Commit 66732f0d2056

@@ -65,6 +65,27 @@ in
       mode = "0644";
     };
 
+    # NetworkManager dispatcher: preserve WireGuard route when Red Hat VPN connects
+    # The VPN pushes 10.0.0.0/8 via tun0 in a higher-priority routing table,
+    # which captures our 10.100.0.0/24 WireGuard traffic. This adds a more
+    # specific route to keep WireGuard reachable.
+    environment.etc."NetworkManager/dispatcher.d/99-wireguard-route" = {
+      text = ''
+        #!/bin/bash
+        INTERFACE="$1"
+        ACTION="$2"
+        if [[ "$INTERFACE" == "tun0" && "$ACTION" == "vpn-up" ]]; then
+          # Find the VPN routing table (usually 75)
+          TABLE=$(ip rule show | grep -oP 'lookup \K[0-9]+' | head -1)
+          if [[ -n "$TABLE" && "$TABLE" != "local" ]]; then
+            ip route add 10.100.0.0/24 dev wg0 table "$TABLE" 2>/dev/null || true
+          fi
+        fi
+      '';
+      mode = "0755";
+      replaceExisting = true;
+    };
+
     # /etc/hosts entries for VPN and home network hosts
     environment.etc.hosts = {
       text = ''