From fc3c1d51b1be9db6ba6ad286584fbc34bb305f38 Mon Sep 17 00:00:00 2001
From: Andrew Guschin <guschin@altlinux.org>
Date: Fri, 30 Oct 2026 03:32:00 +0400
Subject: Fix protected activation ordering and diagnostic review findings

---
 src/linux/routes.rs | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/linux/routes.rs')

diff --git a/src/linux/routes.rs b/src/linux/routes.rs
index 07083bb..4212183 100644
--- a/src/linux/routes.rs
+++ b/src/linux/routes.rs
@@ -84,6 +84,9 @@ fn owned_rule(rule: &rtnetlink::packet_route::rule::RuleMessage) -> bool {
 }
 
 pub async fn capture(interface: u32) -> Result<()> {
+    // Only the product-owned TUN changes this setting. Loose reverse-path
+    // validation accepts proxied replies whose ordinary reverse route is uplink.
+    std::fs::write("/proc/sys/net/ipv4/conf/roentgen0/rp_filter", "2")?;
     let handle = connection()?;
     for route in [
         RouteMessageBuilder::<Ipv4Addr>::new()
-- 
cgit v1.2.3