Fallback to accepting only NEW output public traffic if conntrack netlink isn't supported

internal/netlink/conntrack_linux.go

@@ -1,6 +1,7 @@
 package netlink
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/mdlayher/netlink"
@@ -8,7 +9,13 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+var ErrConntrackNetlinkNotSupported = errors.New("nf_conntrack_netlink is not supported by the kernel")
+
 func (n *NetLink) FlushConntrack() error {
+	if !n.conntrackNetlink {
+		return fmt.Errorf("%w", ErrConntrackNetlinkNotSupported)
+	}
+
 	conn, err := netfilter.Dial(nil)
 	if err != nil {
 		return fmt.Errorf("dialing netfilter: %w", err)

internal/netlink/conntrack_unspecified.go

@@ -2,6 +2,10 @@
 
 package netlink
 
+import "errors"
+
+var ErrConntrackNetlinkNotSupported = errors.New("error not implemented")
+
 func (n *NetLink) FlushConntrack() error {
 	panic("not implemented")
 }

internal/netlink/netlink.go

@@ -1,14 +1,22 @@
 package netlink
 
-import "github.com/qdm12/log"
+import (
+	"github.com/qdm12/gluetun/internal/mod"
+	"github.com/qdm12/log"
+)
 
 type NetLink struct {
 	debugLogger DebugLogger
+
+	// Fixed state
+	conntrackNetlink bool
 }
 
 func New(debugLogger DebugLogger) *NetLink {
+	conntrackNetlink := mod.Probe("nf_conntrack_netlink") == nil
 	return &NetLink{
-		debugLogger: debugLogger,
+		debugLogger:      debugLogger,
+		conntrackNetlink: conntrackNetlink,
 	}
 }