Fix Docker DNAT handling with auto route

redirect_iptables.go

@@ -96,6 +96,13 @@ func (r *autoRedirect) setupIPTablesForFamily(iptablesPath string) error {
 	if err != nil {
 		return err
 	}
+	if r.tunOptions.AutoRoute {
+		err = r.runShell(iptablesPath, "-t nat -A", tableNamePreRouteing,
+			"-m conntrack --ctstate DNAT -j RETURN")
+		if err != nil {
+			return err
+		}
+	}
 	var (
 		routeAddress        []netip.Prefix
 		routeExcludeAddress []netip.Prefix
@@ -136,6 +143,12 @@ func (r *autoRedirect) setupIPTablesForFamily(iptablesPath string) error {
 			return err
 		}
 	}
+	if r.tunOptions.AutoRoute {
+		err = r.runShell(iptablesPath, "-t nat -A", tableNamePreRouteing, "-m addrtype --dst-type LOCAL -j RETURN")
+		if err != nil {
+			return err
+		}
+	}
 	if !r.tunOptions.EXP_DisableDNSHijack {
 		dnsServer := common.Find(r.tunOptions.DNSServers, func(it netip.Addr) bool {
 			return it.Is4() == (iptablesPath == r.iptablesPath)
@@ -187,9 +200,11 @@ func (r *autoRedirect) setupIPTablesForFamily(iptablesPath string) error {
 		}
 	}
 
-	err = r.runShell(iptablesPath, "-t nat -A", tableNamePreRouteing, "-m addrtype --dst-type LOCAL -j RETURN")
-	if err != nil {
-		return err
+	if !r.tunOptions.AutoRoute {
+		err = r.runShell(iptablesPath, "-t nat -A", tableNamePreRouteing, "-m addrtype --dst-type LOCAL -j RETURN")
+		if err != nil {
+			return err
+		}
 	}
 
 	if len(routeAddress) > 0 {
@@ -224,7 +239,11 @@ func (r *autoRedirect) setupIPTablesForFamily(iptablesPath string) error {
 			return err
 		}
 	}
-	err = r.runShell(iptablesPath, "-t nat -I PREROUTING -j", tableNamePreRouteing)
+	preRoutingOperation := "-I"
+	if r.tunOptions.AutoRoute {
+		preRoutingOperation = "-A"
+	}
+	err = r.runShell(iptablesPath, "-t nat", preRoutingOperation, "PREROUTING -j", tableNamePreRouteing)
 	if err != nil {
 		return err
 	}

redirect_iptables_test.go

@@ -0,0 +1,70 @@
+//go:build linux
+
+package tun
+
+import (
+	"net/netip"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAutoRedirectIPTablesLocalDestinationOrder(t *testing.T) {
+	for name, testCase := range map[string]struct {
+		autoRoute            bool
+		localBeforeDNSHijack bool
+	}{
+		"auto route":         {autoRoute: true, localBeforeDNSHijack: true},
+		"without auto route": {autoRoute: false, localBeforeDNSHijack: false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			tempDir := t.TempDir()
+			commandLogPath := filepath.Join(tempDir, "iptables.log")
+			iptablesPath := filepath.Join(tempDir, "iptables")
+			require.NoError(t, os.WriteFile(
+				iptablesPath,
+				[]byte("#!/bin/sh\nprintf '%s\\n' \"$*\" >> \"$IPTABLES_LOG\"\n"),
+				0o700,
+			))
+			t.Setenv("IPTABLES_LOG", commandLogPath)
+
+			redirect := &autoRedirect{
+				tunOptions: &Options{
+					Name:         "tun0",
+					AutoRoute:    testCase.autoRoute,
+					Inet4Address: []netip.Prefix{netip.MustParsePrefix("198.18.0.1/30")},
+					DNSServers:   []netip.Addr{netip.MustParseAddr("198.18.0.2")},
+				},
+				tableName:          "test",
+				enableIPv4:         true,
+				iptablesPath:       iptablesPath,
+				customRedirectPort: 12345,
+			}
+
+			require.NoError(t, redirect.setupIPTablesForFamily(iptablesPath))
+			commandLog, err := os.ReadFile(commandLogPath)
+			require.NoError(t, err)
+
+			localReturnIndex := -1
+			dnsHijackIndex := -1
+			for index, command := range strings.Split(strings.TrimSpace(string(commandLog)), "\n") {
+				if strings.Contains(command, "test-prerouting -m addrtype --dst-type LOCAL -j RETURN") {
+					localReturnIndex = index
+				}
+				if strings.Contains(command, "test-prerouting -p udp --dport 53 -j DNAT --to") {
+					dnsHijackIndex = index
+				}
+			}
+			require.NotEqual(t, -1, localReturnIndex)
+			require.NotEqual(t, -1, dnsHijackIndex)
+			if testCase.localBeforeDNSHijack {
+				require.Less(t, localReturnIndex, dnsHijackIndex)
+			} else {
+				require.Greater(t, localReturnIndex, dnsHijackIndex)
+			}
+		})
+	}
+}

redirect_nftables_rules.go

@@ -133,6 +133,15 @@ func (r *autoRedirect) nftablesCreateLoopbackAddressSets(
 }
 
 func (r *autoRedirect) nftablesCreateExcludeRules(nft *nftables.Conn, table *nftables.Table, chain *nftables.Chain) error {
+	if r.tunOptions.AutoRoute && chain.Hooknum == nftables.ChainHookPrerouting {
+		expressions := nftablesDNATStatusExpressions()
+		expressions = append(expressions, &expr.Counter{}, &expr.Verdict{Kind: expr.VerdictReturn})
+		nft.AddRule(&nftables.Rule{
+			Table: table,
+			Chain: chain,
+			Exprs: expressions,
+		})
+	}
 	if r.tunOptions.AutoRedirectMarkMode && chain.Hooknum == nftables.ChainHookOutput {
 		if chain.Type == nftables.ChainTypeRoute {
 			ipProto := &nftables.Set{