Validate real TUN forwarding and fix firewall routingmain

- Move the default-drop guard to POSTROUTING so it sees final TUN egress
- Treat a missing TUN interface as absent and add acceptance coverage
- Document successful real-subscription validation on ALT Xray 26.10.29

1 files changed, 4 insertions, 1 deletions

diff --git a/src/linux/firewall.rs b/src/linux/firewall.rs
index 8a0dd43..bbde560 100644
--- a/src/linux/firewall.rs
+++ b/src/linux/firewall.rs
@@ -126,7 +126,10 @@ fn apply_policy(enabled: bool, xray_uid: u32, allow_tun: bool) -> Result<()> {
         batch.add(&mark, MsgType::Add);
         let mut guard = Chain::new(c"guard", &table);
         guard.set_type(ChainType::Filter);
-        guard.set_hook(Hook::Out, 100);
+        // OUTPUT's hook state still names the original interface after the
+        // route chain changes skb's route. POSTROUTING sees the final egress,
+        // so the guard can allow TUN traffic without allowing direct fallback.
+        guard.set_hook(Hook::PostRouting, 100);
         guard.set_policy(Policy::Drop);
         batch.add(&guard, MsgType::Add);
         exceptions(&mut batch, &guard, xray_uid);