diff --git a/pkgs/tools/networking/ivpn/default.nix b/pkgs/tools/networking/ivpn/default.nix
index 7a475478a16..e8e33f3bc73 100644
--- a/pkgs/tools/networking/ivpn/default.nix
+++ b/pkgs/tools/networking/ivpn/default.nix
@@ -2,17 +2,26 @@
 , fetchFromGitHub
 , lib
 , wirelesstools
+, makeWrapper
+, wireguard-tools
+, openvpn
+, obfs4
+, iproute2
+, dnscrypt-proxy2
+, iptables
+, gawk
+, util-linux
 }:
 
 builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
   inherit pname;
-  version = "3.10.0";
+  version = "3.10.15";
 
   src = fetchFromGitHub {
     owner = "ivpn";
     repo = "desktop-app";
     rev = "v${version}";
-    hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y=";
+    hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
   };
 
   ldflags = [
@@ -31,16 +40,52 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
     homepage = "https://www.ivpn.net/apps";
     changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ urandom ataraxiasjel ];
   };
 })) {
   ivpn = {
     modRoot = "cli";
-    vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY=";
+    vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
   };
   ivpn-service = {
     modRoot = "daemon";
     vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
+    nativeBuildInputs = [ makeWrapper ];
     buildInputs = [ wirelesstools ];
+
+    patches = [ ./permissions.patch ];
+    postPatch = ''
+      substituteInPlace daemon/service/platform/platform_linux.go \
+        --replace 'openVpnBinaryPath = "/usr/sbin/openvpn"' \
+        'openVpnBinaryPath = "${openvpn}/bin/openvpn"' \
+        --replace 'routeCommand = "/sbin/ip route"' \
+        'routeCommand = "${iproute2}/bin/ip route"'
+
+      substituteInPlace daemon/netinfo/netinfo_linux.go \
+        --replace 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")' \
+        'retErr := shell.ExecAndProcessOutput(log, outParse, "", "${iproute2}/bin/ip", "route")'
+
+      substituteInPlace daemon/service/platform/platform_linux_release.go \
+        --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" \
+        --replace 'obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")' \
+        'obfsproxyStartScript = "${obfs4}/bin/obfs4proxy"' \
+        --replace 'wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")' \
+        'wgBinaryPath = "${wireguard-tools}/bin/wg-quick"' \
+        --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \
+        'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \
+        --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
+        'dnscryptproxyBinPath = "${dnscrypt-proxy2}/bin/dnscrypt-proxy"'
+    '';
+
+    postFixup = ''
+      mkdir -p $out/etc
+      cp -r $src/daemon/References/Linux/etc/* $out/etc/
+      cp -r $src/daemon/References/common/etc/* $out/etc/
+
+      patchShebangs --build $out/etc/firewall.sh $out/etc/splittun.sh $out/etc/client.down $out/etc/client.up
+
+      wrapProgram "$out/bin/ivpn-service" \
+        --suffix PATH : ${lib.makeBinPath [ iptables gawk util-linux ]}
+    '';
   };
 }
diff --git a/pkgs/tools/networking/ivpn/permissions.patch b/pkgs/tools/networking/ivpn/permissions.patch
new file mode 100644
index 00000000000..72fdc4a591e
--- /dev/null
+++ b/pkgs/tools/networking/ivpn/permissions.patch
@@ -0,0 +1,27 @@
+diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
+index 941a99a7..df821c4d 100644
+--- a/daemon/service/platform/platform.go
++++ b/daemon/service/platform/platform.go
+@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	}
+
+ 	// checking file permissions
+-	if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+-	if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+
+ 	if len(openvpnUpScript) > 0 {
+ 		if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
+@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
+ 		errors = append(errors, err)
+ 	}
+-	if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
+-		errors = append(errors, err)
+-	}
+
+ 	if len(routeCommand) > 0 {
+ 		routeBinary := strings.Split(routeCommand, " ")[0]