Add kernel forwarding for bypassed devices

src/server/config.js

@@ -12,6 +12,10 @@ export const settings = {
   tproxyChain: process.env.TPROXY_CHAIN || "VPN_PROXY_TPROXY",
   tproxySourceBypassChain:
     process.env.TPROXY_SOURCE_BYPASS_CHAIN || "VPN_PROXY_SRC_BYPASS",
+  tproxySourceForwardChain:
+    process.env.TPROXY_SOURCE_FORWARD_CHAIN || "VPN_PROXY_FWD_BYPASS",
+  tproxySourceNatChain:
+    process.env.TPROXY_SOURCE_NAT_CHAIN || "VPN_PROXY_NAT_BYPASS",
   bindIp: process.env.PROXY_BIND_IP || "0.0.0.0",
   dataDir,
   distDir: process.env.DIST_DIR || "/app/dist",

src/server/tproxySourceBypass.js

@@ -2,6 +2,9 @@ import { spawnSync } from "node:child_process";
 import { settings } from "./config.js";
 import { deviceCidrs, normalizeCidr } from "./devices.js";
 
+const DEFAULT_NAT_BYPASS_CIDRS =
+  "0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4";
+
 function splitCidrs(value) {
   return String(value || "")
     .split(/[\s,]+/)
@@ -25,10 +28,19 @@ export function sourceBypassCidrs(
 
 export function buildSourceBypassIptablesCommands(
   cidrs,
-  { chain = settings.tproxySourceBypassChain } = {},
+  {
+    chain = settings.tproxySourceBypassChain,
+    forwardChain = settings.tproxySourceForwardChain,
+    natChain = settings.tproxySourceNatChain,
+    natBypassCidrs = splitCidrs(
+      process.env.BYPASS_CIDRS || DEFAULT_NAT_BYPASS_CIDRS,
+    ),
+  } = {},
 ) {
   return [
     ["-w", "-t", "mangle", "-F", chain],
+    ["-w", "-F", forwardChain],
+    ["-w", "-t", "nat", "-F", natChain],
     ...cidrs.map((cidr) => [
       "-w",
       "-t",
@@ -40,6 +52,44 @@ export function buildSourceBypassIptablesCommands(
       "-j",
       "ACCEPT",
     ]),
+    ...cidrs.flatMap((cidr) => [
+      ["-w", "-A", forwardChain, "-s", cidr, "-j", "ACCEPT"],
+      [
+        "-w",
+        "-A",
+        forwardChain,
+        "-d",
+        cidr,
+        "-m",
+        "conntrack",
+        "--ctstate",
+        "RELATED,ESTABLISHED",
+        "-j",
+        "ACCEPT",
+      ],
+    ]),
+    ...natBypassCidrs.map((cidr) => [
+      "-w",
+      "-t",
+      "nat",
+      "-A",
+      natChain,
+      "-d",
+      cidr,
+      "-j",
+      "RETURN",
+    ]),
+    ...cidrs.map((cidr) => [
+      "-w",
+      "-t",
+      "nat",
+      "-A",
+      natChain,
+      "-s",
+      cidr,
+      "-j",
+      "MASQUERADE",
+    ]),
   ];
 }
 
@@ -48,12 +98,11 @@ export function syncTproxySourceBypass(profiles, options = {}) {
     return { success: true, skipped: true, cidrs: [] };
   }
 
-  const chain = options.chain || settings.tproxySourceBypassChain;
   const cidrs = sourceBypassCidrs(
     profiles,
     options.envCidrs ?? process.env.TPROXY_BYPASS_SOURCE_CIDRS,
   );
-  const commands = buildSourceBypassIptablesCommands(cidrs, { chain });
+  const commands = buildSourceBypassIptablesCommands(cidrs, options);
 
   for (const args of commands) {
     const result = spawnSync("iptables", args, {