Validate real TUN forwarding and fix firewall routingmain

- Move the default-drop guard to POSTROUTING so it sees final TUN egress
- Treat a missing TUN interface as absent and add acceptance coverage
- Document successful real-subscription validation on ALT Xray 26.10.29

1 files changed, 23 insertions, 0 deletions

diff --git a/tests/routes_acceptance.rs b/tests/routes_acceptance.rs
new file mode 100644
index 0000000..608e309
--- /dev/null
+++ b/tests/routes_acceptance.rs
@@ -0,0 +1,23 @@
+#![cfg(feature = "linux-runtime")]
+
+use futures_util::TryStreamExt;
+use rtnetlink::packet_route::link::LinkAttribute;
+
+// Run on the disposable ALT VM, including with no active roentgen0. A dump
+// omits missing interfaces, whereas the production named lookup returns ENODEV.
+#[tokio::test]
+async fn tun_lookup_agrees_with_kernel_link_dump() -> anyhow::Result<()> {
+    let (connection, handle, _) = rtnetlink::new_connection()?;
+    tokio::spawn(connection);
+    let mut links = handle.link().get().execute();
+    let mut expected = None;
+    while let Some(link) = links.try_next().await? {
+        if link.attributes.iter().any(|attribute| {
+            matches!(attribute, LinkAttribute::IfName(name) if name == "roentgen0")
+        }) {
+            expected = Some(link.header.index);
+        }
+    }
+    assert_eq!(roentgen::linux::routes::tun_index().await?, expected);
+    Ok(())
+}