Add kernel forwarding for bypassed devices

test/server/entrypoint-tproxy-bypass.test.js

@@ -35,6 +35,13 @@ exit 0
     `#!/usr/bin/env bash
 printf 'ipset %s\\n' "$*" >> "$COMMAND_LOG"
 exit 0
+`,
+  );
+  writeExecutable(
+    path.join(tmp, "sysctl"),
+    `#!/usr/bin/env bash
+printf 'sysctl %s\\n' "$*" >> "$COMMAND_LOG"
+exit 0
 `,
   );
   writeExecutable(
@@ -82,12 +89,34 @@ exit 0
   const tproxyIndex = commands.findIndex((line) =>
     line.includes("-p tcp -j TPROXY --on-port 7895"),
   );
+  const ipForwardIndex = commands.findIndex((line) =>
+    line.includes("sysctl -w net.ipv4.ip_forward=1"),
+  );
+  const forwardAcceptIndex = commands.findIndex((line) =>
+    line.includes(
+      "iptables -w -A VPN_PROXY_FWD_BYPASS -s 192.168.50.25/32 -j ACCEPT",
+    ),
+  );
+  const forwardReturnIndex = commands.findIndex((line) =>
+    line.includes(
+      "iptables -w -A VPN_PROXY_FWD_BYPASS -d 192.168.50.25/32 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT",
+    ),
+  );
+  const natMasqueradeIndex = commands.findIndex((line) =>
+    line.includes(
+      "iptables -w -t nat -A VPN_PROXY_NAT_BYPASS -s 192.168.50.25/32 -j MASQUERADE",
+    ),
+  );
 
   assert.notEqual(sourceBypassIndex, -1);
   assert.notEqual(secondSourceBypassIndex, -1);
   assert.notEqual(sourceBypassJumpIndex, -1);
   assert.notEqual(directCacheIndex, -1);
   assert.notEqual(tproxyIndex, -1);
+  assert.notEqual(ipForwardIndex, -1);
+  assert.notEqual(forwardAcceptIndex, -1);
+  assert.notEqual(forwardReturnIndex, -1);
+  assert.notEqual(natMasqueradeIndex, -1);
   assert.ok(sourceBypassJumpIndex < directCacheIndex);
   assert.ok(sourceBypassJumpIndex < tproxyIndex);
 });