diff --git a/README.md b/README.md
index 3909ce4..7890da4 100644
--- a/README.md
+++ b/README.md
@@ -127,10 +127,10 @@ ip route replace local 0.0.0.0/0 dev lo table 100
 
 # Цепочка iptables (порядок правил — критичен)
 iptables -t mangle -N VPN_PROXY_TPROXY
-iptables -t mangle -N VPN_PROXY_TPROXY_SOURCE_BYPASS
+iptables -t mangle -N VPN_PROXY_SRC_BYPASS
   -m addrtype --dst-type LOCAL          → RETURN   # ответы самого sing-box
   -m mark --mark 1                      → RETURN   # уже помеченные пакеты
-  -j VPN_PROXY_TPROXY_SOURCE_BYPASS     → ACCEPT   # source bypass до sing-box
+  -j VPN_PROXY_SRC_BYPASS               → ACCEPT   # source bypass до sing-box
   -m set --match-set vpn_direct_bypass  → RETURN   # только если DIRECT_BYPASS_CACHE=true
   -d 10.0.0.0/8, 192.168.0.0/16, ...   → RETURN   # приватные адреса
   -p tcp                                → TPROXY :7895 mark 1
@@ -384,7 +384,7 @@ UI доступен на `http://<gateway-ip>:3456`.
 | `PROXY_PORT`        | `8080`               | HTTP/SOCKS mixed inbound               |
 | `TPROXY_PORT`       | `7895`               | TProxy inbound sing-box                |
 | `TPROXY_BYPASS_SOURCE_CIDRS` | unset      | Source CIDR устройств, которые должны идти напрямую мимо TProxy/sing-box, например `192.168.50.25/32` |
-| `TPROXY_SOURCE_BYPASS_CHAIN` | `${TPROXY_CHAIN}_SOURCE_BYPASS` | Управляемая iptables-цепочка для UI source-bypass |
+| `TPROXY_SOURCE_BYPASS_CHAIN` | `VPN_PROXY_SRC_BYPASS` | Управляемая iptables-цепочка для UI source-bypass |
 | `DATA_DIR`          | `/var/lib/vpn-proxy` | Директория данных (volume)             |
 | `ROUTING_RU_DIRECT` | `true`               | geoip-ru/geosite-ru → direct           |
 | `LOG_LEVEL`         | `info`               | Уровень логов sing-box                 |
diff --git a/entrypoint.sh b/entrypoint.sh
index 6e0ed33..1d5fbc9 100644
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -5,7 +5,7 @@ TPROXY_PORT="${TPROXY_PORT:-7895}"
 TPROXY_MARK="${TPROXY_MARK:-1}"
 TPROXY_TABLE="${TPROXY_TABLE:-100}"
 TPROXY_CHAIN="${TPROXY_CHAIN:-VPN_PROXY_TPROXY}"
-TPROXY_SOURCE_BYPASS_CHAIN="${TPROXY_SOURCE_BYPASS_CHAIN:-${TPROXY_CHAIN}_SOURCE_BYPASS}"
+TPROXY_SOURCE_BYPASS_CHAIN="${TPROXY_SOURCE_BYPASS_CHAIN:-VPN_PROXY_SRC_BYPASS}"
 PROXY_PORT="${PROXY_PORT:-8080}"
 PROXY_BIND_IP="${PROXY_BIND_IP:-0.0.0.0}"
 PROXY_INPUT_CHAIN="${PROXY_INPUT_CHAIN:-VPN_PROXY_INPUT}"
diff --git a/scripts/deploy-gateway.sh b/scripts/deploy-gateway.sh
index f1ff0b2..dfaee62 100644
--- a/scripts/deploy-gateway.sh
+++ b/scripts/deploy-gateway.sh
@@ -47,7 +47,7 @@ TPROXY_PORT=7895
 TPROXY_MARK=1
 TPROXY_TABLE=100
 TPROXY_CHAIN=VPN_PROXY_TPROXY
-TPROXY_SOURCE_BYPASS_CHAIN=VPN_PROXY_TPROXY_SOURCE_BYPASS
+TPROXY_SOURCE_BYPASS_CHAIN=VPN_PROXY_SRC_BYPASS
 TPROXY_BYPASS_SOURCE_CIDRS=
 ROUTING_RU_DIRECT=true
 LOG_LEVEL=info
diff --git a/src/server/config.js b/src/server/config.js
index 466b9de..f64fed8 100644
--- a/src/server/config.js
+++ b/src/server/config.js
@@ -11,8 +11,7 @@ export const settings = {
   tproxyPort: Number(process.env.TPROXY_PORT || 7895),
   tproxyChain: process.env.TPROXY_CHAIN || "VPN_PROXY_TPROXY",
   tproxySourceBypassChain:
-    process.env.TPROXY_SOURCE_BYPASS_CHAIN ||
-    `${process.env.TPROXY_CHAIN || "VPN_PROXY_TPROXY"}_SOURCE_BYPASS`,
+    process.env.TPROXY_SOURCE_BYPASS_CHAIN || "VPN_PROXY_SRC_BYPASS",
   bindIp: process.env.PROXY_BIND_IP || "0.0.0.0",
   dataDir,
   distDir: process.env.DIST_DIR || "/app/dist",
diff --git a/test/server/device-bypass-mode.test.js b/test/server/device-bypass-mode.test.js
index 422182a..fe77a1f 100644
--- a/test/server/device-bypass-mode.test.js
+++ b/test/server/device-bypass-mode.test.js
@@ -10,6 +10,12 @@ const {
   sourceBypassCidrs,
   buildSourceBypassIptablesCommands,
 } = await import("../../src/server/tproxySourceBypass.js");
+const { settings } = await import("../../src/server/config.js");
+
+test("default source bypass chain name fits iptables chain length limit", () => {
+  assert.equal(settings.tproxySourceBypassChain, "VPN_PROXY_SRC_BYPASS");
+  assert.ok(settings.tproxySourceBypassChain.length <= 28);
+});
 
 test("device profiles preserve bypass mode for kernel-level TProxy bypass", () => {
   const profiles = normalizeDeviceProfiles({
diff --git a/test/server/entrypoint-tproxy-bypass.test.js b/test/server/entrypoint-tproxy-bypass.test.js
index ce30af7..6a20c2c 100644
--- a/test/server/entrypoint-tproxy-bypass.test.js
+++ b/test/server/entrypoint-tproxy-bypass.test.js
@@ -63,17 +63,17 @@ exit 0
   const commands = fs.readFileSync(commandLog, "utf8").trim().split("\n");
   const sourceBypassIndex = commands.findIndex((line) =>
     line.includes(
-      "iptables -w -t mangle -A VPN_PROXY_TPROXY_SOURCE_BYPASS -s 192.168.50.25/32 -j ACCEPT",
+      "iptables -w -t mangle -A VPN_PROXY_SRC_BYPASS -s 192.168.50.25/32 -j ACCEPT",
     ),
   );
   const secondSourceBypassIndex = commands.findIndex((line) =>
     line.includes(
-      "iptables -w -t mangle -A VPN_PROXY_TPROXY_SOURCE_BYPASS -s 192.168.50.26/32 -j ACCEPT",
+      "iptables -w -t mangle -A VPN_PROXY_SRC_BYPASS -s 192.168.50.26/32 -j ACCEPT",
     ),
   );
   const sourceBypassJumpIndex = commands.findIndex((line) =>
     line.includes(
-      "iptables -w -t mangle -A VPN_PROXY_TPROXY -j VPN_PROXY_TPROXY_SOURCE_BYPASS",
+      "iptables -w -t mangle -A VPN_PROXY_TPROXY -j VPN_PROXY_SRC_BYPASS",
     ),
   );
   const directCacheIndex = commands.findIndex((line) =>