Fix protected activation ordering and diagnostic review findings

1 files changed, 3 insertions, 0 deletions

diff --git a/src/linux/routes.rs b/src/linux/routes.rs
index 07083bb..4212183 100644
--- a/src/linux/routes.rs
+++ b/src/linux/routes.rs
@@ -84,6 +84,9 @@ fn owned_rule(rule: &rtnetlink::packet_route::rule::RuleMessage) -> bool {
 }
 
 pub async fn capture(interface: u32) -> Result<()> {
+    // Only the product-owned TUN changes this setting. Loose reverse-path
+    // validation accepts proxied replies whose ordinary reverse route is uplink.
+    std::fs::write("/proc/sys/net/ipv4/conf/roentgen0/rp_filter", "2")?;
     let handle = connection()?;
     for route in [
         RouteMessageBuilder::<Ipv4Addr>::new()