Validate real TUN forwarding and fix firewall routingmain

- Move the default-drop guard to POSTROUTING so it sees final TUN egress
- Treat a missing TUN interface as absent and add acceptance coverage
- Document successful real-subscription validation on ALT Xray 26.10.29

1 files changed, 40 insertions, 0 deletions

diff --git a/docs/validation/real-subscription-vm.md b/docs/validation/real-subscription-vm.md
new file mode 100644
index 0000000..7bd06ed
--- /dev/null
+++ b/docs/validation/real-subscription-vm.md
@@ -0,0 +1,40 @@
+# Real subscription TUN validation
+
+Validated on `altctlrs` on 2026-10-30 after the system upgrade, with ALT's
+Xray 26.10.29 package. The recovery checkpoint is
+`roentgen-upgraded-xray-20261030`. Subscription credentials are omitted.
+
+The subscription imports one supported Trojan TCP/TLS configuration and one
+unsupported VLESS entry. A temporary SOCKS listener first verified the Trojan
+connection independently of host routing.
+
+Before the firewall fix, the selected configuration enabled TUN, but the real
+request timed out. A targeted nftables trace showed the capture mark set in
+OUTPUT and the guard dropping the packet because its hook state still named
+`ens19`. Moving the guard to POSTROUTING made the request succeed. The final
+source applies that change while retaining the guard's default drop policy.
+See the kernel's [route hook](https://github.com/torvalds/linux/blob/master/net/netfilter/nft_chain_route.c)
+and [hook state](https://github.com/torvalds/linux/blob/master/include/linux/netfilter.h).
+
+The live acceptance check failed before the fix and passed after rebuilding and
+installing the source:
+
+```sh
+sudo python3 tests/vm_tun_acceptance.py --expected-ip 93.95.225.219
+```
+
+- Direct IPv4: `185.39.118.143`.
+- TUN IPv4: `93.95.225.219`, through both HTTP and HTTPS requests.
+- Disabling restored `185.39.118.143`.
+- An ordinary `rustacean` user's request also returned `93.95.225.219`.
+- Masking and stopping the owned Xray service caused a pinned-IP public request
+  to time out instead of falling back directly. Unmasking and enabling restored
+  `93.95.225.219`.
+- The six existing `vm_guard_acceptance.py` checks passed, including private
+  IPv4/IPv6 exceptions, public blocking, UDP DNS policy, incoming TCP continuity,
+  rejection of preexisting outgoing flows, and explicit disable.
+- The missing-interface regression in `routes_acceptance.rs` passed on this VM
+  during the preceding run.
+
+The VM was left with the subscription selected and proxying enabled. This is
+live validation of this configuration, not the full release acceptance matrix.