fix(nft): route root fake-ip traffic through box_main

Author: JadenJSJ

lib/firewall/backend_nft.sh

@@ -6,6 +6,7 @@ set -euo pipefail
 
 BOX_NFT_TABLE_INET="box_mangle"
 BOX_NFT_TABLE_IP="box_nat"
+BOX_MIHOMO_FAKEIP_V4_CIDR="198.18.0.0/16"
 
 nft_cmd() {
   if [[ -n "${BOX_NFT_CMD:-}" ]]; then
@@ -286,6 +287,8 @@ add chain inet ${BOX_NFT_TABLE_INET} output { type route hook output priority ma
 add chain inet ${BOX_NFT_TABLE_INET} box_main
 add chain inet ${BOX_NFT_TABLE_INET} box_dns
 add rule inet ${BOX_NFT_TABLE_INET} prerouting jump box_main
+$(if [[ "${BOX_DNS_ENHANCED_MODE}" == "fake-ip" ]]; then printf 'add rule inet %s output meta skuid 0 ip daddr %s jump box_main\n' "${BOX_NFT_TABLE_INET}" "${BOX_MIHOMO_FAKEIP_V4_CIDR}"; fi)
+add rule inet ${BOX_NFT_TABLE_INET} output meta skuid 0 jump box_dns
 add rule inet ${BOX_NFT_TABLE_INET} output meta skuid 0 return
 add rule inet ${BOX_NFT_TABLE_INET} output jump box_main
 add rule inet ${BOX_NFT_TABLE_INET} box_main jump box_dns
@@ -297,6 +300,8 @@ add chain ip ${BOX_NFT_TABLE_IP} output { type nat hook output priority -100; po
 add chain ip ${BOX_NFT_TABLE_IP} box_main
 add chain ip ${BOX_NFT_TABLE_IP} box_dns
 add rule ip ${BOX_NFT_TABLE_IP} prerouting jump box_main
+$(if [[ "${BOX_DNS_ENHANCED_MODE}" == "fake-ip" ]]; then printf 'add rule ip %s output meta skuid 0 ip daddr %s jump box_main\n' "${BOX_NFT_TABLE_IP}" "${BOX_MIHOMO_FAKEIP_V4_CIDR}"; fi)
+add rule ip ${BOX_NFT_TABLE_IP} output meta skuid 0 jump box_dns
 add rule ip ${BOX_NFT_TABLE_IP} output meta skuid 0 return
 add rule ip ${BOX_NFT_TABLE_IP} output jump box_main
 add rule ip ${BOX_NFT_TABLE_IP} box_main jump box_dns

tests/integration/test_phase2.sh

@@ -449,6 +449,12 @@ assert_contains "${dryrun_output}" "add rule inet box_mangle box_main ip daddr @
 assert_contains "${dryrun_output}" "add rule ip box_nat box_main ip daddr @box_cn_v4 return"
 assert_line_order "${dryrun_output}" "add rule inet box_mangle box_main ip daddr @box_cn_v4 return" 'add rule inet box_mangle box_main return comment "BOX_POLICY_PLACEHOLDER"'
 assert_line_order "${dryrun_output}" "meta mark set 16777216" 'add rule inet box_mangle box_main return comment "BOX_POLICY_PLACEHOLDER"'
+assert_contains "${dryrun_output}" "add rule inet box_mangle output meta skuid 0 ip daddr 198.18.0.0/16 jump box_main"
+assert_contains "${dryrun_output}" "add rule ip box_nat output meta skuid 0 ip daddr 198.18.0.0/16 jump box_main"
+assert_line_order "${dryrun_output}" "add rule inet box_mangle output meta skuid 0 ip daddr 198.18.0.0/16 jump box_main" "add rule inet box_mangle output meta skuid 0 return"
+assert_line_order "${dryrun_output}" "add rule ip box_nat output meta skuid 0 ip daddr 198.18.0.0/16 jump box_main" "add rule ip box_nat output meta skuid 0 return"
+assert_line_order "${dryrun_output}" "add rule inet box_mangle output meta skuid 0 jump box_dns" "add rule inet box_mangle output meta skuid 0 return"
+assert_line_order "${dryrun_output}" "add rule ip box_nat output meta skuid 0 jump box_dns" "add rule ip box_nat output meta skuid 0 return"
 
 printf '[6/13] trace mode logs external commands with action context\n'
 BOX_TRACE_COMMANDS=1