add: icmp as a bypass network entry protocol #226

Merged

mysticalsoap merged 1 commit from add/icmp-network-entries into trunk

2026-10-08 17:57:07 -04:00

mysticalsoap commented

2026-10-08 17:35:40 -04:00

Owner

Problem

Network bypass entries (#116) take tcp/udp plus a port, or nothing. A monitoring container that should ping a public target over the physical link (docker#413) cannot be expressed: a bare subnet entry sends everything from that subnet past the tunnel, container-to-container traffic included, because the network table only holds the physical link's default.

Fix

icmp as a third protocol, no port: the validator refuses a port with it, the entry dialog disables the port field for it, and the v6 rule uses icmpv6. README sentence added.

Verification

pytest: 548 passed. New cases: icmp parses, icmp with a port is rejected, -p icmp on ip4 and -p icmpv6 on ip6, no --dport.
ruff check --select E9,F63,F7,F82 . and the SyntaxWarning compileall gate pass.
Live check follows on the docker side: with a 172.18.7.0/24 icmp entry and aqomui connected, blackbox's ICMP RTT to 1.1.1.1 should sit at the raw link's ~13 ms rather than the tunnel's ~50 ms.

🤖 Generated with Claude Code

## Problem Network bypass entries (#116) take `tcp`/`udp` plus a port, or nothing. A monitoring container that should ping a public target over the physical link (docker#413) cannot be expressed: a bare subnet entry sends everything from that subnet past the tunnel, container-to-container traffic included, because the network table only holds the physical link's default. ## Fix `icmp` as a third protocol, no port: the validator refuses a port with it, the entry dialog disables the port field for it, and the v6 rule uses `icmpv6`. README sentence added. ## Verification - `pytest`: 548 passed. New cases: icmp parses, icmp with a port is rejected, `-p icmp` on ip4 and `-p icmpv6` on ip6, no `--dport`. - `ruff check --select E9,F63,F7,F82 .` and the SyntaxWarning compileall gate pass. - Live check follows on the docker side: with a `172.18.7.0/24 icmp` entry and aqomui connected, blackbox's ICMP RTT to 1.1.1.1 should sit at the raw link's ~13 ms rather than the tunnel's ~50 ms. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mysticalsoap added 1 commit

2026-10-08 17:35:40 -04:00

add: icmp as a bypass network entry protocol

ci / test (pull_request) Successful in 33s

Details

ci / test (push) Successful in 35s

Details

7260b5f86a

A probe container that has to measure the physical link rather than
the tunnel needs only its pings exempted; a bare subnet entry would
also route its traffic to other containers out the physical link,
since the network table holds nothing but that default. icmp has no
port, so the validator refuses one and the dialog keeps the field
disabled, and ip6tables spells the protocol icmpv6.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

mysticalsoap commented

2026-10-08 17:55:26 -04:00

Author

Owner

Verified live, built from this branch (aqomui-git 0.9.2.r427.g7260b5f), service restarted, entry 172.18.7.0/24 icmp added in the bypass tab, tunnel connected. iptables-legacy -t mangle -L aqomui_bypass_net -v -n:

 pkts bytes target     prot opt in     out     source               destination
 538K  513M MARK       udp  --  *      *       172.18.7.0/24        0.0.0.0/0            udp dpt:51820 MARK set 0xc
   99  5544 MARK       icmp --  *      *       172.18.7.0/24        0.0.0.0/0            MARK set 0xc

The icmp counter climbed 9 → 95 → 99 across three reads at the probe's rate (two targets every 15 s), the udp rule kept counting gluetun. Consumer: mysticalsoap/docker PR for #413.

Verified live, built from this branch (`aqomui-git 0.9.2.r427.g7260b5f`), service restarted, entry `172.18.7.0/24 icmp` added in the bypass tab, tunnel connected. `iptables-legacy -t mangle -L aqomui_bypass_net -v -n`: ``` pkts bytes target prot opt in out source destination 538K 513M MARK udp -- * * 172.18.7.0/24 0.0.0.0/0 udp dpt:51820 MARK set 0xc 99 5544 MARK icmp -- * * 172.18.7.0/24 0.0.0.0/0 MARK set 0xc ``` The icmp counter climbed 9 → 95 → 99 across three reads at the probe's rate (two targets every 15 s), the udp rule kept counting gluetun. Consumer: mysticalsoap/docker PR for #413.

mysticalsoap merged commit 7260b5f86a into trunk

2026-10-08 17:57:07 -04:00

mysticalsoap deleted branch add/icmp-network-entries

2026-10-08 17:57:07 -04:00