fix: resolve ghost iptables rules, set -e crashes, and automate MASQUERADE NAT

2026-05-01 13:47:50 +07:00
parent 1268c8a4a2
commit 0b19a9061f
7 changed files with 432 additions and 95 deletions
@@ -137,7 +137,7 @@ ensure_ipset() {
    local name="$1" family="$2"
    has_ipset || return 0
    if ! ipset list "$name" &>/dev/null; then
-        ipset create "$name" hash:net family "$family" hashsize 1024 maxelem 65536 timeout 0
+        ipset create "$name" hash:net,net family "$family" hashsize 1024 maxelem 65536 timeout 0
        log_info "Created ipset: $name (family=$family)"
    fi
 }
@@ -278,6 +278,16 @@ detect_wg_subnet() {
    fi
 }

+detect_default_if() {
+    local def_if
+    def_if=$(ip -4 route ls 2>/dev/null | grep default | grep -Po '(?<=dev )(\S+)' | head -1 || true)
+    if [[ -z "$def_if" ]]; then
+        echo "eth0"
+    else
+        echo "$def_if"
+    fi
+}
+
 # ============================================================
 # HEALTH CHECK
 # ============================================================