Add direct gateway forwarding when VPN is off

test/server/entrypoint-tproxy.test.js

@@ -8,8 +8,11 @@ const entrypoint = fs.readFileSync(
   'utf8',
 );
 
-test('gateway intercepts all public TCP and UDP traffic without source bypasses', () => {
+test('gateway keeps direct forwarding active while TProxy interception is switchable', () => {
   assert.match(entrypoint, /-p tcp -j TPROXY --on-port "\$TPROXY_PORT"/);
   assert.match(entrypoint, /-p udp -j TPROXY --on-port "\$TPROXY_PORT"/);
+  assert.match(entrypoint, /-I FORWARD 1 -j "\$GATEWAY_FORWARD_CHAIN"/);
+  assert.match(entrypoint, /-I POSTROUTING 1 -j "\$GATEWAY_NAT_CHAIN"/);
+  assert.doesNotMatch(entrypoint, /-A PREROUTING -j "\$TPROXY_CHAIN"/);
   assert.doesNotMatch(entrypoint, /TPROXY_BYPASS_SOURCE_CIDRS|DIRECT_BYPASS_CACHE|ipset/);
 });

test/server/gateway-routing.test.js

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { setGatewayInterception } from '../../src/server/gatewayRouting.js';
+
+test('gateway switches only the TProxy PREROUTING jump', () => {
+  const calls = [];
+  const missing = (command, args) => {
+    calls.push([command, args]);
+    return { status: args.includes('-C') ? 1 : 0, stderr: '' };
+  };
+
+  setGatewayInterception(true, 'VPN_PROXY_TPROXY', missing);
+  assert.deepEqual(calls.map(([, args]) => args), [
+    ['-w', '-t', 'mangle', '-C', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
+    ['-w', '-t', 'mangle', '-I', 'PREROUTING', '1', '-j', 'VPN_PROXY_TPROXY'],
+  ]);
+
+  calls.length = 0;
+  const existing = (command, args) => {
+    calls.push([command, args]);
+    return { status: 0, stderr: '' };
+  };
+  setGatewayInterception(false, 'VPN_PROXY_TPROXY', existing);
+  assert.deepEqual(calls.map(([, args]) => args), [
+    ['-w', '-t', 'mangle', '-C', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
+    ['-w', '-t', 'mangle', '-D', 'PREROUTING', '-j', 'VPN_PROXY_TPROXY'],
+  ]);
+});