From 457dd912d1388551026f380f21e661d7d011a272 Mon Sep 17 00:00:00 2001
From: Dmitriy Petrov <floplopru@gmail.com>
Date: Sat, 11 Jul 2026 19:48:04 +0300
Subject: [PATCH] Bypass bridge traffic in TProxy and simplify subscription
 refresh

---
 entrypoint.sh                         | 1 +
 src/web/App.jsx                       | 7 +------
 test/server/entrypoint-tproxy.test.js | 1 +
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index 59c6364..31eb0bb 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -101,6 +101,7 @@ setup_tproxy() {
   ipt -t mangle -N "$TPROXY_CHAIN"
   ipt -t mangle -A "$TPROXY_CHAIN" -m addrtype --dst-type LOCAL -j RETURN
   ipt -t mangle -A "$TPROXY_CHAIN" -m mark --mark "$TPROXY_MARK" -j RETURN
+  ipt -t mangle -A "$TPROXY_CHAIN" -i 'br-+' -j RETURN
 
   # Private/local destinations stay reachable; every intercepted public packet goes to VPN.
   for cidr in $BYPASS_CIDRS; do
diff --git a/src/web/App.jsx b/src/web/App.jsx
index b2afdb7..b5bbe2a 100644
--- a/src/web/App.jsx
+++ b/src/web/App.jsx
@@ -95,12 +95,7 @@ function App() {
   }
 
   async function refreshSubscription() {
-    try {
-      return await applyMutation(api.subscription.refresh);
-    } catch (refreshError) {
-      setError(refreshError.message);
-      throw refreshError;
-    }
+    return applyMutation(api.subscription.refresh);
   }
 
   async function forgetSubscription() {
diff --git a/test/server/entrypoint-tproxy.test.js b/test/server/entrypoint-tproxy.test.js
index 66cb108..0d4f16a 100644
--- a/test/server/entrypoint-tproxy.test.js
+++ b/test/server/entrypoint-tproxy.test.js
@@ -13,6 +13,7 @@ test('gateway keeps direct forwarding active while TProxy interception is switch
   assert.match(entrypoint, /-p udp -j TPROXY --on-port "\$TPROXY_PORT"/);
   assert.match(entrypoint, /-I FORWARD 1 -j "\$GATEWAY_FORWARD_CHAIN"/);
   assert.match(entrypoint, /-I POSTROUTING 1 -j "\$GATEWAY_NAT_CHAIN"/);
+  assert.match(entrypoint, /-A "\$TPROXY_CHAIN" -i 'br-\+' -j RETURN/);
   assert.doesNotMatch(entrypoint, /-A PREROUTING -j "\$TPROXY_CHAIN"/);
   assert.doesNotMatch(entrypoint, /TPROXY_BYPASS_SOURCE_CIDRS|DIRECT_BYPASS_CACHE|ipset/);
 });