Bypass network entries get routed into a bypass VPN tunnel

mysticalsoap commented

2026-09-16 22:41:53 -04:00

Owner

Network entries (bypass.set_network_rules) mark forwarded traffic with the same fwmark the app cgroup uses, so it resolves through the same table 11. That table's default is the physical link only until a bypass VPN tunnel comes up - then the tunnel replaces it (bypass_up.sh for OpenVPN, the table-11 route for WireGuard, #216), and every listed network's traffic is redirected into the bypass tunnel: forwarded, so not masqueraded, so rejected by the server, retransmitted at line rate.

That inverts the feature: network entries exist to route forwarded traffic past the tunnel (#168's case - a container running its own VPN must not be double-tunnelled). Hit live 2026-09-16 with gluetun's subnet listed and a WireGuard bypass up: 43 GiB pushed into wg_aqomui_b in ten minutes, and the per-peer queue starvation hung every bypassed app's connection too. An OpenVPN bypass tunnel misroutes the same way, just without the starvation making it obvious.

Fix: give network entries their own mark and routing table, defaulting to the physical link and never touched by a bypass tunnel. Apps keep table 11 (tunnel if present); networks get table 12 (always physical).

Network entries (bypass.set_network_rules) mark forwarded traffic with the same fwmark the app cgroup uses, so it resolves through the same table 11. That table's default is the physical link only until a bypass VPN tunnel comes up - then the tunnel replaces it (bypass_up.sh for OpenVPN, the table-11 route for WireGuard, #216), and every listed network's traffic is redirected into the bypass tunnel: forwarded, so not masqueraded, so rejected by the server, retransmitted at line rate. That inverts the feature: network entries exist to route forwarded traffic *past* the tunnel (#168's case - a container running its own VPN must not be double-tunnelled). Hit live 2026-09-16 with gluetun's subnet listed and a WireGuard bypass up: 43 GiB pushed into wg_aqomui_b in ten minutes, and the per-peer queue starvation hung every bypassed app's connection too. An OpenVPN bypass tunnel misroutes the same way, just without the starvation making it obvious. Fix: give network entries their own mark and routing table, defaulting to the physical link and never touched by a bypass tunnel. Apps keep table 11 (tunnel if present); networks get table 12 (always physical).

mysticalsoap added the

bug

label

2026-09-16 22:41:53 -04:00

mysticalsoap referenced this issue from a pull request that will close it,

2026-09-16 22:43:31 -04:00

fix: keep bypass network entries on the physical link #222

mysticalsoap referenced this issue from a commit

2026-09-16 22:43:32 -04:00

fix: keep bypass network entries on the physical link

mysticalsoap closed this issue

2026-09-17 00:25:53 -04:00