From 0b898d982549eab1ba12bf743d001aee6c2e27f9 Mon Sep 17 00:00:00 2001 From: Andrew Guschin Date: Fri, 30 Oct 2026 13:20:18 +0400 Subject: Validate real TUN forwarding and fix firewall routing - Move the default-drop guard to POSTROUTING so it sees final TUN egress - Treat a missing TUN interface as absent and add acceptance coverage - Document successful real-subscription validation on ALT Xray 26.10.29 --- src/linux/firewall.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/linux/firewall.rs') diff --git a/src/linux/firewall.rs b/src/linux/firewall.rs index 8a0dd43..bbde560 100644 --- a/src/linux/firewall.rs +++ b/src/linux/firewall.rs @@ -126,7 +126,10 @@ fn apply_policy(enabled: bool, xray_uid: u32, allow_tun: bool) -> Result<()> { batch.add(&mark, MsgType::Add); let mut guard = Chain::new(c"guard", &table); guard.set_type(ChainType::Filter); - guard.set_hook(Hook::Out, 100); + // OUTPUT's hook state still names the original interface after the + // route chain changes skb's route. POSTROUTING sees the final egress, + // so the guard can allow TUN traffic without allowing direct fallback. + guard.set_hook(Hook::PostRouting, 100); guard.set_policy(Policy::Drop); batch.add(&guard, MsgType::Add); exceptions(&mut batch, &guard, xray_uid); -- cgit v1.2.3