From 3d76b14224062b86ec6bb9c4323107fcb3a08fa0 Mon Sep 17 00:00:00 2001
From: Quentin McGaw <quentin.mcgaw@gmail.com>
Date: Fri, 7 Aug 2026 11:32:24 +0000
Subject: [PATCH] more fixes

---
 .devcontainer/Dockerfile                         |  3 ++-
 internal/configuration/settings/firewall.go      |  2 +-
 internal/configuration/settings/settings_test.go |  2 +-
 internal/firewall/iptables/firewall.go           | 15 ---------------
 internal/firewall/iptables/tcp.go                |  4 +++-
 5 files changed, 7 insertions(+), 19 deletions(-)

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 35d02f23..02c85df9 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,2 +1,3 @@
-FROM ghcr.io/qdm12/godevcontainer:v0.21-alpine
+FROM ghcr.io/qdm12/godevcontainer:v0.22-alpine
 RUN apk add wireguard-tools htop openssl tcpdump iptables nftables
+RUN apk add nodejs npm && npm install markdownlint-cli2 --global && apk del npm
\ No newline at end of file
diff --git a/internal/configuration/settings/firewall.go b/internal/configuration/settings/firewall.go
index 6977a6a2..28404374 100644
--- a/internal/configuration/settings/firewall.go
+++ b/internal/configuration/settings/firewall.go
@@ -83,7 +83,7 @@ func (f *Firewall) overrideWith(other Firewall) {
 
 func (f *Firewall) setDefaults(globalLogLevel string) {
 	f.Enabled = gosettings.DefaultPointer(f.Enabled, true)
-	f.Implementation = gosettings.DefaultComparable(f.Implementation, "iptables")
+	f.Implementation = gosettings.DefaultComparable(f.Implementation, "auto")
 	f.Iptables.setDefaults(globalLogLevel)
 }
 
diff --git a/internal/configuration/settings/settings_test.go b/internal/configuration/settings/settings_test.go
index cd3af106..36652325 100644
--- a/internal/configuration/settings/settings_test.go
+++ b/internal/configuration/settings/settings_test.go
@@ -62,7 +62,7 @@ func Test_Settings_String(t *testing.T) {
 |       └── Block ads: no
 ├── Firewall settings:
 |   ├── Enabled: yes
-|   ├── Implementation: iptables
+|   ├── Implementation: auto
 |   └── Iptables settings:
 |       └── Log level: INFO
 ├── Log settings:
diff --git a/internal/firewall/iptables/firewall.go b/internal/firewall/iptables/firewall.go
index 9085aa1d..52f92f82 100644
--- a/internal/firewall/iptables/firewall.go
+++ b/internal/firewall/iptables/firewall.go
@@ -3,8 +3,6 @@ package iptables
 import (
 	"context"
 	"sync"
-
-	"github.com/qdm12/gluetun/internal/mod"
 )
 
 type Config struct {
@@ -15,8 +13,6 @@ type Config struct {
 	// Fixed state
 	ipTables  string
 	ip6Tables string
-	nftables  bool
-	xtMark    bool
 }
 
 func New(ctx context.Context, runner CmdRunner, logger Logger) (*Config, error) {
@@ -30,21 +26,10 @@ func New(ctx context.Context, runner CmdRunner, logger Logger) (*Config, error)
 		return nil, err
 	}
 
-	modules := map[string]bool{
-		"xt_mark":   false,
-		"nf_tables": false,
-	}
-	for module := range modules {
-		err := mod.Probe(module)
-		modules[module] = err == nil
-	}
-
 	return &Config{
 		runner:    runner,
 		logger:    logger,
 		ipTables:  iptables,
 		ip6Tables: ip6tables,
-		nftables:  modules["nf_tables"],
-		xtMark:    modules["xt_mark"],
 	}, nil
 }
diff --git a/internal/firewall/iptables/tcp.go b/internal/firewall/iptables/tcp.go
index 8e48e84a..8ed42fc7 100644
--- a/internal/firewall/iptables/tcp.go
+++ b/internal/firewall/iptables/tcp.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"net/netip"
+	"os"
 )
 
 type tcpFlags struct {
@@ -71,7 +72,8 @@ func (c *Config) TempDropOutputTCPRST(ctx context.Context,
 	src, dst netip.AddrPort, excludeMark int) (
 	revert func(ctx context.Context) error, err error,
 ) {
-	if !c.nftables && !c.xtMark {
+	_, err = os.Stat("/usr/lib/xtables/libxt_mark.so")
+	if err != nil && errors.Is(err, os.ErrNotExist) {
 		return nil, fmt.Errorf("%w", ErrMarkMatchModuleMissing)
 	}