Validate real TUN forwarding and fix firewall routingmain

- Move the default-drop guard to POSTROUTING so it sees final TUN egress
- Treat a missing TUN interface as absent and add acceptance coverage
- Document successful real-subscription validation on ALT Xray 26.10.29

1 files changed, 10 insertions, 3 deletions

diff --git a/src/linux/routes.rs b/src/linux/routes.rs
index 4212183..0380faf 100644
--- a/src/linux/routes.rs
+++ b/src/linux/routes.rs
@@ -178,12 +178,19 @@ pub async fn remove() -> Result<()> {
 
 pub async fn tun_index() -> Result<Option<u32>> {
     let handle = connection()?;
-    Ok(handle
+    let result = handle
         .link()
         .get()
         .match_name("roentgen0")
         .execute()
         .try_next()
-        .await?
-        .map(|link| link.header.index))
+        .await;
+    match result {
+        Ok(link) => Ok(link.map(|link| link.header.index)),
+        // A named RTM_GETLINK request reports ENODEV for an absent interface,
+        // including before Xray starts and while waiting for it to create TUN.
+        Err(rtnetlink::Error::NetlinkError(error))
+            if error.raw_code() == -libc::ENODEV => Ok(None),
+        Err(error) => Err(error.into()),
+    }
 }