1 files changed, 13 insertions, 5 deletions
diff --git a/src/linux/firewall.rs b/src/linux/firewall.rs
index 79731b7..8a0dd43 100644
--- a/src/linux/firewall.rs
+++ b/src/linux/firewall.rs
@@ -84,6 +84,12 @@ pub fn preflight() -> Result<()> {
 
 /// Replacing the table is one kernel transaction. Connection marks survive table replacement.
 pub fn apply(enabled: bool, xray_uid: u32) -> Result<()> {
+    apply_policy(enabled, xray_uid, false)
+}
+pub fn forward(xray_uid: u32) -> Result<()> {
+    apply_policy(true, xray_uid, true)
+}
+fn apply_policy(enabled: bool, xray_uid: u32, allow_tun: bool) -> Result<()> {
     let existing = tables()?;
     let table = Table::new(TABLE, ProtoFamily::Inet);
     let mut batch = Batch::new();
@@ -124,11 +130,13 @@ pub fn apply(enabled: bool, xray_uid: u32) -> Result<()> {
         guard.set_policy(Policy::Drop);
         batch.add(&guard, MsgType::Add);
         exceptions(&mut batch, &guard, xray_uid);
-        let mut tun = Rule::new(&guard);
-        tun.add_expr(&nft_expr!(meta oifname));
-        tun.add_expr(&nft_expr!(cmp == &b"roentgen0\0"[..]));
-        tun.add_expr(&nft_expr!(verdict accept));
-        batch.add(&tun, MsgType::Add);
+        if allow_tun {
+            let mut tun = Rule::new(&guard);
+            tun.add_expr(&nft_expr!(meta oifname));
+            tun.add_expr(&nft_expr!(cmp == &b"roentgen0\0"[..]));
+            tun.add_expr(&nft_expr!(verdict accept));
+            batch.add(&tun, MsgType::Add);
+        }
     }
     send(batch.finalize()).context("Could not apply Roentgen firewall transaction")
 }