\/user\/documents\/flipperzero-firmware\/toolchain\/x86_64-linux\/bin\/arm-none-eabi-gсс/g' compile_commands.json

Solution 3: Install the latest arm-none-eabi toolkit with your system package manager:

sudo pacman -S arm-none-eabi-gcc arm-none-eabi-gdb arm-none-eabi-newlib

After this troubleshooting CLion should work as expected: highlighting and autocompleting your code.

Setup debugging

Go to Run Configuration and create your own with type Remote Debug:
- Pick debugger from toolchain you created before.
- Fill 'target remote' args with content from output of ./fbt get_blackmagic
- Point to symbol file: build/latest/firmware.elf

Create a .gdbinit file with this content in the project directory:

set confirm off
set trace-commands on

define target remote
target extended-remote $arg0
set mem inaccessible-by-default off
source debug/flipperapps.py
fap-set-debug-elf-root build/latest/.extapps
end

Then create a .gdbinit file in your home directory:
```
set auto-load safe-path /path/to/your/project
```

Before first debug session you have to attach Flipper Zero:

toolchain/x86_64-linux/bin/arm-none-eabi-gdb-py -q -ex "target remote `./fbt get_blackmagic`" -ex "monitor swdp_scan" -ex "attach 1" -ex "quit" build/latest/firmware.elf

Now you can set breakpoints and try to debug using the configuration you create. Ensure that your debugger connects successfully, otherwise try to reboot Flipper and start again from step 4.
(Optionally) After successful session of debug you can edit your debug configuration and add in “Before launch” block “External tool” to automate step 4.

UPD: 10 november 2022

Guide has been updated after patches from Flipper Devices team! Now it should work with fewer tricks.

UPD: 25 april 2023

Roman Beltiukov has pointed out in the comments about fap-set-debug-elf-root build/latest/.extapps needed to be added to the project’s .gdbinit to debug fapps.

Telegram Web App bot: разбор и аспекты безопасности

savely@krasovs.ky (Savely Krasovsky) — Tue, 14 Jun 2022 15:01:43 +0300

С релизом нового обновления Telegram у многих возникли вопросы как правильно наладить общение бот <-> Telegram, бот <-> бэкенд и сделать это безопасно. Для начала давайте проясним какие способы активации Telegram решил предоставить пользователю:

Через кнопку меню, которую можно настроить у @BotFather.
Через inline-кнопку.
Через keyboard-кнопку.
Через меню вложений.

Кнопка меню, inline-кнопка

Первый и второй способ предлагают нам аутентифицировать и авторизовать пользователя через специальный объект initData, который можно достать с помощью JavaScript. Объект имеет следующую структуру:

{
  "query_id": "str",
  "user": {
    "id": 1,
    "is_bot": false,
    "first_name": "Pavel",
    "last_name": "Durov",
    "username": "durov",
    "language_code": "ru",
    "photo_url": "https://telegram.org/durov.jpg"
  },
  "auth_date": 1655210062,
  "hash": "7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"
}

Проблема в том, что официальная документация хоть и предупреждает, но не особо объясняет зачем валидировать поле initData на сервере бота.

TL;DR

Без валидации:

Мэллори: Привет Боб, я Алиса, дай мне информацию о балансе и сделай перевод на имя Мэллори.

Боб: Пожалуйста, Алиса, всё готово.

С валидацией:

Мэллори: Привет Боб, я Алиса, дай мне информацию о балансе и сделай перевод на имя Мэллори.

Боб: Предоставьте, пожалуйста, валидную подпись Алисы.

Мэллори разводит руками

То есть нужно это затем, чтобы произвести безопасную аутентификацию (проверку подлинности запроса) и авторизацию (понять, что к боту пришла именно Алиса, а не Мэллори).

Без этой валидации бот сможет предоставлять критически важную информацию (например, вы делаете онлайн-банкинг в боте) просто по ID пользователя Telegram.

Важно также понимать, что валидация должна происходить исключительно на серверной части. Валидация на клиентской части мало того, что бессмысленна, так ещё и скомпрометирует токен вашего бота.

Валидация, к слову, не совсем тривиальная. Разработчики Telegram, как обычно, не поленились и вместо проверенного стандарта JSON Web Token (JWT), реализовали свой собственный велосипед, да ещё и на базе обычного HMAC-SHA256 (то есть HS256 будь у нас JWT-токен). В результате initData представляет собой URL-encoded строку query-параметров. Для корректной валидации которой требуется следующая цепочка шагов:

Декодируем строку, используя URL-encoding (важно, иначе значение с ключом user останется не декодированным).
Полученные пары ключ-значения сортируем в алфавитном порядке.
Исключаем ключ hash
Из полученных пар составляем тело вида: auth_date=<auth_date>\nquery_id=<query_id>\nuser=<user>. Важно сохранить значение с ключом user в чистом JSON.
Берем хэш от токена вашего бота с помощью алгоритма HMAC-SHA256 с ключом WebAppData.
Берем хэш от полученного в шаге 4 тела с помощью того же алгоритма, а в качестве ключа используем хэш, полученный ранее в виде последовательности байтов (а не hex-репрезентации!).
Преобразуем полученный хэш в hex-строку и сравниваем со значением ключа hash.

По аналогии с JWT, если валидация прошла успешно, пользователя можно считать аутентифицированным и переходить к авторизации с помощью предоставленного payload (в нашем случае это id в объекте user).

Говоря о query_id, который мы получаем в initData. Используя это поле, мы можем создать в чате сообщение с ботом от имени пользователя с бейджем via @your_bot. Для этого потребуется вызвать метод answerWebAppQuery.

+ может использоваться для приложений любой сложности
+ initData по факту является полноценным stateless-токеном по типу JWT
+ позволяет создавать сообщения от имени пользователя в чате с ботом с бейджем via @your_bot

- требуется собственный бэкенд для веб-части для валидации initData и работы с пользователем

Keyboard-кнопка

С первым и вторым способом всё понятно: вы получаете от Telegram подобие готового токена и поэтому реализация собственной аутентификации и авторизации не требуется, требуется только валидация.

Но с третьим способом ситуация с одной стороны проще, с другой сложней. Дело в том, что initData не приходит и наладить общение с серверной частью не выйдет. Ведь вы не будете знать кто к вам пришёл.

Однако при использовании этого способа появляется возможность использовать метод Telegram.WebApp.sendData(), который позволяет отправить сообщение боту напрямую, а тот предоставит его вам через long-polling или вебхуки. Стоит учесть, что после успешного выполнения веб-окно автоматически закроется, а бот отрапортует сервисным сообщением Вы успешно передали данные боту кнопкой «Test button».

Поэтому Telegram позиционирует этот способ как удобный способ сделать гибкую веб-форму ввода с полями типа date picker. Вернуть значения формы можно с помощью метода Telegram.WebApp.sendData().

Нужно понимать, что в JS-файле этот метод является лишь прослойкой, само значение, переданное в sendData() отправляются далее через MTProto-метод sendWebAppData. Методы MTProto невозможно использовать без авторизации в Telegram, поэтому тут мессенджер берет безопасность полностью на себя.

В этом заключается плюс этого метода.

+ удобно для заполнения сравнительно простых форм ввода
+ наличие собственного бэкенда для Web-части не требуется

- initData не приходит, возможность авторизовать пользователя на своём бэкенде (даже если он есть) отсутствует
- отправить информацию боту можно только 1 раз

Кнопка в меню вложений

Есть также четвертый способ, который технически не отличается от первого и второго (только дополнительными полями в initData), но в этом случае бот добавляется в меню вложений.

К сожалению эта возможность пока что доступна только для тех, кто участвует в рекламной платформе Telegram и, следовательно, внёс залог 2 миллиона евро. Поэтому пока что говорить тут особо не о чем. Из известных мне публичных ботов такую интеграцию использует @wallet.

Основной плюс — возможность использовать бота не только в личной переписке с ботом. Например, вышеупомянутый @wallet позволяет отправить любому собеседнику сообщение с информацией о переводе, собеседнику остается лишь нажать и получить свой перевод.

+ плюсы первых двух способов
+ возможность использовать бота в переписке с человеком
+ новый интуитивный механизм использования ботов Telegram

- минусы первых двух способов
- необходимо стать крупным рекламодателем на площадке Telegram

Wireguard's AllowedIPs calculator

savely@krasovs.ky (Savely Krasovsky) — Sun, 04 Jul 2021 00:00:00 +0000

As you possibly know Wireguard hasn’t something like “DisallowedIPs” parameter to exclude some networks from allowed ones. Of course technically AllowedIPs is enough, but I am tired to calculate it by hand, so created this simple calculator:

Update: I am using small Golang HTTP-server to quickly calculate results and at first I tried ipaddr due to its similarity to the Python ipaddress. But it has a little problem, in my case it caused an infinite loop that led to DoS and finally to panic. Better use the brilliant netaddr developed by Brad Fitzpatrick and the Tailscale team (their blogpost with motivation)

Update 2: I realized that this is a great case to use WASM!

Update 3: For some reason I didn’t publish source code right after this blog post was written. In 2023, I thought I lost it forever, but randomly found it in my backup files. WASM sources here. HTTP API mini server sources are probably still lost :(

Simple Certificate Authority: how-to

savely@krasovs.ky (Savely Krasovsky) — Tue, 11 May 2021 00:00:00 +0000

This post is just an example of how to create a simple CA and issue a TLS certificate. I will deliberately not give any explanations, because the Internet has been full of them for a long time.

It also frustrates me that people like to just copy and paste configurations and don’t realize that tons of parameters are just not needed for their needs. In my case I tried to keep it as simple as possible.

So create three files:

ca.cnf:

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
# You can remove this if you don't use non-ASCII symbols
utf8 = yes

[req_distinguished_name]
C = RU
CN = "Savely Krasovsky's CA"

[v3_req]
keyUsage = digitalSignature

tls.cnf:

[req]
distinguished_name = req_distinguished_name
prompt = no
utf8 = yes

[req_distinguished_name]
C = RU
CN = "Savely Krasovsky's LAN"

tls.ext:

keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = home.local
DNS.2 = *.home.local

Now execute this:

# Generate CA cert
openssl ecparam -name prime256v1 -genkey -out ca.key
openssl req -new -key ca.key -config ca.cnf -out ca.csr
openssl x509 -req -days 3650 -in ca.csr -signkey ca.key -out ca.crt

# Generate TLS cert
openssl ecparam -name prime256v1 -genkey -out tls.key
openssl req -new -key tls.key -config tls.cnf -out tls.csr
openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key -out tls.crt -days 365 -extfile tls.ext

Of course, you can create not only TLS certs, this is just the simplest case. Play with the tls.ext (especially keyUsage and extendedKeyUsage parameters) file to issue another certificate.

For example this is mTLS compatible client cert:

personal.cnf:

[req]
distinguished_name = req_distinguished_name
prompt = no
utf8 = yes

[req_distinguished_name]
C = RU
CN = "Savely Krasovsky's LAN"

personal.ext:

keyUsage = critical,digitalSignature
extendedKeyUsage = clientAuth
subjectKeyIdentifier = hash

Generation:

openssl ecparam -name prime256v1 -genkey -out personal.key
openssl req -new -key personal.key -config personal.cnf -out personal.csr
openssl x509 -req -in personal.csr -CA ca.crt -CAkey ca.key -out personal.crt -days 365 -extfile personal.ext

# Convert to convenient PKCS#12 certificate there key and cert itself are combined
openssl pkcs12 -export -out personal.pfx -inkey personal.key -in personal.crt

Checkpoint SNX adventure: isolating the proprietary in it own box

savely@krasovs.ky (Savely Krasovsky) — Mon, 26 Apr 2021 00:00:00 +0000

My company uses Checkpoint products as a VPN solution. In case of Windows and macOS there is Checkpoint Endpoint Security. In case of Linux we have to use whatever called Checkpoint SSL Network Extender or just Checkpoint SNX.

As far as I got, it encapsulates traffic into HTTPS connection between you and VPN gateway and provides TUN interface. Sounds okay on paper, right?

But as you know, proprietary software has something in common: the quality of Linux support generally sucks. Checkpoint SNX is not an exception.

Just read their support page. The distros they consider relevant in 2021: Ubuntu 17.04, Fedora 18, openSUSE 12.2. Okay, cool.

The shitty quality of Linux solution itself wasn’t the main reason to isolate it. Gateways like this are pushing settings from the server including routes, usually there is no way to somehow reconfigure this.

In my case, the company decided that split tunneling isn’t secure. It means while I am connected and trying to reach corporate resources, I cannot reach the Internet without corporate proxy and vice versa.

So I had an idea: it would be nice to just share Checkpoint VPN connection with other computers.

Particularly I wanted to:

Completely isolate Checkpoint SNX inside Linux VM.
Use WireGuard tunnels to share VPN connection.
At client-side use only one simple route: 10.0.0.0/8.

Why WireGuard? I could just use IP forwarding and NAT tweaks, but it would only work within a particular LAN and I would have to create and delete route and change DNS servers every time manually.

Let’s get started.

Install Checkpoint SNX

You can download SNX installer from your company’s VPN portal:

$ curl https://example.org/SNX/INSTALL/snx_install.sh -o snx_install.sh
# OR
$ curl https://example.org/sslvpn/SNX/INSTALL/snx_install.sh -o snx_install.sh

There is also a way to install the latest version from Checkpoint site, but I don’t recommend it, your company could use different version.

While the first part of script is just a bash script, the second part contains an archive with the binaries. The binaries are x86 (not x86-64), so you need to enable multiarch and install dependencies.

# ldd /usr/bin/snx
    ...
    libX11.so.6 => /usr/lib32/libX11.so.6
    libpam.so.0 => /usr/lib32/libpam.so.0 (0xf7d3d000)
    libstdc++.so.5 => /usr/lib32/libstdc++.so.5 (0xf7c5c000)
    ...

So you need to install three libraries: libX11, libpam, libstdc++. In various distros you need to use various names, but you can easily google it.

Finally, just install it:

$ chmod +x snx_install.sh
$ sudo ./snx_install.sh

Back to your browser and try to connect using the portal. A while back you needed a browser that supports NPAPI to launch Java-applet, but currently it seems like Checkpoint SNX uses the new mechanism. That’s why most probably a webpage will ask you to install whatever called cshell, but not csh, you will have to download another script cshell_install.sh.

Important

Before installation install OpenJRE, in my case only the latest 15.0 worked well.

$ chmod +x cshell_install.sh
$ sudo ./cshell_install.sh

In case of any errors probably you have a wrong OpenJRE version. Fortunately you can test it even after failed installation process:

$ java -jar /usr/bin/cshell/CShell.jar

Note

Scrips are idempotent, so you can run them indefinitely until getting a fix

After successful installation of snx and cshell there is another step: this jar-file runs HTTPS-server at localhost:14186, but installer fails to make certificate trusted. There are two ways to fix it:

Add /usr/bin/cshell/cert/CShell_Certificate.crt as trusted (preferred)
Just go to the localhost:14186 in your favourite browser and mark it as trusted.

Now try to reconnect again. Everything should now work.

WireGuard tunnel

I don’t want to tell here how WireGuard works. I will just provide an example of working configs:

Peer A (VM with SNX):

[Interface]
PrivateKey = ... # ABC
ListenPort = 51820
Address = 192.168.128.1/24

# Host PC
[Peer]
PublicKey = ... # XYZ' public key
AllowedIPs = 192.168.128.2/32

# You add here another peers:
#
# Mobile phone
# [Peer]
# PublicKey = DEF
# AllowedIPs = 192.168.128.3/32

Peer B (PC with which I want to share):

[Interface]
PrivateKey = ... # XYZ
Address = 192.168.128.2/32
DNS = DNS1, DNS2 # found out you VPN DNS server and hard code them here

[Peer]
PublicKey = ... # ABC's public key
AllowedIPs = 10.0.0.0/8
Endpoint = 192.168.1.8:51820 # Use an IP of your bridged VM

On both sides enable peers. You can test tunnel simply pinging thought it:

# from device to VM with SNX
$ ping 192.168.128.2

Firewall

Of course without proper firewall setup, an SNX connection won’t share. I will use modern nftables.

/etc/nftables.conf:

#!/usr/bin/nft -f
# ipv4/ipv6 Simple & Safe Firewall
# you can find examples in /usr/share/nftables/

flush ruleset

table inet filter {
	chain input {
		type filter hook input priority 0; policy drop;

		# allow established/related connections
		ct state {established, related} accept

		# early drop of invalid connections
		ct state invalid drop

		# allow from loopback
		iifname lo accept

		# allow icmp
		ip protocol icmp accept
		meta l4proto ipv6-icmp accept

		# allow wireguard
		udp dport 51820 accept

		# everything else
		reject with icmpx type port-unreachable
	}

	chain forward {
		type filter hook forward priority 0; policy drop;

		ct state {established, related} accept
		ct state invalid drop

		# allow forwarding from wireguard interface to snx one
		iifname wg0 oifname tunsnx ct state new accept
	}

	chain output {
		type filter hook output priority 0; policy accept;
	}
}

table inet nat {
	chain postrouting {
		type nat hook postrouting priority srcnat;
	}
}

Note

Don’t forget to enable IP forwarding:

net.ipv4.ip_forward=1

net.ipv6.conf.all.forwarding=1

To share SNX connection you will have to configure SNAT dynamically after connection (and disconnection). I will use systemd oneshot-service to do this.

/etc/systemd/system/snx-firewall.service:

[Unit]
Description=Checkpoint SNX firewall tweaker
BindsTo=sys-subsystem-net-devices-tunsnx.device
After=sys-subsystem-net-devices-tunsnx.device

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/root/bin/snx_add_rule.sh
ExecStop=/root/bin/snx_flush_chain.sh

[Install]
WantedBy=sys-subsystem-net-devices-tunsnx.device

The mix of BindsTo and RemainsAfterExit allows us to trigger ExecStart and ExecStop at the right time, when connection starts and when connection stops.

As you could see above, service also requires two scripts:

/root/bin/snx_add_rule.sh:

#!/bin/bash

GATEWAY=$(ip -o -4 addr show tunsnx | awk '{printf $4}')
nft add rule inet nat postrouting oifname "tunsnx" ip daddr 10.0.0.0/8 snat ip to $GATEWAY
echo "nftables rule added"

/root/bin/snx_flush_chain.sh:

#!/bin/bash

nft flush chain inet nat postrouting
echo "nftables flushed"

This is where all the magic is going on. Simple masquerading doesn’t help in this case. Reconnect you SNX and try to open corporate resource. Works? Cool!

Feel free to leave comments below the post.

UPDATE: I can also recommend removing default cshell autostart (from ~/.config/autostart/cshell.desktop) because it’s not reliable and setup user systemd service:

[Unit]
Description=Checkpoint SNX CShell
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
Environment=DISPLAY=:0
WorkingDirectory=/usr/bin/cshell
# Should work for JRE 16+
ExecStart=/usr/bin/java --add-exports java.base/sun.net.spi=ALL-UNNAMED -jar CShell.jar /tmp/cshell.fifo
ExecStop=/bin/kill -15 $MAINPID
SuccessExitStatus=143
Restart=on-failure

[Install]
WantedBy=default.target

UPDATE 2: Rui Ribeiro from comments suggested much nicer method using chroot, check it!