fix(wireguard): keep forward accept rules out of mangle chains by T3ST3ST3R0N · Pull Request #101 · PasarGuard/node

T3ST3ST3R0N · 2026-10-11T16:35:59Z

Fixes #98. Thanks to @levik62 for the precise diagnosis.

The kernel WireGuard backend inserts its forward accept rules at the top of every nftables forward-hook chain. On Docker hosts that includes iptables-nft's table ip mangle FORWARD chain, where TCP MSS clamping lives. The accept ends that chain before the clamp runs, so full-size segments enter the tunnel and get dropped: ping and DNS work, TLS handshakes and streams stall.

This skips forward chains in a table named mangle or at the mangle hook priority (-150, which also covers fw4's mangle_forward). They alter packets rather than filter them, so they never need the accept; every filter-stage chain still gets it.

backend/wireguard/host_routing_linux.go: read prio from nft -j list ruleset and skip mangle chains in parseNFTForwardBaseChains.
backend/wireguard/host_routing_linux_test.go: new parser test (iptables-nft mangle, fw4 mangle_forward and forward, ip filter, and a non-numeric prio that must not fail).

Upgrade note: an older node removes the rules it put into a mangle chain when it shuts down cleanly, and this version never adds them there. If the old process is killed before its cleanup finishes (Docker's default 10 s stop timeout matches the node's 10 s graceful stop), its rules stay in the mangle chain until a reboot. To remove them by hand: nft -a list chain ip mangle FORWARD, then nft delete rule ip mangle FORWARD handle <N> for each rule whose comment starts with pg_node_wg.

go vet and go test ./backend/wireguard/ pass.

Summary by CodeRabbit

Bug Fixes
- Improved Linux network forwarding rule handling by skipping mangle chains and chains with a priority of -150.

@levik62

ensureNFTForwarding inserts "iifname <wg> accept" rules at the top of every forward-hook base chain. That includes mangle chains such as iptables-nft's "table ip mangle" FORWARD, where Docker hosts keep TCP MSS clamping. The accept ends that chain before the clamping rule runs, so full-size TCP segments enter the tunnel, exceed the path MTU and get dropped: ping and DNS work, but TLS handshakes and streams stall. Skip forward chains in a table named "mangle" or at the mangle hook priority (-150, which also covers fw4's mangle_forward). Those chains alter packets rather than filter them, so they never need the accept. Rules from older versions are still removed on shutdown by the old process, as before. Fixes PasarGuard#98 (diagnosis by @levik62).

coderabbitai · 2026-10-11T16:36:08Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: c5100a53-96c8-4e15-971b-b4ca6eeda45d

📥 Commits

Reviewing files that changed from the base of the PR and between e03754d and 2fe9d8f.

📒 Files selected for processing (2)

backend/wireguard/host_routing_linux.go
backend/wireguard/host_routing_linux_test.go

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

Walkthrough

Forward-chain discovery now skips nftables chains in the mangle table or with priority -150. A parser test checks that those chains are excluded while other forward chains remain.

Changes

Mangle chain filtering

Layer / File(s)	Summary
Identify and skip mangle chains `backend/wireguard/host_routing_linux.go`, `backend/wireguard/host_routing_linux_test.go`	The parser decodes chain priority and excludes chains in the `mangle` table or with priority `-150`. The test verifies that mangle chains are skipped and other forward chains are retained in order.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 2fe9d

No merge-blocking risk is identified; merge after normal checks.

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: preventing WireGuard forward accept rules from being added to mangle chains.
Linked Issues check		Issue `#98` requires `parseNFTForwardBaseChains` to avoid injecting forward accept rules into mangle processing. At the reviewed head, `nftMangleChain` skips chains with table `mangle` and chains with p…
Out of Scope Changes check		The reported changes are limited to forward-chain filtering and its parser test. The priority check extends the same `#98` behavior to fw4 mangle chains. The test directly verifies the required behavior…

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the chains at night,
And keeps the mangle rules in sight.
The other forwards pass along,
Their order kept, their parsing strong.
With test in place, the burrow’s bright.}

_{Comment @coderabbitai help to get the list of available commands.}

…ts owner Main's decision G1 (B). None of these lines claims a port, or coverage by a branch that is not on main. - a3d2d2f (PasarGuard#101): owned by NODE-WG (wgnft), until 2026-11-10. - 33ab5fb (PasarGuard#58): owned by NODE-SYNC-055 and NODE-XRAY-RACE, until 2026-11-10. - xray 7da5dae: its verified port by NODE-MISC-XMUX is queued after this cut, until 2026-11-20. - xray b291961, 8d0a7cf and 72b4d0c, each on its upstream branch and scoped to it: reachability awaits NODE-MISC-UPX, until 2026-11-10. - sing-box 42cae14 and release v1.14.4: PUSH-GATE, with the sing-box 1.14 move, until 2026-11-20.

@levik62

…Guard#101) ensureNFTForwarding inserts "iifname <wg> accept" rules at the top of every forward-hook base chain. That includes mangle chains such as iptables-nft's "table ip mangle" FORWARD, where Docker hosts keep TCP MSS clamping. The accept ends that chain before the clamping rule runs, so full-size TCP segments enter the tunnel, exceed the path MTU and get dropped: ping and DNS work, but TLS handshakes and streams stall. Skip forward chains in a table named "mangle" or at the mangle hook priority (-150, which also covers fw4's mangle_forward). Those chains alter packets rather than filter them, so they never need the accept. Rules from older versions are still removed on shutdown by the old process, as before. Fixes PasarGuard#98 (diagnosis by @levik62). (cherry picked from commit a3d2d2f)

…T-L-1) ensureNFTForwarding inserts the L2TP pool's MSS and "ip saddr <pool> accept" rules at the top of every forward-hook base chain that parseForwardBaseChains returns. That list still included mangle chains such as iptables-nft's "table ip mangle" FORWARD and fw4's mangle_forward, both at priority -150. On Docker hosts that chain holds TCP MSS clamping; the inserted accept ends the chain before the clamping rule runs, so full-size TCP segments leave for paths with a smaller MTU and get dropped: ping and DNS work, but TLS handshakes and streams stall. Upstream fixed the same bug for WireGuard in PasarGuard#101, cherry-picked here as c0e36fc9. This applies the same rule to the fork's L2TP copy: forward chains in a table named "mangle" or at the mangle hook priority (-150) are skipped. Those chains alter packets rather than filter them, so they never need the accept. As in the WireGuard fix, cleanup walks the same filtered list, so rules an older version left in a mangle chain are removed by that older process on shutdown, as before. Upstream: a3d2d2f (adapted to backend/l2tp)

… ledger 24e2b12 (PasarGuard#55) and a3d2d2f (PasarGuard#101) are ported on main by 3874446 and 3998a57, whose cherry-pick trailers the drift check reads, so their pending waivers are removed. The v0.5.6 version bump 675bdaa becomes not-applicable, as the panel's upstream-forks/node.md records it and as 47857d4 and 739eab9 already are. The 47857d4 reason now names NodeVersion 0.6.22, the value on main.

ImMohammad20000 merged commit a3d2d2f into PasarGuard:dev Oct 12, 2026
2 checks passed

Navigation Menu

Repository navigation

fix(wireguard): keep forward accept rules out of mangle chains - #101

fix(wireguard): keep forward accept rules out of mangle chains#101
ImMohammad20000 merged 1 commit into
PasarGuard:devfrom
T3ST3ST3R0N:fix/wg-skip-mangle-forward

T3ST3ST3R0N commented Oct 11, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 11, 2026 •

edited

Loading

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

T3ST3ST3R0N commented Oct 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

T3ST3ST3R0N commented Oct 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 11, 2026 •

edited

Loading