# Real subscription TUN validation

Validated on `altctlrs` on 2026-10-30 after the system upgrade, with ALT's
Xray 26.10.29 package. The recovery checkpoint is
`roentgen-upgraded-xray-20261030`. Subscription credentials are omitted.

The subscription imports one supported Trojan TCP/TLS configuration and one
unsupported VLESS entry. A temporary SOCKS listener first verified the Trojan
connection independently of host routing.

Before the firewall fix, the selected configuration enabled TUN, but the real
request timed out. A targeted nftables trace showed the capture mark set in
OUTPUT and the guard dropping the packet because its hook state still named
`ens19`. Moving the guard to POSTROUTING made the request succeed. The final
source applies that change while retaining the guard's default drop policy.
See the kernel's [route hook](https://github.com/torvalds/linux/blob/master/net/netfilter/nft_chain_route.c)
and [hook state](https://github.com/torvalds/linux/blob/master/include/linux/netfilter.h).

The live acceptance check failed before the fix and passed after rebuilding and
installing the source:

```sh
sudo python3 tests/vm_tun_acceptance.py --expected-ip 93.95.225.219
```

- Direct IPv4: `185.39.118.143`.
- TUN IPv4: `93.95.225.219`, through both HTTP and HTTPS requests.
- Disabling restored `185.39.118.143`.
- An ordinary `rustacean` user's request also returned `93.95.225.219`.
- Masking and stopping the owned Xray service caused a pinned-IP public request
  to time out instead of falling back directly. Unmasking and enabling restored
  `93.95.225.219`.
- The six existing `vm_guard_acceptance.py` checks passed, including private
  IPv4/IPv6 exceptions, public blocking, UDP DNS policy, incoming TCP continuity,
  rejection of preexisting outgoing flows, and explicit disable.
- The missing-interface regression in `routes_acceptance.rs` passed on this VM
  during the preceding run.

The VM was left with the subscription selected and proxying enabled. This is
live validation of this configuration, not the full release acceptance matrix.