Use ErrKernelModuleMissing when missing kernel module string is detected

- all operations rollback on failure
- disabling the firewall means rolling back to its state before enabling it
- aligns with nftables atomicity feature

.devcontainer/Dockerfile

@@ -1,2 +1,2 @@
 FROM ghcr.io/qdm12/godevcontainer:v0.21-alpine
-RUN apk add wireguard-tools htop openssl
+RUN apk add wireguard-tools htop openssl tcpdump iptables

.github/workflows/ci.yml

@@ -45,6 +45,7 @@ jobs:
           level: error
           exclude: |
             ./internal/storage/servers.json
+            ./golangci.yml
             *.md
 
       - name: Linting

.golangci.yml

@@ -22,6 +22,7 @@ linters:
         - "^disabled$"
         # Firewall and routing strings
         - "^(ACCEPT|DROP)$"
+        - "^--append$"
         - "^--delete$"
         - "^all$"
         - "^(tcp|udp)$"
@@ -47,7 +48,7 @@ linters:
         path: internal\/server\/.+\.go
       - linters:
           - ireturn
-        text: returns interface \(github\.com\/vishvananda\/netlink\.Link\)
+        text: returns interface \(golang\.org\/x\/sys\/unix\.Sockaddr\)
       - linters:
           - ireturn
         path: internal\/openvpn\/pkcs8\/descbc\.go

Dockerfile

@@ -13,7 +13,7 @@ FROM --platform=${BUILDPLATFORM} ghcr.io/qdm12/binpot:mockgen-${MOCKGEN_VERSION}
 FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION}-alpine${GO_ALPINE_VERSION} AS base
 COPY --from=xcputranslate /xcputranslate /usr/local/bin/xcputranslate
 # Note: findutils needed to have xargs support `-d` flag for mocks stage.
-RUN apk --update add git g++ findutils
+RUN apk --update add git g++ findutils iptables
 ENV CGO_ENABLED=0
 COPY --from=golangci-lint /bin /go/bin/golangci-lint
 COPY --from=mockgen /bin /go/bin/mockgen
@@ -110,8 +110,11 @@ ENV VPN_SERVICE_PROVIDER=pia \
     WIREGUARD_PERSISTENT_KEEPALIVE_INTERVAL=0 \
     WIREGUARD_ADDRESSES= \
     WIREGUARD_ADDRESSES_SECRETFILE=/run/secrets/wireguard_addresses \
-    WIREGUARD_MTU=1320 \
+    WIREGUARD_MTU= \
     WIREGUARD_IMPLEMENTATION=auto \
+    # PMTUD
+    PMTUD_ICMP_ADDRESSES=1.1.1.1,8.8.8.8 \
+    PMTUD_TCP_ADDRESSES=1.1.1.1:443,8.8.8.8:443,1.1.1.1:53,8.8.8.8:53,[2606:4700:4700::1111]:53,[2001:4860:4860::8888]:53,[2606:4700:4700::1111]:443,[2001:4860:4860::8888]:443 \
     # VPN server filtering
     SERVER_REGIONS= \
     SERVER_COUNTRIES= \

README.md

@@ -58,7 +58,7 @@ Lightweight swiss-army-knife-like VPN client to multiple VPN service providers
 ## Features
 
 - Based on Alpine 3.22 for a small Docker image of 41.1MB
-- Supports: **AirVPN**, **Cyberghost**, **ExpressVPN**, **FastestVPN**, **Giganews**, **HideMyAss**, **IPVanish**, **IVPN**, **Mullvad**, **NordVPN**, **Perfect Privacy**, **Privado**, **Private Internet Access**, **PrivateVPN**, **ProtonVPN**, **PureVPN**,  **SlickVPN**, **Surfshark**, **TorGuard**, **VPNSecure.me**, **VPNUnlimited**, **Vyprvpn**, **Windscribe** servers
+- Supports: **AirVPN**, **Cyberghost**, **ExpressVPN**, **FastestVPN**, **Giganews**, **HideMyAss**, **IPVanish**, **IVPN**, **Mullvad** (Wireguard only), **NordVPN**, **Perfect Privacy**, **Privado**, **Private Internet Access**, **PrivateVPN**, **ProtonVPN**, **PureVPN**,  **SlickVPN**, **Surfshark**, **TorGuard**, **VPNSecure.me**, **VPNUnlimited**, **Vyprvpn**, **Windscribe** servers
 - Supports OpenVPN for all providers listed
 - Supports Wireguard both kernelspace and userspace
   - For **AirVPN**, **FastestVPN**, **Ivpn**, **Mullvad**, **NordVPN**, **Perfect privacy**, **ProtonVPN**, **Surfshark** and **Windscribe**

cmd/gluetun/main.go

@@ -168,7 +168,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 
 	defer fmt.Println(gluetunLogo)
 
-	announcementExp, err := time.Parse(time.RFC3339, "2024-12-01T00:00:00Z")
+	announcementExp, err := time.Parse(time.RFC3339, "2026-04-01T00:00:00Z")
 	if err != nil {
 		return err
 	}
@@ -179,7 +179,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 		Version:      buildInfo.Version,
 		Commit:       buildInfo.Commit,
 		Created:      buildInfo.Created,
-		Announcement: "All control server routes will become private by default after the v3.41.0 release",
+		Announcement: "All control server routes are now private by default",
 		AnnounceExp:  announcementExp,
 		// Sponsor information
 		PaypalUser:    "qmcgaw",
@@ -227,7 +227,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 		firewallLogger.Patch(log.SetLevel(log.LevelDebug))
 	}
 	firewallConf, err := firewall.NewConfig(ctx, firewallLogger, cmder,
-		defaultRoutes, localNetworks)
+		netLinker, defaultRoutes, localNetworks)
 	if err != nil {
 		return err
 	}
@@ -264,7 +264,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 
 	puid, pgid := int(*allSettings.System.PUID), int(*allSettings.System.PGID)
 
-	const clientTimeout = 15 * time.Second
+	const clientTimeout = 35 * time.Second
 	httpClient := &http.Client{Timeout: clientTimeout}
 	// Create configurators
 	alpineConf := alpine.New()
@@ -279,7 +279,7 @@ func _main(ctx context.Context, buildInfo models.BuildInformation,
 	err = printVersions(ctx, logger, []printVersionElement{
 		{name: "Alpine", getVersion: alpineConf.Version},
 		{name: "OpenVPN", getVersion: ovpnVersion},
-		{name: "IPtables", getVersion: firewallConf.Version},
+		{name: "Firewall", getVersion: firewallConf.Version},
 	})
 	if err != nil {
 		return err
@@ -556,6 +556,7 @@ type netLinker interface {
 	Linker
 	IsWireguardSupported() (ok bool, err error)
 	IsIPv6Supported() (ok bool, err error)
+	FlushConntrack() error
 	PatchLoggerLevel(level log.Level)
 }
 

go.mod

@@ -11,8 +11,9 @@ require (
 	github.com/klauspost/compress v1.18.1
 	github.com/klauspost/pgzip v1.2.6
 	github.com/mdlayher/genetlink v1.3.2
+	github.com/mdlayher/netlink v1.7.2
 	github.com/pelletier/go-toml/v2 v2.2.4
-	github.com/qdm12/dns/v2 v2.0.0-rc10
+	github.com/qdm12/dns/v2 v2.0.0-rc9.0.20260216151239-36b3306f2205
 	github.com/qdm12/gosettings v0.4.4
 	github.com/qdm12/goshutdown v0.3.0
 	github.com/qdm12/gosplash v0.2.0
@@ -20,6 +21,7 @@ require (
 	github.com/qdm12/log v0.1.0
 	github.com/qdm12/ss-server v0.6.0
 	github.com/stretchr/testify v1.11.1
+	github.com/ti-mo/netfilter v0.5.3
 	github.com/ulikunitz/xz v0.5.15
 	github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a
 	golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c
@@ -43,7 +45,6 @@ require (
 	github.com/josharian/native v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/miekg/dns v1.1.62 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect

go.sum

@@ -73,8 +73,8 @@ github.com/prometheus/common v0.60.1 h1:FUas6GcOw66yB/73KC+BOZoFJmbo/1pojoILArPA
 github.com/prometheus/common v0.60.1/go.mod h1:h0LYf1R1deLSKtD4Vdg8gy4RuOvENW2J/h19V5NADQw=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/qdm12/dns/v2 v2.0.0-rc10 h1:IyeNEYXfhBsaE1dwxx5eAqdAz1HS98dT+8c7xoKODa0=
-github.com/qdm12/dns/v2 v2.0.0-rc10/go.mod h1:98foWgXJZ+g8gJIuO+fdO+oWpFei5WShMFTeN4Im2lE=
+github.com/qdm12/dns/v2 v2.0.0-rc9.0.20260216151239-36b3306f2205 h1:0ycKUDQ50cYb2QpeyGcEnvVs9HJmC9jsb/XZNC1z28c=
+github.com/qdm12/dns/v2 v2.0.0-rc9.0.20260216151239-36b3306f2205/go.mod h1:98foWgXJZ+g8gJIuO+fdO+oWpFei5WShMFTeN4Im2lE=
 github.com/qdm12/goservices v0.1.1-0.20251104135713-6bee97bd4978 h1:TRGpCU1l0lNwtogEUSs5U+RFceYxkAJUmrGabno7J5c=
 github.com/qdm12/goservices v0.1.1-0.20251104135713-6bee97bd4978/go.mod h1:D1Po4CRQLYjccnAR2JsVlN1sBMgQrcNLONbvyuzcdTg=
 github.com/qdm12/gosettings v0.4.4 h1:SM6tOZDf6k8qbjWU8KWyBF4mWIixfsKCfh9DGRLHlj4=
@@ -95,6 +95,8 @@ github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/ti-mo/netfilter v0.5.3 h1:ikzduvnaUMwre5bhbNwWOd6bjqLMVb33vv0XXbK0xGQ=
+github.com/ti-mo/netfilter v0.5.3/go.mod h1:08SyBCg6hu1qyQk4s3DjjJKNrm3RTb32nm6AzyT972E=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a h1:fZHgsYlfvtyqToslyjUt3VOPF4J7aK/3MPcK7xp3PDk=

internal/configuration/settings/dnsblacklist.go

@@ -23,7 +23,9 @@ type DNSBlacklist struct {
 	AddBlockedIPs        []netip.Addr
 	AddBlockedIPPrefixes []netip.Prefix
 	// RebindingProtectionExemptHostnames is a list of hostnames
-	// exempt from DNS rebinding protection.
+	// exempt from DNS rebinding protection. It can contain parent
+	// domains which are of the form "*.example.com". Note the wildcard
+	// can only be used at the start of the hostname.
 	RebindingProtectionExemptHostnames []string
 }
 
@@ -55,6 +57,9 @@ func (b DNSBlacklist) validate() (err error) {
 	}
 
 	for _, host := range b.RebindingProtectionExemptHostnames {
+		if len(host) > 2 && host[:2] == "*." {
+			host = host[2:]
+		}
 		if !hostRegex.MatchString(host) {
 			return fmt.Errorf("%w: %s", ErrRebindingProtectionExemptHostNotValid, host)
 		}

internal/configuration/settings/pmtud.go

@@ -0,0 +1,111 @@
+package settings
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+
+	"github.com/qdm12/gosettings"
+	"github.com/qdm12/gosettings/reader"
+	"github.com/qdm12/gotree"
+)
+
+// PMTUD contains settings to configure Path MTU Discovery.
+type PMTUD struct {
+	// ICMPAddresses is the redundancy list of addresses to use
+	// for ICMP path MTU discovery. Each address MUST handle ICMP
+	// packets for PMTUD to work.
+	// It cannot be nil in the internal state.
+	ICMPAddresses []netip.Addr `json:"icmp_addresses"`
+	// TCPAddresses is the redundancy list of addresses to use
+	// for TCP path MTU discovery. Each address MUST have a listening
+	// TCP server on the port specified.
+	// It cannot be nil in the internal state.
+	TCPAddresses []netip.AddrPort `json:"tcp_addresses"`
+}
+
+var (
+	ErrPMTUDICMPAddressNotValid = errors.New("PMTUD ICMP address is not valid")
+	ErrPMTUDTCPAddressNotValid  = errors.New("PMTUD TCP address is not valid")
+)
+
+// Validate validates PMTUD settings.
+func (p PMTUD) validate() (err error) {
+	for i, addr := range p.ICMPAddresses {
+		if !addr.IsValid() {
+			return fmt.Errorf("%w: at index %d", ErrPMTUDICMPAddressNotValid, i)
+		}
+	}
+	for i, addr := range p.TCPAddresses {
+		if !addr.IsValid() {
+			return fmt.Errorf("%w: at index %d", ErrPMTUDTCPAddressNotValid, i)
+		}
+	}
+	return nil
+}
+
+func (p *PMTUD) copy() (copied PMTUD) {
+	return PMTUD{
+		ICMPAddresses: gosettings.CopySlice(p.ICMPAddresses),
+		TCPAddresses:  gosettings.CopySlice(p.TCPAddresses),
+	}
+}
+
+func (p *PMTUD) overrideWith(other PMTUD) {
+	p.ICMPAddresses = gosettings.OverrideWithSlice(p.ICMPAddresses, other.ICMPAddresses)
+	p.TCPAddresses = gosettings.OverrideWithSlice(p.TCPAddresses, other.TCPAddresses)
+}
+
+func (p *PMTUD) setDefaults() {
+	defaultICMPAddresses := []netip.Addr{
+		netip.AddrFrom4([4]byte{1, 1, 1, 1}),
+		netip.AddrFrom4([4]byte{8, 8, 8, 8}),
+	}
+	p.ICMPAddresses = gosettings.DefaultSlice(p.ICMPAddresses, defaultICMPAddresses)
+
+	const dnsPort, tlsPort = 53, 443
+	defaultTCPAddresses := []netip.AddrPort{
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), dnsPort),
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{8, 8, 8, 8}), dnsPort),
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), tlsPort),
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{8, 8, 8, 8}), tlsPort),
+		netip.AddrPortFrom(netip.MustParseAddr("2606:4700:4700::1111"), dnsPort),
+		netip.AddrPortFrom(netip.MustParseAddr("2001:4860:4860::8888"), dnsPort),
+		netip.AddrPortFrom(netip.MustParseAddr("2606:4700:4700::1111"), tlsPort),
+		netip.AddrPortFrom(netip.MustParseAddr("2001:4860:4860::8888"), tlsPort),
+	}
+	p.TCPAddresses = gosettings.DefaultSlice(p.TCPAddresses, defaultTCPAddresses)
+}
+
+func (p PMTUD) String() string {
+	return p.toLinesNode().String()
+}
+
+func (p PMTUD) toLinesNode() (node *gotree.Node) {
+	node = gotree.New("Path MTU discovery:")
+
+	icmpAddrNode := node.Append("ICMP addresses:")
+	for _, addr := range p.ICMPAddresses {
+		icmpAddrNode.Append(addr.String())
+	}
+
+	tcpAddrNode := node.Append("TCP addresses:")
+	for _, addr := range p.TCPAddresses {
+		tcpAddrNode.Append(addr.String())
+	}
+	return node
+}
+
+func (p *PMTUD) read(r *reader.Reader) (err error) {
+	p.ICMPAddresses, err = r.CSVNetipAddresses("PMTUD_ICMP_ADDRESSES")
+	if err != nil {
+		return err
+	}
+
+	p.TCPAddresses, err = r.CSVNetipAddrPorts("PMTUD_TCP_ADDRESSES")
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

internal/configuration/settings/provider.go

@@ -2,6 +2,8 @@ package settings
 
 import (
 	"fmt"
+	"slices"
+	"sort"
 	"strings"
 
 	"github.com/qdm12/gluetun/internal/constants/providers"
@@ -31,6 +33,11 @@ func (p *Provider) validate(vpnType string, filterChoicesGetter FilterChoicesGet
 	if vpnType == vpn.OpenVPN {
 		validNames = providers.AllWithCustom()
 		validNames = append(validNames, "pia") // Retro-compatibility
+		// Remove Mullvad since it no longer supports OpenVPN as of January 15th, 2026
+		mullvadIndex := slices.Index(validNames, providers.Mullvad)
+		validNames[mullvadIndex], validNames[len(validNames)-1] = validNames[len(validNames)-1], validNames[mullvadIndex]
+		validNames = validNames[:len(validNames)-1]
+		sort.Strings(validNames)
 	} else { // Wireguard
 		validNames = []string{
 			providers.Airvpn,
@@ -48,10 +55,6 @@ func (p *Provider) validate(vpnType string, filterChoicesGetter FilterChoicesGet
 		return fmt.Errorf("%w for Wireguard: %w", ErrVPNProviderNameNotValid, err)
 	}
 
-	if p.Name == providers.Mullvad && vpnType == vpn.OpenVPN {
-		warner.Warn("https://mullvad.net/en/blog/removing-openvpn-15th-january-2026")
-	}
-
 	err = p.ServerSelection.validate(p.Name, filterChoicesGetter, warner)
 	if err != nil {
 		return fmt.Errorf("server selection: %w", err)

internal/configuration/settings/settings_test.go

@@ -29,14 +29,27 @@ func Test_Settings_String(t *testing.T) {
 |   |       └── OpenVPN server selection settings:
 |   |           ├── Protocol: UDP
 |   |           └── Private Internet Access encryption preset: strong
-|   └── OpenVPN settings:
-|       ├── OpenVPN version: 2.6
-|       ├── User: [not set]
-|       ├── Password: [not set]
-|       ├── Private Internet Access encryption preset: strong
-|       ├── Network interface: tun0
-|       ├── Run OpenVPN as: root
-|       └── Verbosity level: 1
+|   ├── OpenVPN settings:
+|   |   ├── OpenVPN version: 2.6
+|   |   ├── User: [not set]
+|   |   ├── Password: [not set]
+|   |   ├── Private Internet Access encryption preset: strong
+|   |   ├── Network interface: tun0
+|   |   ├── Run OpenVPN as: root
+|   |   └── Verbosity level: 1
+|   └── Path MTU discovery:
+|       ├── ICMP addresses:
+|       |   ├── 1.1.1.1
+|       |   └── 8.8.8.8
+|       └── TCP addresses:
+|           ├── 1.1.1.1:53
+|           ├── 8.8.8.8:53
+|           ├── 1.1.1.1:443
+|           ├── 8.8.8.8:443
+|           ├── [2606:4700:4700::1111]:53
+|           ├── [2001:4860:4860::8888]:53
+|           ├── [2606:4700:4700::1111]:443
+|           └── [2001:4860:4860::8888]:443
 ├── DNS settings:
 |   ├── Keep existing nameserver(s): no
 |   ├── DNS server address to use: 127.0.0.1

internal/configuration/settings/vpn.go

@@ -18,6 +18,7 @@ type VPN struct {
 	Provider  Provider  `json:"provider"`
 	OpenVPN   OpenVPN   `json:"openvpn"`
 	Wireguard Wireguard `json:"wireguard"`
+	PMTUD     PMTUD     `json:"pmtud"`
 }
 
 // TODO v4 remove pointer for receiver (because of Surfshark).
@@ -45,6 +46,11 @@ func (v *VPN) Validate(filterChoicesGetter FilterChoicesGetter, ipv6Supported bo
 		}
 	}
 
+	err = v.PMTUD.validate()
+	if err != nil {
+		return fmt.Errorf("PMTUD settings: %w", err)
+	}
+
 	return nil
 }
 
@@ -54,6 +60,7 @@ func (v *VPN) Copy() (copied VPN) {
 		Provider:  v.Provider.copy(),
 		OpenVPN:   v.OpenVPN.copy(),
 		Wireguard: v.Wireguard.copy(),
+		PMTUD:     v.PMTUD.copy(),
 	}
 }
 
@@ -62,6 +69,7 @@ func (v *VPN) OverrideWith(other VPN) {
 	v.Provider.overrideWith(other.Provider)
 	v.OpenVPN.overrideWith(other.OpenVPN)
 	v.Wireguard.overrideWith(other.Wireguard)
+	v.PMTUD.overrideWith(other.PMTUD)
 }
 
 func (v *VPN) setDefaults() {
@@ -69,6 +77,7 @@ func (v *VPN) setDefaults() {
 	v.Provider.setDefaults()
 	v.OpenVPN.setDefaults(v.Provider.Name)
 	v.Wireguard.setDefaults(v.Provider.Name)
+	v.PMTUD.setDefaults()
 }
 
 func (v VPN) String() string {
@@ -85,6 +94,7 @@ func (v VPN) toLinesNode() (node *gotree.Node) {
 	} else {
 		node.AppendNode(v.Wireguard.toLinesNode())
 	}
+	node.AppendNode(v.PMTUD.toLinesNode())
 
 	return node
 }
@@ -107,5 +117,10 @@ func (v *VPN) read(r *reader.Reader) (err error) {
 		return fmt.Errorf("wireguard: %w", err)
 	}
 
+	err = v.PMTUD.read(r)
+	if err != nil {
+		return fmt.Errorf("PMTUD: %w", err)
+	}
+
 	return nil
 }

internal/configuration/settings/wireguard.go

@@ -38,15 +38,9 @@ type Wireguard struct {
 	Interface                   string         `json:"interface"`
 	PersistentKeepaliveInterval *time.Duration `json:"persistent_keep_alive_interval"`
 	// Maximum Transmission Unit (MTU) of the Wireguard interface.
-	// It cannot be zero in the internal state, and defaults to
-	// 1320. Note it is not the wireguard-go MTU default of 1420
-	// because this impacts bandwidth a lot on some VPN providers,
-	// see https://github.com/qdm12/gluetun/issues/1650.
-	// It has been lowered to 1320 following quite a bit of
-	// investigation in the issue:
-	// https://github.com/qdm12/gluetun/issues/2533.
-	// Note this should now be replaced with the PMTUD feature.
-	MTU uint32 `json:"mtu"`
+	// It cannot be nil in the internal state, and defaults to
+	// 0 indicating to use PMTUD.
+	MTU *uint32 `json:"mtu"`
 	// Implementation is the Wireguard implementation to use.
 	// It can be "auto", "userspace" or "kernelspace".
 	// It defaults to "auto" and cannot be the empty string
@@ -195,8 +189,7 @@ func (w *Wireguard) setDefaults(vpnProvider string) {
 	w.AllowedIPs = gosettings.DefaultSlice(w.AllowedIPs, defaultAllowedIPs)
 	w.PersistentKeepaliveInterval = gosettings.DefaultPointer(w.PersistentKeepaliveInterval, 0)
 	w.Interface = gosettings.DefaultComparable(w.Interface, "wg0")
-	const defaultMTU = 1320
-	w.MTU = gosettings.DefaultComparable(w.MTU, defaultMTU)
+	w.MTU = gosettings.DefaultPointer(w.MTU, 0)
 	w.Implementation = gosettings.DefaultComparable(w.Implementation, "auto")
 }
 
@@ -232,7 +225,11 @@ func (w Wireguard) toLinesNode() (node *gotree.Node) {
 	}
 
 	interfaceNode := node.Appendf("Network interface: %s", w.Interface)
-	interfaceNode.Appendf("MTU: %d", w.MTU)
+	if *w.MTU == 0 {
+		interfaceNode.Append("MTU: use path MTU discovery")
+	} else {
+		interfaceNode.Appendf("MTU: %d", *w.MTU)
+	}
 
 	if w.Implementation != "auto" {
 		node.Appendf("Implementation: %s", w.Implementation)
@@ -273,11 +270,9 @@ func (w *Wireguard) read(r *reader.Reader) (err error) {
 		return err
 	}
 
-	mtuPtr, err := r.Uint32Ptr("WIREGUARD_MTU")
+	w.MTU, err = r.Uint32Ptr("WIREGUARD_MTU")
 	if err != nil {
 		return err
-	} else if mtuPtr != nil {
-		w.MTU = *mtuPtr
 	}
 	return nil
 }

internal/dns/run.go

@@ -2,7 +2,6 @@ package dns
 
 import (
 	"context"
-	"errors"
 
 	"github.com/qdm12/dns/v2/pkg/nameserver"
 	"github.com/qdm12/gluetun/internal/constants"
@@ -44,7 +43,12 @@ func (l *Loop) Run(ctx context.Context, done chan<- struct{}) {
 			runError, err = l.setupServer(ctx)
 			if err == nil {
 				l.backoffTime = defaultBackoffTime
-				l.logger.Info("ready")
+				l.logger.Info("ready and using DNS server at address " + settings.ServerAddress.String())
+
+				err = l.updateFiles(ctx, settings)
+				if err != nil {
+					l.logger.Warn("downloading block lists failed, skipping: " + err.Error())
+				}
 				break
 			}
 
@@ -53,11 +57,6 @@ func (l *Loop) Run(ctx context.Context, done chan<- struct{}) {
 			if ctx.Err() != nil {
 				return
 			}
-
-			if !errors.Is(err, errUpdateBlockLists) {
-				const fallback = true
-				l.useUnencryptedDNS(fallback)
-			}
 			l.logAndWait(ctx, err)
 			settings = l.GetSettings()
 		}

internal/dns/setup.go

@@ -2,24 +2,23 @@ package dns
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net/netip"
 
 	"github.com/qdm12/dns/v2/pkg/check"
+	"github.com/qdm12/dns/v2/pkg/middlewares/filter/update"
 	"github.com/qdm12/dns/v2/pkg/nameserver"
 	"github.com/qdm12/dns/v2/pkg/server"
 )
 
-var errUpdateBlockLists = errors.New("cannot update filter block lists")
-
 func (l *Loop) setupServer(ctx context.Context) (runError <-chan error, err error) {
-	err = l.updateFiles(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("%w: %w", errUpdateBlockLists, err)
-	}
-
 	settings := l.GetSettings()
+	var updateSettings update.Settings
+	updateSettings.SetRebindingProtectionExempt(settings.Blacklist.RebindingProtectionExemptHostnames)
+	err = l.filter.Update(updateSettings)
+	if err != nil {
+		return nil, fmt.Errorf("updating filter for rebinding protection: %w", err)
+	}
 
 	serverSettings, err := buildServerSettings(settings, l.filter, l.localResolvers, l.logger)
 	if err != nil {

internal/dns/ticker.go

@@ -28,23 +28,12 @@ func (l *Loop) RunRestartTicker(ctx context.Context, done chan<- struct{}) {
 			return
 		case <-timer.C:
 			lastTick = l.timeNow()
-
-			status := l.GetStatus()
-			if status == constants.Running {
-				if err := l.updateFiles(ctx); err != nil {
-					l.statusManager.SetStatus(constants.Crashed)
-					l.logger.Error(err.Error())
-					l.logger.Warn("skipping DNS server restart due to failed files update")
-					settings := l.GetSettings()
-					timer.Reset(*settings.UpdatePeriod)
-					continue
+			settings := l.GetSettings()
+			if l.GetStatus() == constants.Running {
+				if err := l.updateFiles(ctx, settings); err != nil {
+					l.logger.Warn("updating block lists failed, skipping: " + err.Error())
 				}
 			}
-
-			_, _ = l.statusManager.ApplyStatus(ctx, constants.Stopped)
-			_, _ = l.statusManager.ApplyStatus(ctx, constants.Running)
-
-			settings := l.GetSettings()
 			timer.Reset(*settings.UpdatePeriod)
 		case <-l.updateTicker:
 			if !timer.Stop() {

internal/dns/update.go

@@ -6,11 +6,10 @@ import (
 
 	"github.com/qdm12/dns/v2/pkg/blockbuilder"
 	"github.com/qdm12/dns/v2/pkg/middlewares/filter/update"
+	"github.com/qdm12/gluetun/internal/configuration/settings"
 )
 
-func (l *Loop) updateFiles(ctx context.Context) (err error) {
-	settings := l.GetSettings()
-
+func (l *Loop) updateFiles(ctx context.Context, settings settings.DNS) (err error) {
 	l.logger.Info("downloading hostnames and IP block lists")
 	blacklistSettings := settings.Blacklist.ToBlockBuilderSettings(l.client)
 
@@ -37,7 +36,6 @@ func (l *Loop) updateFiles(ctx context.Context) (err error) {
 		IPPrefixes: result.BlockedIPPrefixes,
 	}
 	updateSettings.BlockHostnames(result.BlockedHostnames)
-	updateSettings.SetRebindingProtectionExempt(settings.Blacklist.RebindingProtectionExemptHostnames)
 	err = l.filter.Update(updateSettings)
 	if err != nil {
 		return fmt.Errorf("updating filter: %w", err)

internal/firewall/enable.go

@@ -22,9 +22,7 @@ func (c *Config) SetEnabled(ctx context.Context, enabled bool) (err error) {
 
 	if !enabled {
 		c.logger.Info("disabling...")
-		if err = c.disable(ctx); err != nil {
-			return fmt.Errorf("disabling firewall: %w", err)
-		}
+		c.restore(ctx)
 		c.enabled = false
 		c.logger.Info("disabled successfully")
 		return nil
@@ -41,64 +39,42 @@ func (c *Config) SetEnabled(ctx context.Context, enabled bool) (err error) {
 	return nil
 }
 
-func (c *Config) disable(ctx context.Context) (err error) {
-	if err = c.clearAllRules(ctx); err != nil {
-		return fmt.Errorf("clearing all rules: %w", err)
-	}
-	if err = c.setIPv4AllPolicies(ctx, "ACCEPT"); err != nil {
-		return fmt.Errorf("setting ipv4 policies: %w", err)
-	}
-	if err = c.setIPv6AllPolicies(ctx, "ACCEPT"); err != nil {
-		return fmt.Errorf("setting ipv6 policies: %w", err)
-	}
-
-	const remove = true
-	err = c.redirectPorts(ctx, remove)
-	if err != nil {
-		return fmt.Errorf("removing port redirections: %w", err)
-	}
-
-	return nil
-}
-
-// To use in defered call when enabling the firewall.
-func (c *Config) fallbackToDisabled(ctx context.Context) {
-	if ctx.Err() != nil {
-		return
-	}
-	if err := c.disable(ctx); err != nil {
-		c.logger.Error("failed reversing firewall changes: " + err.Error())
-	}
-}
-
 func (c *Config) enable(ctx context.Context) (err error) {
-	touched := false
-	if err = c.setIPv4AllPolicies(ctx, "DROP"); err != nil {
-		return err
+	c.restore, err = c.impl.SaveAndRestore(ctx)
+	if err != nil {
+		return fmt.Errorf("saving firewall rules: %w", err)
 	}
-	touched = true
 
-	if err = c.setIPv6AllPolicies(ctx, "DROP"); err != nil {
+	if err = c.impl.SetIPv4AllPolicies(ctx, "DROP"); err != nil {
 		return err
 	}
 
-	const remove = false
+	if err = c.impl.SetIPv6AllPolicies(ctx, "DROP"); err != nil {
+		return err
+	}
 
 	defer func() {
-		if touched && err != nil {
-			c.fallbackToDisabled(ctx)
+		if err != nil {
+			c.restore(context.Background())
 		}
 	}()
 
 	// Loopback traffic
-	if err = c.acceptInputThroughInterface(ctx, "lo", remove); err != nil {
-		return err
-	}
-	if err = c.acceptOutputThroughInterface(ctx, "lo", remove); err != nil {
+	if err = c.impl.AcceptInputThroughInterface(ctx, "lo"); err != nil {
 		return err
 	}
 
-	if err = c.acceptEstablishedRelatedTraffic(ctx, remove); err != nil {
+	const remove = false
+	if err = c.impl.AcceptOutputThroughInterface(ctx, "lo", remove); err != nil {
+		return err
+	}
+
+	err = c.flushExistingConnections(ctx)
+	if err != nil {
+		return fmt.Errorf("flushing existing connections: %w", err)
+	}
+
+	if err = c.impl.AcceptEstablishedRelatedTraffic(ctx); err != nil {
 		return err
 	}
 
@@ -108,7 +84,9 @@ func (c *Config) enable(ctx context.Context) (err error) {
 
 	localInterfaces := make(map[string]struct{}, len(c.localNetworks))
 	for _, network := range c.localNetworks {
-		if err := c.acceptOutputFromIPToSubnet(ctx, network.InterfaceName, network.IP, network.IPNet, remove); err != nil {
+		err = c.impl.AcceptOutputFromIPToSubnet(ctx,
+			network.InterfaceName, network.IP, network.IPNet, remove)
+		if err != nil {
 			return err
 		}
 
@@ -117,7 +95,7 @@ func (c *Config) enable(ctx context.Context) (err error) {
 			continue
 		}
 		localInterfaces[network.InterfaceName] = struct{}{}
-		err = c.acceptIpv6MulticastOutput(ctx, network.InterfaceName, remove)
+		err = c.impl.AcceptIpv6MulticastOutput(ctx, network.InterfaceName)
 		if err != nil {
 			return fmt.Errorf("accepting IPv6 multicast output: %w", err)
 		}
@@ -130,7 +108,7 @@ func (c *Config) enable(ctx context.Context) (err error) {
 	// Allows packets from any IP address to go through eth0 / local network
 	// to reach Gluetun.
 	for _, network := range c.localNetworks {
-		if err := c.acceptInputToSubnet(ctx, network.InterfaceName, network.IPNet, remove); err != nil {
+		if err := c.impl.AcceptInputToSubnet(ctx, network.InterfaceName, network.IPNet); err != nil {
 			return err
 		}
 	}
@@ -139,12 +117,12 @@ func (c *Config) enable(ctx context.Context) (err error) {
 		return err
 	}
 
-	err = c.redirectPorts(ctx, remove)
+	err = c.redirectPorts(ctx)
 	if err != nil {
 		return fmt.Errorf("redirecting ports: %w", err)
 	}
 
-	if err := c.runUserPostRules(ctx, c.customRulesPath, remove); err != nil {
+	if err := c.impl.RunUserPostRules(ctx, c.customRulesPath); err != nil {
 		return fmt.Errorf("running user defined post firewall rules: %w", err)
 	}
 
@@ -164,7 +142,7 @@ func (c *Config) allowVPNIP(ctx context.Context) (err error) {
 			continue
 		}
 		interfacesSeen[defaultRoute.NetInterface] = struct{}{}
-		err = c.acceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, c.vpnConnection, remove)
+		err = c.impl.AcceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, c.vpnConnection, remove)
 		if err != nil {
 			return fmt.Errorf("accepting output traffic through VPN: %w", err)
 		}
@@ -186,7 +164,7 @@ func (c *Config) allowOutboundSubnets(ctx context.Context) (err error) {
 			firewallUpdated = true
 
 			const remove = false
-			err := c.acceptOutputFromIPToSubnet(ctx, defaultRoute.NetInterface,
+			err := c.impl.AcceptOutputFromIPToSubnet(ctx, defaultRoute.NetInterface,
 				defaultRoute.AssignedIP, subnet, remove)
 			if err != nil {
 				return err
@@ -204,7 +182,7 @@ func (c *Config) allowInputPorts(ctx context.Context) (err error) {
 	for port, netInterfaces := range c.allowedInputPorts {
 		for netInterface := range netInterfaces {
 			const remove = false
-			err = c.acceptInputToPort(ctx, netInterface, port, remove)
+			err = c.impl.AcceptInputToPort(ctx, netInterface, port, remove)
 			if err != nil {
 				return fmt.Errorf("accepting input port %d on interface %s: %w",
 					port, netInterface, err)
@@ -214,9 +192,10 @@ func (c *Config) allowInputPorts(ctx context.Context) (err error) {
 	return nil
 }
 
-func (c *Config) redirectPorts(ctx context.Context, remove bool) (err error) {
+func (c *Config) redirectPorts(ctx context.Context) (err error) {
 	for _, portRedirection := range c.portRedirections {
-		err = c.redirectPort(ctx, portRedirection.interfaceName, portRedirection.sourcePort,
+		const remove = false
+		err = c.impl.RedirectPort(ctx, portRedirection.interfaceName, portRedirection.sourcePort,
 			portRedirection.destinationPort, remove)
 		if err != nil {
 			return err

internal/firewall/firewall.go

@@ -2,28 +2,29 @@ package firewall
 
 import (
 	"context"
+	"fmt"
 	"net/netip"
 	"sync"
 
+	"github.com/qdm12/gluetun/internal/firewall/iptables"
 	"github.com/qdm12/gluetun/internal/models"
 	"github.com/qdm12/gluetun/internal/routing"
 )
 
 type Config struct {
-	runner         CmdRunner
-	logger         Logger
-	iptablesMutex  sync.Mutex
-	ip6tablesMutex sync.Mutex
-	defaultRoutes  []routing.DefaultRoute
-	localNetworks  []routing.LocalNetwork
+	runner        CmdRunner
+	netlinker     Netlinker
+	logger        Logger
+	defaultRoutes []routing.DefaultRoute
+	localNetworks []routing.LocalNetwork
 
-	// Fixed state
-	ipTables        string
-	ip6Tables       string
+	// Fixed
+	impl            firewallImpl
 	customRulesPath string
 
 	// State
 	enabled           bool
+	restore           func(context.Context)
 	vpnConnection     models.Connection
 	vpnIntf           string
 	outboundSubnets   []netip.Prefix
@@ -35,28 +36,23 @@ type Config struct {
 // NewConfig creates a new Config instance and returns an error
 // if no iptables implementation is available.
 func NewConfig(ctx context.Context, logger Logger,
-	runner CmdRunner, defaultRoutes []routing.DefaultRoute,
-	localNetworks []routing.LocalNetwork,
+	runner CmdRunner, netlinker Netlinker,
+	defaultRoutes []routing.DefaultRoute, localNetworks []routing.LocalNetwork,
 ) (config *Config, err error) {
-	iptables, err := checkIptablesSupport(ctx, runner, "iptables", "iptables-nft", "iptables-legacy")
+	impl, err := iptables.New(ctx, runner, logger)
 	if err != nil {
-		return nil, err
-	}
-
-	ip6tables, err := findIP6tablesSupported(ctx, runner)
-	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("creating iptables firewall: %w", err)
 	}
 
 	return &Config{
 		runner:            runner,
+		netlinker:         netlinker,
 		logger:            logger,
 		allowedInputPorts: make(map[uint16]map[string]struct{}),
-		ipTables:          iptables,
-		ip6Tables:         ip6tables,
-		customRulesPath:   "/iptables/post-rules.txt",
 		// Obtained from routing
-		defaultRoutes: defaultRoutes,
-		localNetworks: localNetworks,
+		defaultRoutes:   defaultRoutes,
+		localNetworks:   localNetworks,
+		impl:            impl,
+		customRulesPath: "/iptables/post-rules.txt",
 	}, nil
 }

internal/firewall/flush.go

@@ -0,0 +1,74 @@
+package firewall
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/firewall/iptables"
+	"github.com/qdm12/gluetun/internal/netlink"
+)
+
+func (c *Config) flushExistingConnections(ctx context.Context) error {
+	tries := []struct {
+		name string
+		f    func(ctx context.Context) error
+	}{
+		{name: "flushing conntrack", f: func(_ context.Context) error {
+			return c.netlinker.FlushConntrack()
+		}},
+		{name: "marking and filtering unmarked packets", f: c.impl.AcceptOutputPublicOnlyNewTraffic},
+		{name: "rejecting connections for one second", f: c.rejectOutputTrafficTemporarily},
+		{name: "dropping connections for one second", f: c.dropOutputTrafficTemporarily},
+	}
+	errs := make([]error, 0, len(tries))
+	for i, try := range tries {
+		if i > 0 {
+			c.logger.Debugf("falling back to %s because %s failed: %s", try.name, tries[i-1].name, errs[i-1])
+		}
+		err := try.f(ctx)
+		if err == nil {
+			return nil
+		}
+		err = fmt.Errorf("%s: %w", try.name, err)
+		if !errors.Is(err, iptables.ErrKernelModuleMissing) && !errors.Is(err, netlink.ErrConntrackNetlinkNotSupported) {
+			return err
+		}
+		errs = append(errs, err)
+	}
+	return fmt.Errorf("all tries failed: %v", errs) //nolint:err113
+}
+
+func (c *Config) rejectOutputTrafficTemporarily(ctx context.Context) error {
+	return setupThenRevert(ctx, c.impl.RejectOutputPublicTraffic)
+}
+
+func (c *Config) dropOutputTrafficTemporarily(ctx context.Context) error {
+	return setupThenRevert(ctx, c.impl.DropOutputPublicTraffic)
+}
+
+// setupThenRevert is a helper function to run a setup function that takes a remove boolean argument,
+// and then run the same function with remove set to true after one second or when the context is canceled,
+// whichever comes first.
+func setupThenRevert(ctx context.Context, f func(ctx context.Context, remove bool) error) error {
+	remove := false
+	err := f(ctx, remove)
+	if err != nil {
+		return fmt.Errorf("setting up: %w", err)
+	}
+	timer := time.NewTimer(time.Second)
+	select {
+	case <-timer.C:
+	case <-ctx.Done():
+		timer.Stop()
+	}
+	remove = true
+	// Use [context.Background] to make sure this is removed, even if the context
+	// passed to this function is canceled.
+	err = f(context.Background(), remove)
+	if err != nil {
+		return fmt.Errorf("reverting: %w", err)
+	}
+	return nil
+}

internal/firewall/interfaces.go

@@ -1,6 +1,12 @@
 package firewall
 
-import "os/exec"
+import (
+	"context"
+	"net/netip"
+	"os/exec"
+
+	"github.com/qdm12/gluetun/internal/models"
+)
 
 type CmdRunner interface {
 	Run(cmd *exec.Cmd) (output string, err error)
@@ -8,7 +14,37 @@ type CmdRunner interface {
 
 type Logger interface {
 	Debug(s string)
+	Debugf(format string, args ...any)
 	Info(s string)
 	Warn(s string)
 	Error(s string)
 }
+
+type Netlinker interface {
+	FlushConntrack() error
+}
+
+type firewallImpl interface { //nolint:interfacebloat
+	SaveAndRestore(ctx context.Context) (restore func(context.Context), err error)
+	AcceptOutputPublicOnlyNewTraffic(ctx context.Context) error
+	RejectOutputPublicTraffic(ctx context.Context, remove bool) error
+	DropOutputPublicTraffic(ctx context.Context, remove bool) error
+	AcceptInputThroughInterface(ctx context.Context, intf string) error
+	AcceptEstablishedRelatedTraffic(ctx context.Context) error
+	AcceptInputToPort(ctx context.Context, intf string, port uint16, remove bool) error
+	AcceptInputToSubnet(ctx context.Context, intf string, subnet netip.Prefix) error
+	AcceptIpv6MulticastOutput(ctx context.Context, intf string) error
+	AcceptOutputFromIPToSubnet(ctx context.Context, intf string, assignedIP netip.Addr,
+		subnet netip.Prefix, remove bool) error
+	AcceptOutputThroughInterface(ctx context.Context, intf string, remove bool) error
+	AcceptOutputTrafficToVPN(ctx context.Context, intf string,
+		connection models.Connection, remove bool) error
+	RedirectPort(ctx context.Context, intf string, sourcePort,
+		destinationPort uint16, remove bool) error
+	RunUserPostRules(ctx context.Context, customRulesPath string) error
+	SetIPv4AllPolicies(ctx context.Context, policy string) error
+	SetIPv6AllPolicies(ctx context.Context, policy string) error
+	TempDropOutputTCPRST(ctx context.Context, src, dst netip.AddrPort, excludeMark int) (
+		revert func(ctx context.Context) error, err error)
+	Version(ctx context.Context) (version string, err error)
+}

internal/firewall/iptables.go

@@ -1,331 +0,0 @@
-package firewall
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net/netip"
-	"os"
-	"os/exec"
-	"strings"
-
-	"github.com/qdm12/gluetun/internal/models"
-)
-
-var (
-	ErrIPTablesVersionTooShort = errors.New("iptables version string is too short")
-	ErrPolicyUnknown           = errors.New("unknown policy")
-	ErrNeedIP6Tables           = errors.New("ip6tables is required, please upgrade your kernel to support it")
-)
-
-func appendOrDelete(remove bool) string {
-	if remove {
-		return "--delete"
-	}
-	return "--append"
-}
-
-// flipRule changes an append rule in a delete rule or a delete rule into an
-// append rule.
-func flipRule(rule string) string {
-	switch {
-	case strings.HasPrefix(rule, "-A"):
-		return strings.Replace(rule, "-A", "-D", 1)
-	case strings.HasPrefix(rule, "--append"):
-		return strings.Replace(rule, "--append", "-D", 1)
-	case strings.HasPrefix(rule, "-D"):
-		return strings.Replace(rule, "-D", "-A", 1)
-	case strings.HasPrefix(rule, "--delete"):
-		return strings.Replace(rule, "--delete", "-A", 1)
-	}
-	return rule
-}
-
-// Version obtains the version of the installed iptables.
-func (c *Config) Version(ctx context.Context) (string, error) {
-	cmd := exec.CommandContext(ctx, c.ipTables, "--version") //nolint:gosec
-	output, err := c.runner.Run(cmd)
-	if err != nil {
-		return "", err
-	}
-	words := strings.Fields(output)
-	const minWords = 2
-	if len(words) < minWords {
-		return "", fmt.Errorf("%w: %s", ErrIPTablesVersionTooShort, output)
-	}
-	return words[1], nil
-}
-
-func (c *Config) runIptablesInstructions(ctx context.Context, instructions []string) error {
-	for _, instruction := range instructions {
-		if err := c.runIptablesInstruction(ctx, instruction); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *Config) runIptablesInstruction(ctx context.Context, instruction string) error {
-	c.iptablesMutex.Lock() // only one iptables command at once
-	defer c.iptablesMutex.Unlock()
-
-	if isDeleteMatchInstruction(instruction) {
-		return deleteIPTablesRule(ctx, c.ipTables, instruction,
-			c.runner, c.logger)
-	}
-
-	flags := strings.Fields(instruction)
-	cmd := exec.CommandContext(ctx, c.ipTables, flags...) // #nosec G204
-	c.logger.Debug(cmd.String())
-	if output, err := c.runner.Run(cmd); err != nil {
-		return fmt.Errorf("command failed: \"%s %s\": %s: %w",
-			c.ipTables, instruction, output, err)
-	}
-	return nil
-}
-
-func (c *Config) clearAllRules(ctx context.Context) error {
-	return c.runMixedIptablesInstructions(ctx, []string{
-		"--flush",        // flush all chains
-		"--delete-chain", // delete all chains
-	})
-}
-
-func (c *Config) setIPv4AllPolicies(ctx context.Context, policy string) error {
-	switch policy {
-	case "ACCEPT", "DROP":
-	default:
-		return fmt.Errorf("%w: %s", ErrPolicyUnknown, policy)
-	}
-	return c.runIptablesInstructions(ctx, []string{
-		"--policy INPUT " + policy,
-		"--policy OUTPUT " + policy,
-		"--policy FORWARD " + policy,
-	})
-}
-
-func (c *Config) acceptInputThroughInterface(ctx context.Context, intf string, remove bool) error {
-	return c.runMixedIptablesInstruction(ctx, fmt.Sprintf(
-		"%s INPUT -i %s -j ACCEPT", appendOrDelete(remove), intf,
-	))
-}
-
-func (c *Config) acceptInputToSubnet(ctx context.Context, intf string,
-	destination netip.Prefix, remove bool,
-) error {
-	interfaceFlag := "-i " + intf
-	if intf == "*" { // all interfaces
-		interfaceFlag = ""
-	}
-
-	instruction := fmt.Sprintf("%s INPUT %s -d %s -j ACCEPT",
-		appendOrDelete(remove), interfaceFlag, destination.String())
-
-	if destination.Addr().Is4() {
-		return c.runIptablesInstruction(ctx, instruction)
-	}
-	if c.ip6Tables == "" {
-		return fmt.Errorf("accept input to subnet %s: %w", destination, ErrNeedIP6Tables)
-	}
-	return c.runIP6tablesInstruction(ctx, instruction)
-}
-
-func (c *Config) acceptOutputThroughInterface(ctx context.Context, intf string, remove bool) error {
-	return c.runMixedIptablesInstruction(ctx, fmt.Sprintf(
-		"%s OUTPUT -o %s -j ACCEPT", appendOrDelete(remove), intf,
-	))
-}
-
-func (c *Config) acceptEstablishedRelatedTraffic(ctx context.Context, remove bool) error {
-	return c.runMixedIptablesInstructions(ctx, []string{
-		fmt.Sprintf("%s OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT", appendOrDelete(remove)),
-		fmt.Sprintf("%s INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT", appendOrDelete(remove)),
-	})
-}
-
-func (c *Config) acceptOutputTrafficToVPN(ctx context.Context,
-	defaultInterface string, connection models.Connection, remove bool,
-) error {
-	protocol := connection.Protocol
-	if protocol == "tcp-client" {
-		protocol = "tcp"
-	}
-	instruction := fmt.Sprintf("%s OUTPUT -d %s -o %s -p %s -m %s --dport %d -j ACCEPT",
-		appendOrDelete(remove), connection.IP, defaultInterface, protocol,
-		protocol, connection.Port)
-	if connection.IP.Is4() {
-		return c.runIptablesInstruction(ctx, instruction)
-	} else if c.ip6Tables == "" {
-		return fmt.Errorf("accept output to VPN server: %w", ErrNeedIP6Tables)
-	}
-	return c.runIP6tablesInstruction(ctx, instruction)
-}
-
-// Thanks to @npawelek.
-func (c *Config) acceptOutputFromIPToSubnet(ctx context.Context,
-	intf string, sourceIP netip.Addr, destinationSubnet netip.Prefix, remove bool,
-) error {
-	doIPv4 := sourceIP.Is4() && destinationSubnet.Addr().Is4()
-
-	interfaceFlag := "-o " + intf
-	if intf == "*" { // all interfaces
-		interfaceFlag = ""
-	}
-
-	instruction := fmt.Sprintf("%s OUTPUT %s -s %s -d %s -j ACCEPT",
-		appendOrDelete(remove), interfaceFlag, sourceIP.String(), destinationSubnet.String())
-
-	if doIPv4 {
-		return c.runIptablesInstruction(ctx, instruction)
-	} else if c.ip6Tables == "" {
-		return fmt.Errorf("accept output from %s to %s: %w", sourceIP, destinationSubnet, ErrNeedIP6Tables)
-	}
-	return c.runIP6tablesInstruction(ctx, instruction)
-}
-
-// NDP uses multicast address (theres no broadcast in IPv6 like ARP uses in IPv4).
-func (c *Config) acceptIpv6MulticastOutput(ctx context.Context,
-	intf string, remove bool,
-) error {
-	interfaceFlag := "-o " + intf
-	if intf == "*" { // all interfaces
-		interfaceFlag = ""
-	}
-	instruction := fmt.Sprintf("%s OUTPUT %s -d ff02::1:ff00:0/104 -j ACCEPT",
-		appendOrDelete(remove), interfaceFlag)
-	return c.runIP6tablesInstruction(ctx, instruction)
-}
-
-// Used for port forwarding, with intf set to tun.
-func (c *Config) acceptInputToPort(ctx context.Context, intf string, port uint16, remove bool) error {
-	interfaceFlag := "-i " + intf
-	if intf == "*" { // all interfaces
-		interfaceFlag = ""
-	}
-	return c.runMixedIptablesInstructions(ctx, []string{
-		fmt.Sprintf("%s INPUT %s -p tcp -m tcp --dport %d -j ACCEPT", appendOrDelete(remove), interfaceFlag, port),
-		fmt.Sprintf("%s INPUT %s -p udp -m udp --dport %d -j ACCEPT", appendOrDelete(remove), interfaceFlag, port),
-	})
-}
-
-// Used for VPN server side port forwarding, with intf set to the VPN tunnel interface.
-func (c *Config) redirectPort(ctx context.Context, intf string,
-	sourcePort, destinationPort uint16, remove bool,
-) (err error) {
-	interfaceFlag := "-i " + intf
-	if intf == "*" { // all interfaces
-		interfaceFlag = ""
-	}
-
-	err = c.runIptablesInstructions(ctx, []string{
-		fmt.Sprintf("-t nat %s PREROUTING %s -p tcp --dport %d -j REDIRECT --to-ports %d",
-			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
-		fmt.Sprintf("%s INPUT %s -p tcp -m tcp --dport %d -j ACCEPT",
-			appendOrDelete(remove), interfaceFlag, destinationPort),
-		fmt.Sprintf("-t nat %s PREROUTING %s -p udp --dport %d -j REDIRECT --to-ports %d",
-			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
-		fmt.Sprintf("%s INPUT %s -p udp -m udp --dport %d -j ACCEPT",
-			appendOrDelete(remove), interfaceFlag, destinationPort),
-	})
-	if err != nil {
-		return fmt.Errorf("redirecting IPv4 source port %d to destination port %d on interface %s: %w",
-			sourcePort, destinationPort, intf, err)
-	}
-
-	err = c.runIP6tablesInstructions(ctx, []string{
-		fmt.Sprintf("-t nat %s PREROUTING %s -p tcp --dport %d -j REDIRECT --to-ports %d",
-			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
-		fmt.Sprintf("%s INPUT %s -p tcp -m tcp --dport %d -j ACCEPT",
-			appendOrDelete(remove), interfaceFlag, destinationPort),
-		fmt.Sprintf("-t nat %s PREROUTING %s -p udp --dport %d -j REDIRECT --to-ports %d",
-			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
-		fmt.Sprintf("%s INPUT %s -p udp -m udp --dport %d -j ACCEPT",
-			appendOrDelete(remove), interfaceFlag, destinationPort),
-	})
-	if err != nil {
-		errMessage := err.Error()
-		if strings.Contains(errMessage, "can't initialize ip6tables table `nat': Table does not exist") {
-			if !remove {
-				c.logger.Warn("IPv6 port redirection disabled because your kernel does not support IPv6 NAT: " + errMessage)
-			}
-			return nil
-		}
-		return fmt.Errorf("redirecting IPv6 source port %d to destination port %d on interface %s: %w",
-			sourcePort, destinationPort, intf, err)
-	}
-	return nil
-}
-
-func (c *Config) runUserPostRules(ctx context.Context, filepath string, remove bool) error {
-	file, err := os.OpenFile(filepath, os.O_RDONLY, 0)
-	if os.IsNotExist(err) {
-		return nil
-	} else if err != nil {
-		return err
-	}
-	b, err := io.ReadAll(file)
-	if err != nil {
-		_ = file.Close()
-		return err
-	}
-	if err := file.Close(); err != nil {
-		return err
-	}
-	lines := strings.Split(string(b), "\n")
-	successfulRules := []string{}
-	defer func() {
-		// transaction-like rollback
-		if err == nil || ctx.Err() != nil {
-			return
-		}
-		for _, rule := range successfulRules {
-			_ = c.runIptablesInstruction(ctx, flipRule(rule))
-		}
-	}()
-	for _, line := range lines {
-		var ipv4 bool
-		var rule string
-		switch {
-		case strings.HasPrefix(line, "iptables "):
-			ipv4 = true
-			rule = strings.TrimPrefix(line, "iptables ")
-		case strings.HasPrefix(line, "iptables-nft "):
-			ipv4 = true
-			rule = strings.TrimPrefix(line, "iptables-nft ")
-		case strings.HasPrefix(line, "iptables-legacy "):
-			ipv4 = true
-			rule = strings.TrimPrefix(line, "iptables-legacy ")
-		case strings.HasPrefix(line, "ip6tables "):
-			ipv4 = false
-			rule = strings.TrimPrefix(line, "ip6tables ")
-		case strings.HasPrefix(line, "ip6tables-nft "):
-			ipv4 = false
-			rule = strings.TrimPrefix(line, "ip6tables-nft ")
-		case strings.HasPrefix(line, "ip6tables-legacy "):
-			ipv4 = false
-			rule = strings.TrimPrefix(line, "ip6tables-legacy ")
-		default:
-			continue
-		}
-
-		if remove {
-			rule = flipRule(rule)
-		}
-
-		switch {
-		case ipv4:
-			err = c.runIptablesInstruction(ctx, rule)
-		case c.ip6Tables == "":
-			err = fmt.Errorf("running user ip6tables rule: %w", ErrNeedIP6Tables)
-		default: // ipv6
-			err = c.runIP6tablesInstruction(ctx, rule)
-		}
-		if err != nil {
-			return err
-		}
-
-		successfulRules = append(successfulRules, rule)
-	}
-	return nil
-}

internal/firewall/iptables/atomic.go

@@ -0,0 +1,85 @@
+package iptables
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// SaveAndRestore saves the current iptables and ip6tables rules and
+// returns a restore function that can be called to restore the saved rules.
+func (c *Config) SaveAndRestore(ctx context.Context) (restore func(context.Context), err error) {
+	c.iptablesMutex.Lock()
+	c.ip6tablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+	defer c.ip6tablesMutex.Unlock()
+
+	return c.saveAndRestore(ctx)
+}
+
+// callers MUST always lock both the [Config] iptablesMutex and the ip6tablesMutex
+// before calling this function. Note the restore function does not interact with mutexes
+// so the caller must make sure the mutexes are locked when calling the restore function.
+func (c *Config) saveAndRestore(ctx context.Context) (restore func(context.Context), err error) {
+	restoreIPv4, err := c.saveAndRestoreIPv4(ctx)
+	if err != nil {
+		return nil, err
+	}
+	restoreIPv6, err := c.saveAndRestoreIPv6(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	restore = func(ctx context.Context) {
+		restoreIPv4(ctx)
+		if restoreIPv6 != nil {
+			restoreIPv6(ctx)
+		}
+	}
+	return restore, nil
+}
+
+// Callers of saveAndRestoreIPv4 MUST always lock the [Config] iptablesMutex
+// before calling this function.
+func (c *Config) saveAndRestoreIPv4(ctx context.Context) (restore func(context.Context), err error) {
+	cmd := exec.CommandContext(ctx, c.ipTables+"-save") //nolint:gosec
+	data, err := c.runner.Run(cmd)
+	if err != nil {
+		return nil, fmt.Errorf("saving IPv4 iptables: %w", err)
+	}
+
+	restore = func(ctx context.Context) {
+		cmd := exec.CommandContext(ctx, c.ipTables+"-restore") //nolint:gosec
+		cmd.Stdin = strings.NewReader(data)
+		output, err := c.runner.Run(cmd)
+		if err != nil {
+			c.logger.Warn(fmt.Sprintf("restoring IPv4 iptables failed: %v: %s", err, output))
+		}
+	}
+	return restore, nil
+}
+
+// Callers of saveAndRestoreIPv6 MUST always lock the [Config] ip6tablesMutex
+// before calling this function.
+func (c *Config) saveAndRestoreIPv6(ctx context.Context) (restore func(context.Context), err error) {
+	if c.ip6Tables == "" {
+		return nil, nil //nolint:nilnil
+	}
+
+	cmd := exec.CommandContext(ctx, c.ip6Tables+"-save") //nolint:gosec
+	data, err := c.runner.Run(cmd)
+	if err != nil {
+		return nil, fmt.Errorf("saving IPv6 iptables: %w", err)
+	}
+
+	restore = func(ctx context.Context) {
+		cmd = exec.CommandContext(ctx, c.ip6Tables+"-restore") //nolint:gosec
+		cmd.Stdin = strings.NewReader(data)
+		output, err := c.runner.Run(cmd)
+		if err != nil {
+			c.logger.Warn(fmt.Sprintf("restoring IPv6 iptables failed: %v: %s", err, output))
+		}
+	}
+	return restore, nil
+}

internal/firewall/iptables/cmd_matcher_test.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"fmt"

internal/firewall/iptables/delete.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"context"

internal/firewall/iptables/delete_test.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"context"
@@ -69,8 +69,8 @@ func Test_deleteIPTablesRule(t *testing.T) {
 		"invalid_instruction": {
 			instruction: "invalid",
 			errWrapped:  ErrIptablesCommandMalformed,
-			errMessage: "parsing iptables command: iptables command is malformed: " +
-				"fields count 1 is not even: \"invalid\"",
+			errMessage: "parsing iptables command: parsing \"invalid\": " +
+				"iptables command is malformed: flag \"invalid\" requires a value, but got none",
 		},
 		"list_error": {
 			instruction: "-t nat --delete PREROUTING -i tun0 -p tcp --dport 43716 -j REDIRECT --to-ports 5678",

internal/firewall/iptables/firewall.go

@@ -0,0 +1,39 @@
+package iptables
+
+import (
+	"context"
+	"errors"
+	"sync"
+)
+
+var ErrKernelModuleMissing = errors.New("kernel module is missing for this operation")
+
+type Config struct {
+	runner         CmdRunner
+	logger         Logger
+	iptablesMutex  sync.Mutex
+	ip6tablesMutex sync.Mutex
+
+	// Fixed state
+	ipTables  string
+	ip6Tables string
+}
+
+func New(ctx context.Context, runner CmdRunner, logger Logger) (*Config, error) {
+	iptables, err := checkIptablesSupport(ctx, runner, "iptables", "iptables-nft", "iptables-legacy")
+	if err != nil {
+		return nil, err
+	}
+
+	ip6tables, err := findIP6tablesSupported(ctx, runner)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Config{
+		runner:    runner,
+		logger:    logger,
+		ipTables:  iptables,
+		ip6Tables: ip6tables,
+	}, nil
+}

internal/firewall/iptables/interfaces.go

@@ -0,0 +1,14 @@
+package iptables
+
+import "os/exec"
+
+type CmdRunner interface {
+	Run(cmd *exec.Cmd) (output string, err error)
+}
+
+type Logger interface {
+	Debug(s string)
+	Info(s string)
+	Warn(s string)
+	Error(s string)
+}

internal/firewall/iptables/ip6tables.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"context"
@@ -14,8 +14,8 @@ import (
 func findIP6tablesSupported(ctx context.Context, runner CmdRunner) (
 	ip6tablesPath string, err error,
 ) {
-	ip6tablesPath, err = checkIptablesSupport(ctx, runner, "ip6tables", "ip6tables-nft", "ip6tables-legacy")
-	if errors.Is(err, ErrIPTablesNotSupported) {
+	ip6tablesPath, err = checkIptablesSupport(ctx, runner, "ip6tables", "ip6tables-legacy")
+	if errors.Is(err, ErrNotSupported) {
 		return "", nil
 	} else if err != nil {
 		return "", err
@@ -24,8 +24,23 @@ func findIP6tablesSupported(ctx context.Context, runner CmdRunner) (
 }
 
 func (c *Config) runIP6tablesInstructions(ctx context.Context, instructions []string) error {
+	c.ip6tablesMutex.Lock() // only one ip6tables command at once
+	defer c.ip6tablesMutex.Unlock()
+
+	restore, err := c.saveAndRestoreIPv6(ctx)
+	if err != nil {
+		return err
+	}
+	err = c.runIP6tablesInstructionsNoSave(ctx, instructions)
+	if err != nil {
+		restore(ctx)
+	}
+	return err
+}
+
+func (c *Config) runIP6tablesInstructionsNoSave(ctx context.Context, instructions []string) error {
 	for _, instruction := range instructions {
-		if err := c.runIP6tablesInstruction(ctx, instruction); err != nil {
+		if err := c.runIP6tablesInstructionNoSave(ctx, instruction); err != nil {
 			return err
 		}
 	}
@@ -33,11 +48,24 @@ func (c *Config) runIP6tablesInstructions(ctx context.Context, instructions []st
 }
 
 func (c *Config) runIP6tablesInstruction(ctx context.Context, instruction string) error {
+	c.ip6tablesMutex.Lock() // only one ip6tables command at once
+	defer c.ip6tablesMutex.Unlock()
+
+	restore, err := c.saveAndRestoreIPv6(ctx)
+	if err != nil {
+		return err
+	}
+	err = c.runIP6tablesInstructionNoSave(ctx, instruction)
+	if err != nil {
+		restore(ctx)
+	}
+	return err
+}
+
+func (c *Config) runIP6tablesInstructionNoSave(ctx context.Context, instruction string) error {
 	if c.ip6Tables == "" {
 		return nil
 	}
-	c.ip6tablesMutex.Lock() // only one ip6tables command at once
-	defer c.ip6tablesMutex.Unlock()
 
 	if isDeleteMatchInstruction(instruction) {
 		return deleteIPTablesRule(ctx, c.ip6Tables, instruction,
@@ -48,6 +76,9 @@ func (c *Config) runIP6tablesInstruction(ctx context.Context, instruction string
 	cmd := exec.CommandContext(ctx, c.ip6Tables, flags...) // #nosec G204
 	c.logger.Debug(cmd.String())
 	if output, err := c.runner.Run(cmd); err != nil {
+		if strings.Contains(output, "missing kernel module") {
+			err = ErrKernelModuleMissing
+		}
 		return fmt.Errorf("command failed: \"%s %s\": %s: %w",
 			c.ip6Tables, instruction, output, err)
 	}
@@ -56,7 +87,7 @@ func (c *Config) runIP6tablesInstruction(ctx context.Context, instruction string
 
 var ErrPolicyNotValid = errors.New("policy is not valid")
 
-func (c *Config) setIPv6AllPolicies(ctx context.Context, policy string) error {
+func (c *Config) SetIPv6AllPolicies(ctx context.Context, policy string) error {
 	switch policy {
 	case "ACCEPT", "DROP":
 	default:

internal/firewall/iptables/iptables.go

@@ -0,0 +1,485 @@
+package iptables
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/netip"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/qdm12/gluetun/internal/models"
+)
+
+var (
+	ErrIPTablesVersionTooShort = errors.New("iptables version string is too short")
+	ErrPolicyUnknown           = errors.New("unknown policy")
+	ErrNeedIP6Tables           = errors.New("ip6tables is required, please upgrade your kernel to support it")
+)
+
+func appendOrDelete(remove bool) string {
+	if remove {
+		return "--delete"
+	}
+	return "--append"
+}
+
+// Version obtains the version of the installed iptables.
+func (c *Config) Version(ctx context.Context) (string, error) {
+	cmd := exec.CommandContext(ctx, c.ipTables, "--version") //nolint:gosec
+	output, err := c.runner.Run(cmd)
+	if err != nil {
+		return "", err
+	}
+	words := strings.Fields(output)
+	const minWords = 2
+	if len(words) < minWords {
+		return "", fmt.Errorf("%w: %s", ErrIPTablesVersionTooShort, output)
+	}
+	return "iptables " + words[1], nil
+}
+
+func (c *Config) runIptablesInstructions(ctx context.Context, instructions []string) error {
+	c.iptablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+
+	restore, err := c.saveAndRestoreIPv4(ctx)
+	if err != nil {
+		return err
+	}
+
+	err = c.runIptablesInstructionsNoSave(ctx, instructions)
+	if err != nil {
+		restore(ctx)
+	}
+	return err
+}
+
+func (c *Config) runIptablesInstructionsNoSave(ctx context.Context, instructions []string) error {
+	for _, instruction := range instructions {
+		if err := c.runIptablesInstructionNoSave(ctx, instruction); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *Config) runIptablesInstruction(ctx context.Context, instruction string) error {
+	c.iptablesMutex.Lock() // only one iptables command at once
+	defer c.iptablesMutex.Unlock()
+
+	restore, err := c.saveAndRestoreIPv4(ctx)
+	if err != nil {
+		return err
+	}
+
+	err = c.runIptablesInstructionNoSave(ctx, instruction)
+	if err != nil {
+		restore(ctx)
+	}
+	return err
+}
+
+func (c *Config) runIptablesInstructionNoSave(ctx context.Context, instruction string) error {
+	if isDeleteMatchInstruction(instruction) {
+		return deleteIPTablesRule(ctx, c.ipTables, instruction,
+			c.runner, c.logger)
+	}
+
+	flags := strings.Fields(instruction)
+	cmd := exec.CommandContext(ctx, c.ipTables, flags...) // #nosec G204
+	c.logger.Debug(cmd.String())
+	if output, err := c.runner.Run(cmd); err != nil {
+		if strings.Contains(output, "missing kernel module") {
+			err = ErrKernelModuleMissing
+		}
+		return fmt.Errorf("command failed: \"%s %s\": %s: %w",
+			c.ipTables, instruction, output, err)
+	}
+	return nil
+}
+
+func (c *Config) SetIPv4AllPolicies(ctx context.Context, policy string) error {
+	switch policy {
+	case "ACCEPT", "DROP":
+	default:
+		return fmt.Errorf("%w: %s", ErrPolicyUnknown, policy)
+	}
+	return c.runIptablesInstructions(ctx, []string{
+		"--policy INPUT " + policy,
+		"--policy OUTPUT " + policy,
+		"--policy FORWARD " + policy,
+	})
+}
+
+func (c *Config) AcceptInputThroughInterface(ctx context.Context, intf string) error {
+	return c.runMixedIptablesInstruction(ctx, fmt.Sprintf(
+		"--append INPUT -i %s -j ACCEPT", intf))
+}
+
+func (c *Config) AcceptInputToSubnet(ctx context.Context, intf string, destination netip.Prefix) error {
+	interfaceFlag := "-i " + intf
+	if intf == "*" { // all interfaces
+		interfaceFlag = ""
+	}
+
+	instruction := fmt.Sprintf("--append INPUT %s -d %s -j ACCEPT",
+		interfaceFlag, destination.String())
+
+	if destination.Addr().Is4() {
+		return c.runIptablesInstruction(ctx, instruction)
+	}
+	if c.ip6Tables == "" {
+		return fmt.Errorf("accept input to subnet %s: %w", destination, ErrNeedIP6Tables)
+	}
+	return c.runIP6tablesInstruction(ctx, instruction)
+}
+
+func (c *Config) AcceptOutputThroughInterface(ctx context.Context, intf string, remove bool) error {
+	return c.runMixedIptablesInstruction(ctx, fmt.Sprintf(
+		"%s OUTPUT -o %s -j ACCEPT", appendOrDelete(remove), intf,
+	))
+}
+
+func (c *Config) AcceptEstablishedRelatedTraffic(ctx context.Context) error {
+	return c.runMixedIptablesInstructions(ctx, []string{
+		"--append OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT",
+		"--append INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT",
+	})
+}
+
+// AcceptOutputPublicOnlyNewTraffic adds rules to mark new output connections, and to accept
+// established or related packets with this mark only. This effectively forces
+// previously established or related traffic to be blocked.
+// If remove is true, the rules are removed instead of appended.
+// If the relevant kernel modules are not available, it returns an error indicating
+// which kernel module is missing.
+func (c *Config) AcceptOutputPublicOnlyNewTraffic(ctx context.Context) error {
+	ipv4Instructions, ipv6Instructions := makeCreatePublicIPChainInstructions()
+	appendToBoth := func(instruction string) {
+		ipv4Instructions = append(ipv4Instructions, instruction)
+		ipv6Instructions = append(ipv6Instructions, instruction)
+	}
+
+	// Mark new connections with mark 0x567
+	appendToBoth("-A PUBLIC_ONLY -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x567")
+	// Drop related/established connections that made it through; marked connections would
+	// be directly accepted by the first rule in the OUTPUT chain (see below)
+	appendToBoth("-A PUBLIC_ONLY -m conntrack --ctstate RELATED,ESTABLISHED -j DROP")
+	// Set the PUBLIC_ONLY chain as the second rule in the OUTPUT chain, so that it is evaluated
+	// after the accept rule below, for performance reasons.
+	appendToBoth("-I OUTPUT -j PUBLIC_ONLY")
+	appendToBoth("-I OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -m connmark --mark 0x567 -j ACCEPT")
+
+	c.iptablesMutex.Lock()
+	c.ip6tablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+	defer c.ip6tablesMutex.Unlock()
+
+	restore, err := c.saveAndRestore(ctx)
+	if err != nil {
+		return err
+	}
+
+	err = c.runIptablesInstructionsNoSave(ctx, ipv4Instructions)
+	if err != nil {
+		restore(ctx)
+		return err
+	}
+	err = c.runIP6tablesInstructionsNoSave(ctx, ipv6Instructions)
+	if err != nil {
+		restore(ctx)
+		return err
+	}
+
+	return nil
+}
+
+func (c *Config) RejectOutputPublicTraffic(ctx context.Context, remove bool) error {
+	return c.targetOutputPublicTraffic(ctx, "REJECT", remove)
+}
+
+func (c *Config) DropOutputPublicTraffic(ctx context.Context, remove bool) error {
+	return c.targetOutputPublicTraffic(ctx, "DROP", remove)
+}
+
+func (c *Config) targetOutputPublicTraffic(ctx context.Context, target string, remove bool) error {
+	removeInstructions := []string{
+		"-D OUTPUT -j PUBLIC_ONLY",
+		"-F PUBLIC_ONLY",
+		"-X PUBLIC_ONLY",
+	}
+	if remove {
+		return c.runMixedIptablesInstructions(ctx, removeInstructions)
+	}
+
+	ipv4Instructions, ipv6Instructions := makeCreatePublicIPChainInstructions()
+	appendToBoth := func(instruction string) {
+		ipv4Instructions = append(ipv4Instructions, instruction)
+		ipv6Instructions = append(ipv6Instructions, instruction)
+	}
+
+	if target == "REJECT" {
+		// Block TCP by sending back TCP RST packets.
+		appendToBoth("-A PUBLIC_ONLY -p tcp -m conntrack --ctstate RELATED,ESTABLISHED " +
+			"-j REJECT --reject-with tcp-reset")
+		// Block UDP and ICMP, sending back ICMP port unreachable.
+		appendToBoth("-A PUBLIC_ONLY -m conntrack --ctstate RELATED,ESTABLISHED -j REJECT")
+	} else {
+		appendToBoth("-A PUBLIC_ONLY -m conntrack --ctstate RELATED,ESTABLISHED -j " + target)
+	}
+	appendToBoth("-I OUTPUT -j PUBLIC_ONLY")
+
+	err := c.runIptablesInstructions(ctx, ipv4Instructions)
+	if err != nil {
+		if strings.Contains(err.Error(), " support") {
+			return fmt.Errorf("%w: %w", ErrKernelModuleMissing, err)
+		}
+	}
+
+	err = c.runIP6tablesInstructions(ctx, ipv6Instructions)
+	if err != nil {
+		_ = c.runIptablesInstructions(ctx, removeInstructions)
+		if strings.Contains(err.Error(), " support") {
+			return fmt.Errorf("%w: %w", ErrKernelModuleMissing, err)
+		}
+		return err
+	}
+
+	return nil
+}
+
+func makeCreatePublicIPChainInstructions() (ipv4Instructions, ipv6Instructions []string) {
+	ipv4PrivatePrefixes := []netip.Prefix{
+		netip.MustParsePrefix("10.0.0.0/8"),
+		netip.MustParsePrefix("172.16.0.0/12"),
+		netip.MustParsePrefix("192.168.0.0/16"),
+		netip.MustParsePrefix("127.0.0.0/8"),
+	}
+	ipv6PrivatePrefixes := []netip.Prefix{
+		netip.MustParsePrefix("fc00::/7"),
+		netip.MustParsePrefix("fe80::/10"),
+		netip.MustParsePrefix("::1/128"),
+	}
+
+	ipv4Instructions = append(ipv4Instructions, "-N PUBLIC_ONLY")
+	ipv6Instructions = append(ipv6Instructions, "-N PUBLIC_ONLY")
+
+	for _, prefix := range ipv4PrivatePrefixes {
+		ipv4Instructions = append(ipv4Instructions, fmt.Sprintf(
+			"-A PUBLIC_ONLY -d %s -j RETURN", prefix))
+	}
+
+	for _, prefix := range ipv6PrivatePrefixes {
+		ipv6Instructions = append(ipv6Instructions, fmt.Sprintf(
+			"-A PUBLIC_ONLY -d %s -j RETURN", prefix))
+	}
+
+	return ipv4Instructions, ipv6Instructions
+}
+
+func (c *Config) AcceptOutputTrafficToVPN(ctx context.Context,
+	defaultInterface string, connection models.Connection, remove bool,
+) error {
+	protocol := connection.Protocol
+	if protocol == "tcp-client" {
+		protocol = "tcp"
+	}
+	instruction := fmt.Sprintf("%s OUTPUT -d %s -o %s -p %s -m %s --dport %d -j ACCEPT",
+		appendOrDelete(remove), connection.IP, defaultInterface, protocol,
+		protocol, connection.Port)
+	if connection.IP.Is4() {
+		return c.runIptablesInstruction(ctx, instruction)
+	} else if c.ip6Tables == "" {
+		return fmt.Errorf("accept output to VPN server: %w", ErrNeedIP6Tables)
+	}
+	return c.runIP6tablesInstruction(ctx, instruction)
+}
+
+// AcceptOutputFromIPToSubnet accepts outgoing traffic from sourceIP to destinationSubnet
+// on the interface intf. If intf is empty, it is set to "*" which means all interfaces.
+// If remove is true, the rule is removed instead of added.
+// Thanks to @npawelek.
+func (c *Config) AcceptOutputFromIPToSubnet(ctx context.Context,
+	intf string, sourceIP netip.Addr, destinationSubnet netip.Prefix, remove bool,
+) error {
+	doIPv4 := sourceIP.Is4() && destinationSubnet.Addr().Is4()
+
+	interfaceFlag := "-o " + intf
+	if intf == "*" { // all interfaces
+		interfaceFlag = ""
+	}
+
+	instruction := fmt.Sprintf("%s OUTPUT %s -s %s -d %s -j ACCEPT",
+		appendOrDelete(remove), interfaceFlag, sourceIP.String(), destinationSubnet.String())
+
+	if doIPv4 {
+		return c.runIptablesInstruction(ctx, instruction)
+	} else if c.ip6Tables == "" {
+		return fmt.Errorf("accept output from %s to %s: %w", sourceIP, destinationSubnet, ErrNeedIP6Tables)
+	}
+	return c.runIP6tablesInstruction(ctx, instruction)
+}
+
+// AcceptIpv6MulticastOutput accepts outgoing traffic to the IPv6 multicast address
+// ff02::1:ff00:0/104, which is used for NDP (Neighbor Discovery Protocol) to resolve
+// IPv6 addresses to MAC addresses. If intf is empty, it is set to "*" which means
+// all interfaces. If remove is true, the rule is removed instead of added.
+func (c *Config) AcceptIpv6MulticastOutput(ctx context.Context, intf string) error {
+	interfaceFlag := "-o " + intf
+	if intf == "*" { // all interfaces
+		interfaceFlag = ""
+	}
+	instruction := fmt.Sprintf("--append OUTPUT %s -d ff02::1:ff00:0/104 -j ACCEPT", interfaceFlag)
+	return c.runIP6tablesInstruction(ctx, instruction)
+}
+
+// AcceptInputToPort accepts incoming traffic on the specified port, for both TCP and UDP
+// protocols, on the interface intf. If intf is empty, it is set to "*" which means all interfaces.
+// If remove is true, the rule is removed instead of added. This is used for port forwarding, with
+// intf set to the VPN tunnel interface.
+func (c *Config) AcceptInputToPort(ctx context.Context, intf string, port uint16, remove bool) error {
+	interfaceFlag := "-i " + intf
+	if intf == "*" { // all interfaces
+		interfaceFlag = ""
+	}
+	return c.runMixedIptablesInstructions(ctx, []string{
+		fmt.Sprintf("%s INPUT %s -p tcp -m tcp --dport %d -j ACCEPT", appendOrDelete(remove), interfaceFlag, port),
+		fmt.Sprintf("%s INPUT %s -p udp -m udp --dport %d -j ACCEPT", appendOrDelete(remove), interfaceFlag, port),
+	})
+}
+
+// RedirectPort redirects incoming traffic on the specified source port to the
+// specified destination port, for both TCP and UDP protocols, on the interface intf.
+// If intf is empty, it is set to "*" which means all interfaces. If remove is true,
+// the redirection is removed instead of added. This is used for VPN server side
+// port forwarding, with intf set to the VPN tunnel interface.
+func (c *Config) RedirectPort(ctx context.Context, intf string,
+	sourcePort, destinationPort uint16, remove bool,
+) (err error) {
+	interfaceFlag := "-i " + intf
+	if intf == "*" { // all interfaces
+		interfaceFlag = ""
+	}
+
+	c.iptablesMutex.Lock()
+	c.ip6tablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+	defer c.ip6tablesMutex.Unlock()
+
+	restore, err := c.saveAndRestore(ctx)
+	if err != nil {
+		return err
+	}
+
+	err = c.runIptablesInstructionsNoSave(ctx, []string{
+		fmt.Sprintf("-t nat %s PREROUTING %s -p tcp --dport %d -j REDIRECT --to-ports %d",
+			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
+		fmt.Sprintf("%s INPUT %s -p tcp -m tcp --dport %d -j ACCEPT",
+			appendOrDelete(remove), interfaceFlag, destinationPort),
+		fmt.Sprintf("-t nat %s PREROUTING %s -p udp --dport %d -j REDIRECT --to-ports %d",
+			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
+		fmt.Sprintf("%s INPUT %s -p udp -m udp --dport %d -j ACCEPT",
+			appendOrDelete(remove), interfaceFlag, destinationPort),
+	})
+	if err != nil {
+		restore(ctx)
+		return fmt.Errorf("redirecting IPv4 source port %d to destination port %d on interface %s: %w",
+			sourcePort, destinationPort, intf, err)
+	}
+
+	err = c.runIP6tablesInstructionsNoSave(ctx, []string{
+		fmt.Sprintf("-t nat %s PREROUTING %s -p tcp --dport %d -j REDIRECT --to-ports %d",
+			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
+		fmt.Sprintf("%s INPUT %s -p tcp -m tcp --dport %d -j ACCEPT",
+			appendOrDelete(remove), interfaceFlag, destinationPort),
+		fmt.Sprintf("-t nat %s PREROUTING %s -p udp --dport %d -j REDIRECT --to-ports %d",
+			appendOrDelete(remove), interfaceFlag, sourcePort, destinationPort),
+		fmt.Sprintf("%s INPUT %s -p udp -m udp --dport %d -j ACCEPT",
+			appendOrDelete(remove), interfaceFlag, destinationPort),
+	})
+	if err != nil {
+		restore(ctx) // just in case
+		errMessage := err.Error()
+		if strings.Contains(errMessage, "can't initialize ip6tables table `nat': Table does not exist") {
+			if !remove {
+				c.logger.Warn("IPv6 port redirection disabled because your kernel does not support IPv6 NAT: " + errMessage)
+			}
+			return nil
+		}
+		return fmt.Errorf("redirecting IPv6 source port %d to destination port %d on interface %s: %w",
+			sourcePort, destinationPort, intf, err)
+	}
+	return nil
+}
+
+func (c *Config) RunUserPostRules(ctx context.Context, filepath string) error {
+	file, err := os.OpenFile(filepath, os.O_RDONLY, 0)
+	if os.IsNotExist(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	b, err := io.ReadAll(file)
+	if err != nil {
+		_ = file.Close()
+		return err
+	}
+	if err := file.Close(); err != nil {
+		return err
+	}
+	lines := strings.Split(string(b), "\n")
+
+	c.iptablesMutex.Lock()
+	c.ip6tablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+	defer c.ip6tablesMutex.Unlock()
+
+	restore, err := c.saveAndRestore(ctx)
+	if err != nil {
+		return err
+	}
+
+	for _, line := range lines {
+		var ipv4 bool
+		var rule string
+		switch {
+		case strings.HasPrefix(line, "iptables "):
+			ipv4 = true
+			rule = strings.TrimPrefix(line, "iptables ")
+		case strings.HasPrefix(line, "iptables-nft "):
+			ipv4 = true
+			rule = strings.TrimPrefix(line, "iptables-nft ")
+		case strings.HasPrefix(line, "iptables-legacy "):
+			ipv4 = true
+			rule = strings.TrimPrefix(line, "iptables-legacy ")
+		case strings.HasPrefix(line, "ip6tables "):
+			ipv4 = false
+			rule = strings.TrimPrefix(line, "ip6tables ")
+		case strings.HasPrefix(line, "ip6tables-nft "):
+			ipv4 = false
+			rule = strings.TrimPrefix(line, "ip6tables-nft ")
+		case strings.HasPrefix(line, "ip6tables-legacy "):
+			ipv4 = false
+			rule = strings.TrimPrefix(line, "ip6tables-legacy ")
+		default:
+			continue
+		}
+
+		switch {
+		case ipv4:
+			err = c.runIptablesInstruction(ctx, rule)
+		case c.ip6Tables == "":
+			err = fmt.Errorf("running user ip6tables rule: %w", ErrNeedIP6Tables)
+		default: // ipv6
+			err = c.runIP6tablesInstruction(ctx, rule)
+		}
+		if err != nil {
+			restore(ctx)
+			return err
+		}
+	}
+	return nil
+}

internal/firewall/iptables/iptablesmix.go

@@ -0,0 +1,49 @@
+package iptables
+
+import (
+	"context"
+)
+
+func (c *Config) runMixedIptablesInstructions(ctx context.Context, instructions []string) error {
+	c.iptablesMutex.Lock()
+	c.ip6tablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+	defer c.ip6tablesMutex.Unlock()
+
+	restore, err := c.saveAndRestore(ctx)
+	if err != nil {
+		return err
+	}
+
+	for _, instruction := range instructions {
+		if err := c.runMixedIptablesInstructionNoSave(ctx, instruction); err != nil {
+			restore(ctx)
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *Config) runMixedIptablesInstruction(ctx context.Context, instruction string) error {
+	c.iptablesMutex.Lock()
+	c.ip6tablesMutex.Lock()
+	defer c.iptablesMutex.Unlock()
+	defer c.ip6tablesMutex.Unlock()
+
+	restore, err := c.saveAndRestore(ctx)
+	if err != nil {
+		return err
+	}
+	err = c.runIptablesInstructionNoSave(ctx, instruction)
+	if err != nil {
+		restore(ctx)
+	}
+	return err
+}
+
+func (c *Config) runMixedIptablesInstructionNoSave(ctx context.Context, instruction string) error {
+	if err := c.runIptablesInstructionNoSave(ctx, instruction); err != nil {
+		return err
+	}
+	return c.runIP6tablesInstructionNoSave(ctx, instruction)
+}

internal/firewall/iptables/list.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"errors"
@@ -26,10 +26,21 @@ type chainRule struct {
 	inputInterface  string       // input interface, for example "tun0" or "*""
 	outputInterface string       // output interface, for example "eth0" or "*""
 	source          netip.Prefix // source IP CIDR, for example 0.0.0.0/0. Must be valid.
+	sourcePort      uint16       // Not specified if set to zero.
 	destination     netip.Prefix // destination IP CIDR, for example 0.0.0.0/0. Must be valid.
 	destinationPort uint16       // Not specified if set to zero.
 	redirPorts      []uint16     // Not specified if empty.
 	ctstate         []string     // for example ["RELATED","ESTABLISHED"]. Can be empty.
+	tcpFlags        tcpFlags
+	mark            mark
+	connMark        mark
+	setMark         uint
+	rejectWith      string // for example "tcp-reset", only used for REJECT targets
+}
+
+type mark struct {
+	invert bool
+	value  uint
 }
 
 var ErrChainListMalformed = errors.New("iptables chain list output is malformed")
@@ -211,10 +222,6 @@ func parseChainRuleField(fieldIndex int, field string, rule *chainRule) (err err
 			return fmt.Errorf("parsing bytes: %w", err)
 		}
 	case targetIndex:
-		err = checkTarget(field)
-		if err != nil {
-			return fmt.Errorf("checking target: %w", err)
-		}
 		rule.target = field
 	case protocolIndex:
 		rule.protocol, err = parseProtocol(field)
@@ -241,19 +248,23 @@ func parseChainRuleField(fieldIndex int, field string, rule *chainRule) (err err
 }
 
 func parseChainRuleOptionalFields(optionalFields []string, rule *chainRule) (err error) {
-	for i := 0; i < len(optionalFields); i++ {
-		key := optionalFields[i]
-		switch key {
-		case "tcp", "udp":
+	i := 0
+	for i < len(optionalFields) {
+		switch optionalFields[i] {
+		case "udp":
 			i++
-			value := optionalFields[i]
-			value = strings.TrimPrefix(value, "dpt:")
-			const base, bitLength = 10, 16
-			destinationPort, err := strconv.ParseUint(value, base, bitLength)
+			consumed, err := parseUDPOptional(optionalFields[i:], rule)
 			if err != nil {
-				return fmt.Errorf("parsing destination port %q: %w", value, err)
+				return fmt.Errorf("parsing UDP optional fields: %w", err)
 			}
-			rule.destinationPort = uint16(destinationPort)
+			i += consumed
+		case "tcp":
+			i++
+			consumed, err := parseTCPOptional(optionalFields[i:], rule)
+			if err != nil {
+				return fmt.Errorf("parsing TCP optional fields: %w", err)
+			}
+			i += consumed
 		case "redir":
 			i++
 			switch optionalFields[i] {
@@ -264,20 +275,163 @@ func parseChainRuleOptionalFields(optionalFields []string, rule *chainRule) (err
 					return fmt.Errorf("parsing redirection ports: %w", err)
 				}
 				rule.redirPorts = ports
+				i++
 			default:
-				return fmt.Errorf("%w: unexpected optional field: %s",
-					ErrChainRuleMalformed, optionalFields[i])
+				return fmt.Errorf("%w: unexpected %q after redir",
+					ErrChainRuleMalformed, optionalFields[1])
 			}
 		case "ctstate":
 			i++
 			rule.ctstate = strings.Split(optionalFields[i], ",")
+			i++
+		case "mark":
+			i++
+			mark, consumed, err := parseMark(optionalFields[i:])
+			if err != nil {
+				return fmt.Errorf("parsing mark: %w", err)
+			}
+			rule.mark = mark
+			i += consumed
+		case "reject-with":
+			i++
+			rule.rejectWith = optionalFields[i] // for example "tcp-reset"
+			i++
+		case "connmark":
+			i++
+			connMark, consumed, err := parseMark(optionalFields[i:])
+			if err != nil {
+				return fmt.Errorf("parsing connmark: %w", err)
+			}
+			rule.connMark = connMark
+			i += consumed
+		case "CONNMARK":
+			i++
+			switch optionalFields[i] {
+			case "set":
+				i++
+				value, err := parseAny32bNumber(optionalFields[i])
+				if err != nil {
+					return fmt.Errorf("parsing CONNMARK set value: %w", err)
+				}
+				rule.setMark = value
+				i++
+			default:
+				return fmt.Errorf("%w: unexpected %q after CONNMARK",
+					ErrChainRuleMalformed, optionalFields[i])
+			}
 		default:
-			return fmt.Errorf("%w: unexpected optional field: %s", ErrChainRuleMalformed, key)
+			return fmt.Errorf("%w: unexpected optional field: %s",
+				ErrChainRuleMalformed, optionalFields[i])
 		}
 	}
 	return nil
 }
 
+var errUDPOptionalUnknown = errors.New("unknown UDP optional field")
+
+func parseUDPOptional(optionalFields []string, rule *chainRule) (consumed int, err error) {
+	for _, value := range optionalFields {
+		if !strings.ContainsRune(value, ':') {
+			// no longer a UDP-associated option
+			return consumed, nil
+		}
+		switch {
+		case strings.HasPrefix(value, "dpt:"):
+			rule.destinationPort, err = parseDestinationPort(value)
+			if err != nil {
+				return 0, fmt.Errorf("parsing destination port: %w", err)
+			}
+			consumed++
+		case strings.HasPrefix(value, "spt:"):
+			rule.sourcePort, err = parseSourcePort(value)
+			if err != nil {
+				return 0, fmt.Errorf("parsing source port: %w", err)
+			}
+			consumed++
+		default:
+			return 0, fmt.Errorf("%w: %s", errUDPOptionalUnknown, value)
+		}
+	}
+	return consumed, nil
+}
+
+var errTCPOptionalUnknown = errors.New("unknown TCP optional field")
+
+func parseTCPOptional(optionalFields []string, rule *chainRule) (consumed int, err error) {
+	for _, value := range optionalFields {
+		if !strings.ContainsRune(value, ':') {
+			// no longer a TCP-associated option
+			return consumed, nil
+		}
+		switch {
+		case strings.HasPrefix(value, "dpt:"):
+			rule.destinationPort, err = parseDestinationPort(value)
+			if err != nil {
+				return 0, fmt.Errorf("parsing destination port: %w", err)
+			}
+			consumed++
+		case strings.HasPrefix(value, "spt:"):
+			rule.sourcePort, err = parseSourcePort(value)
+			if err != nil {
+				return 0, fmt.Errorf("parsing source port: %w", err)
+			}
+			consumed++
+		case strings.HasPrefix(value, "flags:"):
+			rule.tcpFlags, err = parseTCPFlags(value)
+			if err != nil {
+				return 0, fmt.Errorf("parsing TCP flags: %w", err)
+			}
+			consumed++
+		default:
+			return 0, fmt.Errorf("%w: %s", errTCPOptionalUnknown, value)
+		}
+	}
+	return consumed, nil
+}
+
+func parseDestinationPort(value string) (port uint16, err error) {
+	value = strings.TrimPrefix(value, "dpt:")
+	return parsePort(value)
+}
+
+func parseSourcePort(value string) (port uint16, err error) {
+	value = strings.TrimPrefix(value, "spt:")
+	return parsePort(value)
+}
+
+var errTCPFlagsMalformed = errors.New("TCP flags are malformed")
+
+func parseTCPFlags(value string) (tcpFlags, error) {
+	value = strings.TrimPrefix(value, "flags:")
+	fields := strings.Split(value, "/")
+	const expectedFields = 2
+	if len(fields) != expectedFields {
+		return tcpFlags{}, fmt.Errorf("%w: expected format 'flags:<mask>/<comparison>' in %q",
+			errTCPFlagsMalformed, value)
+	}
+	maskFlags := strings.Split(fields[0], ",")
+	mask := make([]tcpFlag, len(maskFlags))
+	var err error
+	for i, maskFlag := range maskFlags {
+		mask[i], err = parseTCPFlag(maskFlag)
+		if err != nil {
+			return tcpFlags{}, fmt.Errorf("parsing TCP mask flags: %w", err)
+		}
+	}
+	comparisonFlags := strings.Split(fields[1], ",")
+	comparison := make([]tcpFlag, len(comparisonFlags))
+	for i, comparisonFlag := range comparisonFlags {
+		comparison[i], err = parseTCPFlag(comparisonFlag)
+		if err != nil {
+			return tcpFlags{}, fmt.Errorf("parsing TCP comparison flags: %w", err)
+		}
+	}
+	return tcpFlags{
+		mask:       mask,
+		comparison: comparison,
+	}, nil
+}
+
 func parsePortsCSV(s string) (ports []uint16, err error) {
 	if s == "" {
 		return nil, nil
@@ -286,16 +440,36 @@ func parsePortsCSV(s string) (ports []uint16, err error) {
 	fields := strings.Split(s, ",")
 	ports = make([]uint16, len(fields))
 	for i, field := range fields {
-		const base, bitLength = 10, 16
-		port, err := strconv.ParseUint(field, base, bitLength)
+		ports[i], err = parsePort(field)
 		if err != nil {
-			return nil, fmt.Errorf("parsing port %q: %w", field, err)
+			return nil, err
 		}
-		ports[i] = uint16(port)
 	}
 	return ports, nil
 }
 
+func parseMark(optionalFields []string) (m mark, consumed int, err error) {
+	switch optionalFields[consumed] {
+	case "match":
+		consumed++
+		if optionalFields[consumed] == "!" {
+			m.invert = true
+			consumed++
+		}
+
+		value, err := parseAny32bNumber(optionalFields[consumed])
+		if err != nil {
+			return mark{}, 0, fmt.Errorf("value malformed: %w", err)
+		}
+		m.value = value
+		consumed++
+	default:
+		return mark{}, 0, fmt.Errorf("%w: unexpected mark mode field: %s",
+			ErrChainRuleMalformed, optionalFields[consumed])
+	}
+	return m, consumed, nil
+}
+
 var ErrLineNumberIsZero = errors.New("line number is zero")
 
 func parseLineNumber(s string) (n uint16, err error) {

internal/firewall/iptables/list_test.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"net/netip"

internal/firewall/iptables/mocks_generate_test.go

@@ -1,3 +1,3 @@
-package firewall
+package iptables
 
 //go:generate mockgen -destination=mocks_test.go -package $GOPACKAGE . CmdRunner,Logger

internal/firewall/iptables/mocks_test.go

@@ -1,8 +1,8 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/qdm12/gluetun/internal/firewall (interfaces: CmdRunner,Logger)
+// Source: github.com/qdm12/gluetun/internal/firewall/iptables (interfaces: CmdRunner,Logger)
 
-// Package firewall is a generated GoMock package.
-package firewall
+// Package iptables is a generated GoMock package.
+package iptables
 
 import (
 	exec "os/exec"

internal/firewall/iptables/parse.go

@@ -0,0 +1,339 @@
+package iptables
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"slices"
+	"strconv"
+	"strings"
+)
+
+type operation uint8
+
+const (
+	opNone operation = iota
+	opAppend
+	opDelete
+	opInsert
+	opReplace
+)
+
+type iptablesInstruction struct {
+	table           string // defaults to "filter", and can be "nat" for example.
+	operation       operation
+	chain           string       // for example INPUT, PREROUTING. Cannot be empty.
+	target          string       // for example ACCEPT. Can be empty.
+	protocol        string       // "tcp" or "udp" or "" for all protocols.
+	inputInterface  string       // for example "tun0" or "" for any interface.
+	outputInterface string       // for example "tun0" or "" for any interface.
+	source          netip.Prefix // if not valid, then it is unspecified.
+	sourcePort      uint16       // if zero, there is no source port
+	destination     netip.Prefix // if not valid, then it is unspecified.
+	destinationPort uint16       // if zero, there is no destination port
+	toPorts         []uint16     // if empty, there is no redirection
+	ctstate         []string     // if empty, there is no ctstate
+	tcpFlags        tcpFlags
+	mark            mark
+	connMark        mark
+	setMark         uint   // only used for jump CONNMARK --set-mark
+	rejectWith      string // only used for REJECT targets
+}
+
+func (i *iptablesInstruction) setDefaults() {
+	if i.table == "" {
+		i.table = "filter"
+	}
+}
+
+// equalToRule ignores the append boolean flag of the instruction to compare against the rule.
+func (i *iptablesInstruction) equalToRule(table, chain string, rule chainRule) (equal bool) {
+	switch {
+	case i.table != table:
+		return false
+	case i.chain != chain:
+		return false
+	case i.target != rule.target:
+		return false
+	case i.protocol != rule.protocol:
+		return false
+	case i.destinationPort != rule.destinationPort:
+		return false
+	case i.sourcePort != rule.sourcePort:
+		return false
+	case !slices.Equal(i.toPorts, rule.redirPorts):
+		return false
+	case !slices.Equal(i.ctstate, rule.ctstate):
+		return false
+	case !networkInterfacesEqual(i.inputInterface, rule.inputInterface):
+		return false
+	case !networkInterfacesEqual(i.outputInterface, rule.outputInterface):
+		return false
+	case !ipPrefixesEqual(i.source, rule.source):
+		return false
+	case !ipPrefixesEqual(i.destination, rule.destination):
+		return false
+	case !slices.Equal(i.tcpFlags.mask, rule.tcpFlags.mask) ||
+		!slices.Equal(i.tcpFlags.comparison, rule.tcpFlags.comparison):
+		return false
+	case i.mark != rule.mark:
+		return false
+	case i.connMark != rule.connMark:
+		return false
+	case i.setMark != rule.setMark:
+		return false
+	case i.rejectWith != rule.rejectWith:
+		return false
+	default:
+		return true
+	}
+}
+
+// instruction can be "" which equivalent to the "*" chain rule interface.
+func networkInterfacesEqual(instruction, chainRule string) bool {
+	return instruction == chainRule || (instruction == "" && chainRule == "*")
+}
+
+func ipPrefixesEqual(instruction, chainRule netip.Prefix) bool {
+	return instruction == chainRule ||
+		(!instruction.IsValid() && chainRule.Bits() == 0 && chainRule.Addr().IsUnspecified())
+}
+
+var ErrIptablesCommandMalformed = errors.New("iptables command is malformed")
+
+func parseIptablesInstruction(s string) (instruction iptablesInstruction, err error) {
+	if s == "" {
+		return iptablesInstruction{}, fmt.Errorf("%w: empty instruction", ErrIptablesCommandMalformed)
+	}
+	fields := strings.Fields(s)
+
+	i := 0
+	for i < len(fields) {
+		consumed, err := parseInstructionFlag(fields[i:], &instruction)
+		if err != nil {
+			return iptablesInstruction{}, fmt.Errorf("parsing %q: %w", s, err)
+		}
+		i += consumed
+	}
+
+	instruction.setDefaults()
+	return instruction, nil
+}
+
+func parseInstructionFlag(fields []string, instruction *iptablesInstruction) (consumed int, err error) {
+	consumed, err = preCheckInstructionFields(fields)
+	if err != nil {
+		return 0, err
+	}
+	flag := fields[0]
+	value := fields[1]
+
+	switch flag {
+	case "-t", "--table":
+		instruction.table = value
+	case "-D", "--delete":
+		instruction.operation = opDelete
+		instruction.chain = value
+	case "-A", "--append":
+		instruction.operation = opAppend
+		instruction.chain = value
+	case "-I", "--insert":
+		instruction.operation = opInsert
+		instruction.chain = value
+	case "-j", "--jump":
+		subConsumed, err := parseJumpFlag(fields[1:], instruction)
+		if err != nil {
+			return 0, fmt.Errorf("parsing jump flag: %w", err)
+		}
+		consumed += subConsumed
+	case "-p", "--protocol":
+		instruction.protocol = value
+	case "-m", "--match":
+		consumed, err = parseMatchModule(fields, instruction)
+		if err != nil {
+			return 0, fmt.Errorf("parsing match module: %w", err)
+		}
+	case "--mark":
+		n, err := parseAny32bNumber(value)
+		if err != nil {
+			return 0, fmt.Errorf("parsing mark value %q: %w", value, err)
+		}
+		instruction.mark.value = n
+	case "-i", "--in-interface":
+		instruction.inputInterface = value
+	case "-o", "--out-interface":
+		instruction.outputInterface = value
+	case "-s", "--source":
+		instruction.source, err = parseIPPrefix(value)
+		if err != nil {
+			return 0, fmt.Errorf("parsing source IP CIDR: %w", err)
+		}
+	case "--sport":
+		instruction.sourcePort, err = parsePort(value)
+		if err != nil {
+			return 0, fmt.Errorf("parsing source port: %w", err)
+		}
+	case "-d", "--destination":
+		instruction.destination, err = parseIPPrefix(value)
+		if err != nil {
+			return 0, fmt.Errorf("parsing destination IP CIDR: %w", err)
+		}
+	case "--dport":
+		instruction.destinationPort, err = parsePort(value)
+		if err != nil {
+			return 0, fmt.Errorf("parsing destination port: %w", err)
+		}
+	case "--ctstate":
+		instruction.ctstate = strings.Split(value, ",")
+	case "--to-ports":
+		instruction.toPorts, err = parseToPorts(value)
+		if err != nil {
+			return 0, fmt.Errorf("parsing port redirection: %w", err)
+		}
+	case "--tcp-flags":
+		mask, comparison := value, fields[2]
+		instruction.tcpFlags, err = parseTCPFlags(mask + "/" + comparison)
+		if err != nil {
+			return 0, fmt.Errorf("parsing TCP flags: %w", err)
+		}
+	case "--reject-with":
+		instruction.rejectWith = value // for example "tcp-reset"
+	default:
+		return 0, fmt.Errorf("%w: unknown key %q", ErrIptablesCommandMalformed, flag)
+	}
+	return consumed, nil
+}
+
+func preCheckInstructionFields(fields []string) (consumed int, err error) {
+	flag := fields[0]
+	// All flags use one value after the flag, except the following:
+	switch flag {
+	case "--tcp-flags":
+		const expected = 3
+		if len(fields) < expected {
+			return 0, fmt.Errorf("%w: flag %q requires at least 2 values, but got %s",
+				ErrIptablesCommandMalformed, flag, strings.Join(fields, " "))
+		}
+		return expected, nil
+	default:
+		const expected = 2
+		if len(fields) < expected {
+			return 0, fmt.Errorf("%w: flag %q requires a value, but got none",
+				ErrIptablesCommandMalformed, flag)
+		}
+		return expected, nil
+	}
+}
+
+func parseJumpFlag(fields []string, instruction *iptablesInstruction) (consumed int, err error) {
+	instruction.target = fields[0]
+	// consumed in the caller already takes fields[0] into account
+	if instruction.target != "CONNMARK" {
+		return consumed, nil
+	}
+	// consumed already accounts for the "CONNMARK" value
+	const expectedFields = 3
+	if len(fields) < expectedFields {
+		return 0, fmt.Errorf("%w: jump CONNMARK requires at least two additional values",
+			ErrIptablesCommandMalformed)
+	}
+	switch fields[1] {
+	case "--set-mark":
+		n, err := parseAny32bNumber(fields[2])
+		if err != nil {
+			return 0, fmt.Errorf("parsing connmark mark value %q: %w", fields[2], err)
+		}
+		consumed++
+		instruction.setMark = n
+	default:
+		return consumed, fmt.Errorf("%w: unsupported jump CONNMARK with value: %s",
+			ErrIptablesCommandMalformed, fields[1])
+	}
+	consumed++
+	return consumed, nil
+}
+
+func parseIPPrefix(value string) (prefix netip.Prefix, err error) {
+	slashIndex := strings.Index(value, "/")
+	if slashIndex >= 0 {
+		return netip.ParsePrefix(value)
+	}
+
+	ip, err := netip.ParseAddr(value)
+	if err != nil {
+		return netip.Prefix{}, fmt.Errorf("parsing IP address: %w", err)
+	}
+	return netip.PrefixFrom(ip, ip.BitLen()), nil
+}
+
+func parsePort(value string) (port uint16, err error) {
+	const base, bitLength = 10, 16
+	portValue, err := strconv.ParseUint(value, base, bitLength)
+	if err != nil {
+		return 0, err
+	}
+	return uint16(portValue), nil
+}
+
+func parseAny32bNumber(mark string) (value uint, err error) {
+	const base = 0 // auto-detect
+	const bits = 32
+	n, err := strconv.ParseUint(mark, base, bits)
+	return uint(n), err
+}
+
+func parseMatchModule(fields []string, instruction *iptablesInstruction) (
+	consumed int, err error,
+) {
+	_ = fields[consumed] // -m or --match flag already detected
+	consumed++
+	switch fields[consumed] {
+	case "tcp", "udp":
+		consumed++
+		// for now ignore the protocol match since it's auto-loaded
+		// when parsing the -p/--protocol flag, and we don't need to
+		// parse it twice.
+	case "mark":
+		consumed++
+		switch {
+		case len(fields[consumed:]) == 0 || strings.HasPrefix(fields[consumed], "-"):
+			// end or another flag
+			return consumed, nil
+		case fields[consumed] == "!":
+			consumed++
+			instruction.mark.invert = true
+		default:
+			return consumed, fmt.Errorf("%w: unsupported match mark with value: %s",
+				ErrIptablesCommandMalformed, fields[2])
+		}
+	case "connmark":
+		consumed++
+		switch {
+		case len(fields[consumed:]) == 0 || strings.HasPrefix(fields[consumed], "-"):
+			// end or another flag
+			return consumed, nil
+		case fields[consumed] == "!":
+			consumed++
+			instruction.connMark.invert = true
+		default:
+			return consumed, fmt.Errorf("%w: unsupported match connmark with value: %s",
+				ErrIptablesCommandMalformed, fields[2])
+		}
+	default:
+		return 0, fmt.Errorf("%w: unknown match value: %s",
+			ErrIptablesCommandMalformed, fields[consumed])
+	}
+	return consumed, nil
+}
+
+func parseToPorts(value string) (toPorts []uint16, err error) {
+	portStrings := strings.Split(value, ",")
+	toPorts = make([]uint16, len(portStrings))
+	for i, portString := range portStrings {
+		toPorts[i], err = parsePort(portString)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return toPorts, nil
+}

internal/firewall/iptables/parse_test.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"net/netip"
@@ -23,7 +23,7 @@ func Test_parseIptablesInstruction(t *testing.T) {
 		"uneven_fields": {
 			s:          "-A",
 			errWrapped: ErrIptablesCommandMalformed,
-			errMessage: "iptables command is malformed: fields count 1 is not even: \"-A\"",
+			errMessage: "parsing \"-A\": iptables command is malformed: flag \"-A\" requires a value, but got none",
 		},
 		"unknown_key": {
 			s:          "-x something",
@@ -33,9 +33,9 @@ func Test_parseIptablesInstruction(t *testing.T) {
 		"one_pair": {
 			s: "-A INPUT",
 			instruction: iptablesInstruction{
-				table:  "filter",
-				chain:  "INPUT",
-				append: true,
+				table:     "filter",
+				chain:     "INPUT",
+				operation: opAppend,
 			},
 		},
 		"instruction_A": {
@@ -43,7 +43,7 @@ func Test_parseIptablesInstruction(t *testing.T) {
 			instruction: iptablesInstruction{
 				table:           "filter",
 				chain:           "INPUT",
-				append:          true,
+				operation:       opAppend,
 				inputInterface:  "tun0",
 				protocol:        "tcp",
 				source:          netip.MustParsePrefix("1.2.3.4/32"),
@@ -57,7 +57,7 @@ func Test_parseIptablesInstruction(t *testing.T) {
 			instruction: iptablesInstruction{
 				table:           "nat",
 				chain:           "PREROUTING",
-				append:          false,
+				operation:       opDelete,
 				inputInterface:  "tun0",
 				protocol:        "tcp",
 				destinationPort: 43716,

internal/firewall/iptables/support.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"context"
@@ -11,10 +11,10 @@ import (
 )
 
 var (
-	ErrNetAdminMissing      = errors.New("NET_ADMIN capability is missing")
-	ErrTestRuleCleanup      = errors.New("failed cleaning up test rule")
-	ErrInputPolicyNotFound  = errors.New("input policy not found")
-	ErrIPTablesNotSupported = errors.New("no iptables supported found")
+	ErrNetAdminMissing     = errors.New("NET_ADMIN capability is missing")
+	ErrTestRuleCleanup     = errors.New("failed cleaning up test rule")
+	ErrInputPolicyNotFound = errors.New("input policy not found")
+	ErrNotSupported        = errors.New("no iptables supported found")
 )
 
 func checkIptablesSupport(ctx context.Context, runner CmdRunner,
@@ -57,7 +57,7 @@ func checkIptablesSupport(ctx context.Context, runner CmdRunner,
 	}
 
 	return "", fmt.Errorf("%w: errors encountered are: %s",
-		ErrIPTablesNotSupported, strings.Join(allUnsupportedMessages, "; "))
+		ErrNotSupported, strings.Join(allUnsupportedMessages, "; "))
 }
 
 func testIptablesPath(ctx context.Context, path string,

internal/firewall/iptables/support_test.go

@@ -1,4 +1,4 @@
-package firewall
+package iptables
 
 import (
 	"context"
@@ -101,7 +101,7 @@ func Test_checkIptablesSupport(t *testing.T) {
 				return runner
 			},
 			iptablesPathsToTry: []string{"path1", "path2"},
-			errSentinel:        ErrIPTablesNotSupported,
+			errSentinel:        ErrNotSupported,
 			errMessage: "no iptables supported found: " +
 				"errors encountered are: " +
 				"path1: output 1 (exit code 4); " +

internal/firewall/iptables/tcp.go

@@ -0,0 +1,98 @@
+package iptables
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"os"
+)
+
+type tcpFlags struct {
+	mask       []tcpFlag
+	comparison []tcpFlag
+}
+
+type tcpFlag uint8
+
+const (
+	tcpFlagFIN tcpFlag = 1 << iota
+	tcpFlagSYN
+	tcpFlagRST
+	tcpFlagPSH
+	tcpFlagACK
+	tcpFlagURG
+	tcpFlagECE
+	tcpFlagCWR
+)
+
+func (f tcpFlag) String() string {
+	switch f {
+	case tcpFlagFIN:
+		return "FIN"
+	case tcpFlagSYN:
+		return "SYN"
+	case tcpFlagRST:
+		return "RST"
+	case tcpFlagPSH:
+		return "PSH"
+	case tcpFlagACK:
+		return "ACK"
+	case tcpFlagURG:
+		return "URG"
+	case tcpFlagECE:
+		return "ECE"
+	case tcpFlagCWR:
+		return "CWR"
+	default:
+		panic(fmt.Sprintf("%s: %d", errTCPFlagUnknown, f))
+	}
+}
+
+var errTCPFlagUnknown = errors.New("unknown TCP flag")
+
+func parseTCPFlag(s string) (tcpFlag, error) {
+	allFlags := []tcpFlag{
+		tcpFlagFIN, tcpFlagSYN, tcpFlagRST, tcpFlagPSH,
+		tcpFlagACK, tcpFlagURG, tcpFlagECE, tcpFlagCWR,
+	}
+	for _, flag := range allFlags {
+		if s == fmt.Sprintf("%#02x", uint8(flag)) || s == flag.String() {
+			return flag, nil
+		}
+	}
+	return 0, fmt.Errorf("%w: %s", errTCPFlagUnknown, s)
+}
+
+var ErrMarkMatchModuleMissing = errors.New("libxt_mark.so module is missing")
+
+// TempDropOutputTCPRST temporarily drops outgoing TCP RST packets to the specified address and port,
+// for any TCP packets not marked with the excludeMark given.
+// This is necessary for TCP path MTU discovery to work, as the kernel will try to terminate the connection
+// by sending a TCP RST packet, although we want to handle the connection manually.
+func (c *Config) TempDropOutputTCPRST(ctx context.Context,
+	src, dst netip.AddrPort, excludeMark int) (
+	revert func(ctx context.Context) error, err error,
+) {
+	_, err = os.Stat("/usr/lib/xtables/libxt_mark.so")
+	if err != nil && errors.Is(err, os.ErrNotExist) {
+		return nil, fmt.Errorf("%w", ErrMarkMatchModuleMissing)
+	}
+
+	const template = "%s OUTPUT -p tcp -s %s --sport %d -d %s --dport %d " +
+		"--tcp-flags RST RST -m mark ! --mark %d -j DROP" //nolint:dupword
+	instruction := fmt.Sprintf(template, "--append", src.Addr(), src.Port(), dst.Addr(), dst.Port(), excludeMark)
+	revertInstruction := fmt.Sprintf(template, "--delete", src.Addr(), src.Port(), dst.Addr(), dst.Port(), excludeMark)
+	run := c.runIptablesInstruction
+	if dst.Addr().Is6() {
+		run = c.runIP6tablesInstruction
+	}
+	revert = func(ctx context.Context) error {
+		return run(ctx, revertInstruction)
+	}
+	err = run(ctx, instruction)
+	if err != nil {
+		return nil, fmt.Errorf("running instruction: %w", err)
+	}
+	return revert, nil
+}

internal/firewall/iptablesmix.go

@@ -1,21 +0,0 @@
-package firewall
-
-import (
-	"context"
-)
-
-func (c *Config) runMixedIptablesInstructions(ctx context.Context, instructions []string) error {
-	for _, instruction := range instructions {
-		if err := c.runMixedIptablesInstruction(ctx, instruction); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (c *Config) runMixedIptablesInstruction(ctx context.Context, instruction string) error {
-	if err := c.runIptablesInstruction(ctx, instruction); err != nil {
-		return err
-	}
-	return c.runIP6tablesInstruction(ctx, instruction)
-}

internal/firewall/outboundsubnets.go

@@ -48,7 +48,7 @@ func (c *Config) removeOutboundSubnets(ctx context.Context, subnets []netip.Pref
 			}
 
 			firewallUpdated = true
-			err := c.acceptOutputFromIPToSubnet(ctx, defaultRoute.NetInterface,
+			err := c.impl.AcceptOutputFromIPToSubnet(ctx, defaultRoute.NetInterface,
 				defaultRoute.AssignedIP, subNet, remove)
 			if err != nil {
 				c.logger.Error("cannot remove outdated outbound subnet: " + err.Error())
@@ -77,7 +77,7 @@ func (c *Config) addOutboundSubnets(ctx context.Context, subnets []netip.Prefix)
 			}
 
 			firewallUpdated = true
-			err := c.acceptOutputFromIPToSubnet(ctx, defaultRoute.NetInterface,
+			err := c.impl.AcceptOutputFromIPToSubnet(ctx, defaultRoute.NetInterface,
 				defaultRoute.AssignedIP, subnet, remove)
 			if err != nil {
 				return err

internal/firewall/parse.go

@@ -1,164 +0,0 @@
-package firewall
-
-import (
-	"errors"
-	"fmt"
-	"net/netip"
-	"slices"
-	"strconv"
-	"strings"
-)
-
-type iptablesInstruction struct {
-	table           string // defaults to "filter", and can be "nat" for example.
-	append          bool
-	chain           string       // for example INPUT, PREROUTING. Cannot be empty.
-	target          string       // for example ACCEPT. Can be empty.
-	protocol        string       // "tcp" or "udp" or "" for all protocols.
-	inputInterface  string       // for example "tun0" or "" for any interface.
-	outputInterface string       // for example "tun0" or "" for any interface.
-	source          netip.Prefix // if not valid, then it is unspecified.
-	destination     netip.Prefix // if not valid, then it is unspecified.
-	destinationPort uint16       // if zero, there is no destination port
-	toPorts         []uint16     // if empty, there is no redirection
-	ctstate         []string     // if empty, there is no ctstate
-}
-
-func (i *iptablesInstruction) setDefaults() {
-	if i.table == "" {
-		i.table = "filter"
-	}
-}
-
-// equalToRule ignores the append boolean flag of the instruction to compare against the rule.
-func (i *iptablesInstruction) equalToRule(table, chain string, rule chainRule) (equal bool) {
-	switch {
-	case i.table != table:
-		return false
-	case i.chain != chain:
-		return false
-	case i.target != rule.target:
-		return false
-	case i.protocol != rule.protocol:
-		return false
-	case i.destinationPort != rule.destinationPort:
-		return false
-	case !slices.Equal(i.toPorts, rule.redirPorts):
-		return false
-	case !slices.Equal(i.ctstate, rule.ctstate):
-		return false
-	case !networkInterfacesEqual(i.inputInterface, rule.inputInterface):
-		return false
-	case !networkInterfacesEqual(i.outputInterface, rule.outputInterface):
-		return false
-	case !ipPrefixesEqual(i.source, rule.source):
-		return false
-	case !ipPrefixesEqual(i.destination, rule.destination):
-		return false
-	default:
-		return true
-	}
-}
-
-// instruction can be "" which equivalent to the "*" chain rule interface.
-func networkInterfacesEqual(instruction, chainRule string) bool {
-	return instruction == chainRule || (instruction == "" && chainRule == "*")
-}
-
-func ipPrefixesEqual(instruction, chainRule netip.Prefix) bool {
-	return instruction == chainRule ||
-		(!instruction.IsValid() && chainRule.Bits() == 0 && chainRule.Addr().IsUnspecified())
-}
-
-var ErrIptablesCommandMalformed = errors.New("iptables command is malformed")
-
-func parseIptablesInstruction(s string) (instruction iptablesInstruction, err error) {
-	if s == "" {
-		return iptablesInstruction{}, fmt.Errorf("%w: empty instruction", ErrIptablesCommandMalformed)
-	}
-	fields := strings.Fields(s)
-	if len(fields)%2 != 0 {
-		return iptablesInstruction{}, fmt.Errorf("%w: fields count %d is not even: %q",
-			ErrIptablesCommandMalformed, len(fields), s)
-	}
-
-	for i := 0; i < len(fields); i += 2 {
-		key := fields[i]
-		value := fields[i+1]
-		err = parseInstructionFlag(key, value, &instruction)
-		if err != nil {
-			return iptablesInstruction{}, fmt.Errorf("parsing %q: %w", s, err)
-		}
-	}
-
-	instruction.setDefaults()
-	return instruction, nil
-}
-
-func parseInstructionFlag(key, value string, instruction *iptablesInstruction) (err error) {
-	switch key {
-	case "-t", "--table":
-		instruction.table = value
-	case "-D", "--delete":
-		instruction.append = false
-		instruction.chain = value
-	case "-A", "--append":
-		instruction.append = true
-		instruction.chain = value
-	case "-j", "--jump":
-		instruction.target = value
-	case "-p", "--protocol":
-		instruction.protocol = value
-	case "-m", "--match": // ignore match
-	case "-i", "--in-interface":
-		instruction.inputInterface = value
-	case "-o", "--out-interface":
-		instruction.outputInterface = value
-	case "-s", "--source":
-		instruction.source, err = parseIPPrefix(value)
-		if err != nil {
-			return fmt.Errorf("parsing source IP CIDR: %w", err)
-		}
-	case "-d", "--destination":
-		instruction.destination, err = parseIPPrefix(value)
-		if err != nil {
-			return fmt.Errorf("parsing destination IP CIDR: %w", err)
-		}
-	case "--dport":
-		const base, bitLength = 10, 16
-		destinationPort, err := strconv.ParseUint(value, base, bitLength)
-		if err != nil {
-			return fmt.Errorf("parsing destination port: %w", err)
-		}
-		instruction.destinationPort = uint16(destinationPort)
-	case "--ctstate":
-		instruction.ctstate = strings.Split(value, ",")
-	case "--to-ports":
-		portStrings := strings.Split(value, ",")
-		instruction.toPorts = make([]uint16, len(portStrings))
-		for i, portString := range portStrings {
-			const base, bitLength = 10, 16
-			port, err := strconv.ParseUint(portString, base, bitLength)
-			if err != nil {
-				return fmt.Errorf("parsing port redirection: %w", err)
-			}
-			instruction.toPorts[i] = uint16(port)
-		}
-	default:
-		return fmt.Errorf("%w: unknown key %q", ErrIptablesCommandMalformed, key)
-	}
-	return nil
-}
-
-func parseIPPrefix(value string) (prefix netip.Prefix, err error) {
-	slashIndex := strings.Index(value, "/")
-	if slashIndex >= 0 {
-		return netip.ParsePrefix(value)
-	}
-
-	ip, err := netip.ParseAddr(value)
-	if err != nil {
-		return netip.Prefix{}, fmt.Errorf("parsing IP address: %w", err)
-	}
-	return netip.PrefixFrom(ip, ip.BitLen()), nil
-}

internal/firewall/ports.go

@@ -35,7 +35,7 @@ func (c *Config) SetAllowedPort(ctx context.Context, port uint16, intf string) (
 	c.logger.Info("setting allowed input port " + fmt.Sprint(port) + " through interface " + intf + "...")
 
 	const remove = false
-	if err := c.acceptInputToPort(ctx, intf, port, remove); err != nil {
+	if err := c.impl.AcceptInputToPort(ctx, intf, port, remove); err != nil {
 		return fmt.Errorf("allowing input to port %d through interface %s: %w",
 			port, intf, err)
 	}
@@ -68,7 +68,7 @@ func (c *Config) RemoveAllowedPort(ctx context.Context, port uint16) (err error)
 
 	const remove = true
 	for netInterface := range interfacesSet {
-		err := c.acceptInputToPort(ctx, netInterface, port, remove)
+		err := c.impl.AcceptInputToPort(ctx, netInterface, port, remove)
 		if err != nil {
 			return fmt.Errorf("removing allowed port %d on interface %s: %w",
 				port, netInterface, err)

internal/firewall/redirect.go

@@ -50,7 +50,7 @@ func (c *Config) RedirectPort(ctx context.Context, intf string, sourcePort,
 		return nil
 	case conflict != nil:
 		const remove = true
-		err = c.redirectPort(ctx, conflict.interfaceName, conflict.sourcePort,
+		err = c.impl.RedirectPort(ctx, conflict.interfaceName, conflict.sourcePort,
 			conflict.destinationPort, remove)
 		if err != nil {
 			return fmt.Errorf("removing conflicting redirection: %w", err)
@@ -60,7 +60,7 @@ func (c *Config) RedirectPort(ctx context.Context, intf string, sourcePort,
 	}
 
 	const remove = false
-	err = c.redirectPort(ctx, intf, sourcePort, destinationPort, remove)
+	err = c.impl.RedirectPort(ctx, intf, sourcePort, destinationPort, remove)
 	if err != nil {
 		return fmt.Errorf("redirecting port: %w", err)
 	}

internal/firewall/vpn.go

@@ -28,7 +28,7 @@ func (c *Config) SetVPNConnection(ctx context.Context,
 	remove := true
 	if c.vpnConnection.IP.IsValid() {
 		for _, defaultRoute := range c.defaultRoutes {
-			if err := c.acceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, c.vpnConnection, remove); err != nil {
+			if err := c.impl.AcceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, c.vpnConnection, remove); err != nil {
 				c.logger.Error("cannot remove outdated VPN connection rule: " + err.Error())
 			}
 		}
@@ -36,7 +36,7 @@ func (c *Config) SetVPNConnection(ctx context.Context,
 	c.vpnConnection = models.Connection{}
 
 	if c.vpnIntf != "" {
-		if err = c.acceptOutputThroughInterface(ctx, c.vpnIntf, remove); err != nil {
+		if err = c.impl.AcceptOutputThroughInterface(ctx, c.vpnIntf, remove); err != nil {
 			c.logger.Error("cannot remove outdated VPN interface rule: " + err.Error())
 		}
 	}
@@ -45,13 +45,13 @@ func (c *Config) SetVPNConnection(ctx context.Context,
 	remove = false
 
 	for _, defaultRoute := range c.defaultRoutes {
-		if err := c.acceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, connection, remove); err != nil {
+		if err := c.impl.AcceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, connection, remove); err != nil {
 			return fmt.Errorf("allowing output traffic through VPN connection: %w", err)
 		}
 	}
 	c.vpnConnection = connection
 
-	if err = c.acceptOutputThroughInterface(ctx, vpnIntf, remove); err != nil {
+	if err = c.impl.AcceptOutputThroughInterface(ctx, vpnIntf, remove); err != nil {
 		return fmt.Errorf("accepting output traffic through interface %s: %w", vpnIntf, err)
 	}
 	c.vpnIntf = vpnIntf

internal/firewall/wrappers.go

@@ -0,0 +1,21 @@
+package firewall
+
+import (
+	"context"
+	"net/netip"
+)
+
+func (c *Config) Version(ctx context.Context) (version string, err error) {
+	return c.impl.Version(ctx)
+}
+
+// TempDropOutputTCPRST temporarily drops outgoing TCP RST packets to the specified address and port,
+// for any TCP packets not marked with the excludeMark given.
+// This is necessary for TCP path MTU discovery to work, as the kernel will try to terminate the connection
+// by sending a TCP RST packet, although we want to handle the connection manually.
+func (c *Config) TempDropOutputTCPRST(ctx context.Context,
+	src, dst netip.AddrPort, excludeMark int) (
+	revert func(ctx context.Context) error, err error,
+) {
+	return c.impl.TempDropOutputTCPRST(ctx, src, dst, excludeMark)
+}

internal/healthcheck/checker.go

@@ -23,6 +23,7 @@ type Checker struct {
 	logger         Logger
 	icmpTargetIPs  []netip.Addr
 	smallCheckType string
+	startupOnFail  bool
 	configMutex    sync.Mutex
 
 	icmpNotPermitted *bool
@@ -45,26 +46,43 @@ func NewChecker(logger Logger) *Checker {
 	}
 }
 
-// SetConfig sets the TCP+TLS dial addresses, the ICMP echo IP address
-// to target and the desired small check type (dns or icmp).
+// SetConfig sets the following:
+// - TCP+TLS dial addresses
+// - ICMP echo IP addresses to target
+// - the desired small check type (dns or icmp)
+// - whether to startup the periodic checks if the startup check fails.
 // This function MUST be called before calling [Checker.Start].
 func (c *Checker) SetConfig(tlsDialAddrs []string, icmpTargets []netip.Addr,
-	smallCheckType string,
+	smallCheckType string, startupOnFail bool,
 ) {
 	c.configMutex.Lock()
 	defer c.configMutex.Unlock()
 	c.tlsDialAddrs = tlsDialAddrs
 	c.icmpTargetIPs = icmpTargets
 	c.smallCheckType = smallCheckType
+	c.startupOnFail = startupOnFail
 }
 
-// Start starts the checker by first running a blocking 6s-timed TCP+TLS check,
-// and, on success, starts the periodic checks in a separate goroutine:
+// Start starts the [Checker] which behaves differently according to its
+// internal field startupOnFail, which is set by calling [Checker.SetConfig].
+//
+// By default, startupOnFail should be false and the behavior is as follows:
+// A blocking 6s-timed TCP+TLS check is performed first. If it fails,
+// an error is returned and the [Checker] is not started.
+// On success, it starts the periodic checks in a separate goroutine, returning
+// the runError error channel and a nil error.
+//
+// If startupOnFail is true, the behavior is as follows:
+// A blocking 6s-timed TCP+TLS check is performed first. If it fails,
+// the error is sent to the runError channel, but no error is returned
+// and the [Checker] continues to start the periodic checks in a separate goroutine, returning
+// the runError error channel and a nil error.
+//
+// The periodic checks consist in:
 // - a "small" ICMP echo check every minute
 // - a "full" TCP+TLS check every 5 minutes
-// It returns a channel `runError` that receives an error (nil or not) when a periodic check is performed.
-// It returns an error if the initial TCP+TLS check fails.
-// The Checker has to be ultimately stopped by calling [Checker.Stop].
+//
+// The [Checker] has to be ultimately stopped by calling [Checker.Stop].
 func (c *Checker) Start(ctx context.Context) (runError <-chan error, err error) {
 	if len(c.tlsDialAddrs) == 0 || len(c.icmpTargetIPs) == 0 || c.smallCheckType == "" {
 		panic("call Checker.SetConfig with non empty values before Checker.Start")
@@ -76,9 +94,19 @@ func (c *Checker) Start(ctx context.Context) (runError <-chan error, err error)
 	}
 	c.echoer.Reset()
 
+	// runErrorCh MUST be buffered in the case startupOnFail is true, and
+	// a startup error was encountered, to avoid blocking the startup
+	// goroutine when sending the error, especially since the caller may
+	// not be ready to receive from the channel yet.
+	runErrorCh := make(chan error, 1)
+	runError = runErrorCh
 	err = c.startupCheck(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("startup check: %w", err)
+		err = fmt.Errorf("startup check: %w", err)
+		if !c.startupOnFail {
+			return nil, err
+		}
+		runErrorCh <- err
 	}
 
 	ready := make(chan struct{})
@@ -90,8 +118,6 @@ func (c *Checker) Start(ctx context.Context) (runError <-chan error, err error)
 	smallCheckTimer := time.NewTimer(smallCheckPeriod)
 	const fullCheckPeriod = 5 * time.Minute
 	fullCheckTimer := time.NewTimer(fullCheckPeriod)
-	runErrorCh := make(chan error)
-	runError = runErrorCh
 	go func() {
 		defer close(done)
 		close(ready)

internal/healthcheck/client.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"time"
 )
 
 var ErrHTTPStatusNotOK = errors.New("HTTP response status is not OK")
@@ -21,6 +22,9 @@ func NewClient(httpClient *http.Client) *Client {
 }
 
 func (c *Client) Check(ctx context.Context, url string) error {
+	ctx, cancel := context.WithTimeout(ctx, time.Second)
+	defer cancel()
+
 	request, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return err

internal/mod/builtin_linux.go

@@ -0,0 +1,33 @@
+package mod
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+var errBuiltinModuleNotFound = errors.New("builtin module not found")
+
+func checkModulesBuiltin(modulesPath, moduleName string) error {
+	f, err := os.Open(filepath.Join(modulesPath, "modules.builtin"))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	moduleName = strings.TrimSuffix(moduleName, ".ko")
+
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		line = strings.TrimSuffix(line, ".ko")
+		if strings.HasSuffix(line, "/"+moduleName) {
+			return nil
+		}
+	}
+
+	return fmt.Errorf("%w: %s", errBuiltinModuleNotFound, moduleName)
+}

internal/mod/configgz_linux.go

@@ -0,0 +1,132 @@
+package mod
+
+import (
+	"bufio"
+	"compress/gzip"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+)
+
+var (
+	errModuleNameUnknown     = errors.New("unknown module name")
+	errKernelFeatureIsModule = errors.New("kernel feature is a module, not built-in")
+	errKernelFeatureNotSet   = errors.New("kernel feature not set")
+	errKernelFeatureNotFound = errors.New("kernel feature not found")
+)
+
+// checkProcConfig checks /proc/config.gz for a the kernel feature corresponding
+// to the given module name. If the kernel feature is found and set to "y", it returns nil.
+// If the kernel feature is found and set to "m", it returns an error indicating that the kernel
+// feature is a module, not built-in.
+// If the kernel feature is found and not set, it returns an error indicating that the kernel
+// feature is not set. If the kernel feature is not found, it returns an error indicating that the kernel
+// feature is not found.
+func checkProcConfig(moduleName string) error {
+	f, err := os.Open("/proc/config.gz")
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		return fmt.Errorf("creating gzip reader: %w", err)
+	}
+	defer gz.Close()
+
+	// If any group of kernel features is satisfied, then the module is considered supported.
+	kernelFeatureGroups, ok := moduleNameToKernelFeatureGroups(moduleName)
+	if !ok {
+		return fmt.Errorf("%w: %s", errModuleNameUnknown, moduleName)
+	}
+	groups := make([]map[string]bool, len(kernelFeatureGroups))
+	for i, group := range kernelFeatureGroups {
+		featureToOK := make(map[string]bool)
+		for _, feature := range group {
+			featureToOK[feature] = false
+		}
+		groups[i] = featureToOK
+	}
+
+	scanner := bufio.NewScanner(gz)
+	for scanner.Scan() {
+		line := scanner.Text()
+		for _, featureToOK := range groups {
+			for name, ok := range featureToOK {
+				switch {
+				case ok:
+				case strings.HasPrefix(line, name+"=m"):
+					return fmt.Errorf("%w: %s", errKernelFeatureIsModule, name)
+				case strings.HasPrefix(line, name+"=y"):
+					featureToOK[name] = true
+					if allFeaturesOK(featureToOK) {
+						return nil
+					}
+				case strings.HasPrefix(line, "# "+name+" is not set"):
+					return fmt.Errorf("%w: %s", errKernelFeatureNotSet, name)
+				}
+			}
+		}
+	}
+
+	return fmt.Errorf("%w: for module name %s", errKernelFeatureNotFound, moduleName)
+}
+
+func moduleNameToKernelFeatureGroups(moduleName string) (featureGroups [][]string, ok bool) {
+	moduleMap := map[string][][]string{
+		"nf_tables": {{"CONFIG_NF_TABLES"}},
+
+		// Netfilter Matches
+		"xt_conntrack": {{"CONFIG_NETFILTER_XT_MATCH_CONNTRACK"}},
+		"xt_connmark": {
+			{"CONFIG_NETFILTER_XT_CONNMARK"},
+			{"CONFIG_NETFILTER_XT_MATCH_CONNMARK", "CONFIG_NETFILTER_XT_TARGET_CONNMARK"},
+		},
+		"xt_mark": {
+			{"CONFIG_NETFILTER_XT_MARK"},
+			{"CONFIG_NETFILTER_XT_MATCH_MARK", "CONFIG_NETFILTER_XT_TARGET_MARK"},
+		},
+		"nf_conntrack_netlink": {{"CONFIG_NF_CT_NETLINK"}},
+		"nf_reject_ipv4":       {{"CONFIG_NF_REJECT_IPV4"}},
+
+		// Common Netfilter Targets
+		"xt_log": {{"CONFIG_NETFILTER_XT_TARGET_LOG"}},
+		"xt_reject": {
+			{"CONFIG_IP_NF_TARGET_REJECT", "CONFIG_NF_REJECT_IPV4"},
+			{"CONFIG_NETFILTER_XT_TARGET_REJECT", "CONFIG_NF_REJECT_IPV4"},
+		},
+		"xt_masquerade": {{"CONFIG_NETFILTER_XT_TARGET_MASQUERADE"}},
+
+		// Additional Netfilter Matches
+		"xt_addrtype":  {{"CONFIG_NETFILTER_XT_MATCH_ADDRTYPE"}},
+		"xt_comment":   {{"CONFIG_NETFILTER_XT_MATCH_COMMENT"}},
+		"xt_multiport": {{"CONFIG_NETFILTER_XT_MATCH_MULTIPORT"}},
+		"xt_state":     {{"CONFIG_NETFILTER_XT_MATCH_STATE"}},
+		"xt_tcpudp":    {{"CONFIG_NETFILTER_XT_MATCH_TCPUDP"}},
+
+		// Tunneling and Virtualization
+		"tun":       {{"CONFIG_TUN"}},
+		"bridge":    {{"CONFIG_BRIDGE"}},
+		"veth":      {{"CONFIG_VETH"}},
+		"vxlan":     {{"CONFIG_VXLAN"}},
+		"wireguard": {{"CONFIG_WIREGUARD"}},
+
+		// Filesystems
+		"overlay": {{"CONFIG_OVERLAY_FS"}},
+		"fuse":    {{"CONFIG_FUSE_FS"}},
+	}
+
+	featureGroups, ok = moduleMap[strings.ToLower(moduleName)]
+	return featureGroups, ok
+}
+
+func allFeaturesOK(featureToOK map[string]bool) bool {
+	for _, ok := range featureToOK {
+		if !ok {
+			return false
+		}
+	}
+	return true
+}

internal/mod/info_linux.go

@@ -30,36 +30,7 @@ type moduleInfo struct {
 
 var ErrModulesDirectoryNotFound = errors.New("modules directory not found")
 
-func getModulesInfo() (modulesInfo map[string]moduleInfo, err error) {
-	var utsName unix.Utsname
-	err = unix.Uname(&utsName)
-	if err != nil {
-		return nil, fmt.Errorf("getting unix uname release: %w", err)
-	}
-	release := unix.ByteSliceToString(utsName.Release[:])
-	release = strings.TrimSpace(release)
-
-	modulePaths := []string{
-		filepath.Join("/lib/modules", release),
-		filepath.Join("/usr/lib/modules", release),
-	}
-
-	var modulesPath string
-	var found bool
-	for _, modulesPath = range modulePaths {
-		info, err := os.Stat(modulesPath)
-		if err == nil && info.IsDir() {
-			found = true
-			break
-		}
-	}
-
-	if !found {
-		return nil, fmt.Errorf("%w: %s are not valid existing directories"+
-			"; have you bind mounted the /lib/modules directory?",
-			ErrModulesDirectoryNotFound, strings.Join(modulePaths, ", "))
-	}
-
+func getModulesInfo(modulesPath string) (modulesInfo map[string]moduleInfo, err error) {
 	dependencyFilepath := filepath.Join(modulesPath, "modules.dep")
 	dependencyFile, err := os.Open(dependencyFilepath)
 	if err != nil {
@@ -111,6 +82,39 @@ func getModulesInfo() (modulesInfo map[string]moduleInfo, err error) {
 	return modulesInfo, nil
 }
 
+func getModulesPath() (string, error) {
+	release, err := getReleaseName()
+	if err != nil {
+		return "", fmt.Errorf("getting release name: %w", err)
+	}
+
+	modulePaths := []string{
+		filepath.Join("/lib/modules", release),
+		filepath.Join("/usr/lib/modules", release),
+	}
+
+	for _, modulesPath := range modulePaths {
+		info, err := os.Stat(modulesPath)
+		if err == nil && info.IsDir() {
+			return modulesPath, nil
+		}
+	}
+	return "", fmt.Errorf("%w: %s are not valid existing directories"+
+		"; have you bind mounted the /lib/modules directory?",
+		ErrModulesDirectoryNotFound, strings.Join(modulePaths, ", "))
+}
+
+func getReleaseName() (release string, err error) {
+	var utsName unix.Utsname
+	err = unix.Uname(&utsName)
+	if err != nil {
+		return "", fmt.Errorf("getting unix uname release: %w", err)
+	}
+	release = unix.ByteSliceToString(utsName.Release[:])
+	release = strings.TrimSpace(release)
+	return release, nil
+}
+
 func getBuiltinModules(modulesDirPath string, modulesInfo map[string]moduleInfo) error {
 	file, err := os.Open(filepath.Join(modulesDirPath, "modules.builtin"))
 	if err != nil {

internal/mod/probe_linux.go

@@ -1,12 +1,49 @@
 package mod
 
 import (
+	"errors"
 	"fmt"
 )
 
-// Probe loads the given kernel module and its dependencies.
+// Probe is a expanded version of modprobe, in which it checks if the Kernel
+// built-in features contain the given module name.
+// It first tries to locate the modules directory in [getModulesPath].
+// If it fails (like on WSL), it then only checks for the kernel feature
+// in /proc/config.gz with [checkProcConfig].
+// Otherwise, it first checks if the modules directory modules.builtin
+// file contains the given module name in [checkModulesBuiltin].
+// If the module is not found, it then runs the classic [modProbe] behavior,
+// trying to load the module in the kernel.
+// If this fails, it does one final try running [checkProcConfig].
 func Probe(moduleName string) error {
-	modulesInfo, err := getModulesInfo()
+	modulesPath, err := getModulesPath()
+	if err != nil {
+		if errors.Is(err, ErrModulesDirectoryNotFound) {
+			err = checkProcConfig(moduleName)
+			if err != nil {
+				return fmt.Errorf("checking /proc/config.gz: %w", err)
+			}
+			return nil
+		}
+		return fmt.Errorf("getting modules path: %w", err)
+	}
+
+	err = checkModulesBuiltin(modulesPath, moduleName)
+	if err != nil {
+		err = modProbe(modulesPath, moduleName)
+		if err != nil {
+			err = checkProcConfig(moduleName)
+			if err != nil {
+				return fmt.Errorf("checking /proc/config.gz: %w", err)
+			}
+		}
+	}
+	return nil
+}
+
+// modProbe is the classic modprobe behavior.
+func modProbe(modulesPath, moduleName string) error {
+	modulesInfo, err := getModulesInfo(modulesPath)
 	if err != nil {
 		return fmt.Errorf("getting modules information: %w", err)
 	}

internal/netlink/conntrack_linux.go

@@ -0,0 +1,44 @@
+package netlink
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/mdlayher/netlink"
+	"github.com/ti-mo/netfilter"
+	"golang.org/x/sys/unix"
+)
+
+var ErrConntrackNetlinkNotSupported = errors.New("nf_conntrack_netlink is not supported by the kernel")
+
+func (n *NetLink) FlushConntrack() error {
+	conn, err := netfilter.Dial(nil)
+	if err != nil {
+		if !n.conntrackNetlink {
+			err = fmt.Errorf("%w: %w", err, ErrConntrackNetlinkNotSupported)
+		}
+		return fmt.Errorf("dialing netfilter: %w", err)
+	}
+	defer conn.Close()
+
+	const ipCtnlMsgCtDelete = netfilter.MessageType(2)
+	header := netfilter.Header{
+		SubsystemID: netfilter.NFSubsysCTNetlink,
+		MessageType: ipCtnlMsgCtDelete,
+		Family:      unix.AF_UNSPEC,
+		Flags:       netlink.Request | netlink.Acknowledge,
+	}
+	request, err := netfilter.MarshalNetlink(header, nil)
+	if err != nil {
+		return fmt.Errorf("encoding netlink request: %w", err)
+	}
+
+	_, err = conn.Query(request)
+	if err != nil {
+		if !n.conntrackNetlink {
+			err = fmt.Errorf("%w: %w", err, ErrConntrackNetlinkNotSupported)
+		}
+		return fmt.Errorf("querying netlink request: %w", err)
+	}
+	return nil
+}

internal/netlink/conntrack_unspecified.go

@@ -0,0 +1,11 @@
+//go:build !linux
+
+package netlink
+
+import "errors"
+
+var ErrConntrackNetlinkNotSupported = errors.New("error not implemented")
+
+func (n *NetLink) FlushConntrack() error {
+	panic("not implemented")
+}

internal/netlink/netlink.go

@@ -1,14 +1,22 @@
 package netlink
 
-import "github.com/qdm12/log"
+import (
+	"github.com/qdm12/gluetun/internal/mod"
+	"github.com/qdm12/log"
+)
 
 type NetLink struct {
 	debugLogger DebugLogger
+
+	// Fixed state
+	conntrackNetlink bool
 }
 
 func New(debugLogger DebugLogger) *NetLink {
+	conntrackNetlink := mod.Probe("nf_conntrack_netlink") == nil
 	return &NetLink{
-		debugLogger: debugLogger,
+		debugLogger:      debugLogger,
+		conntrackNetlink: conntrackNetlink,
 	}
 }
 

internal/netlink/route.go

@@ -18,6 +18,7 @@ type Route struct {
 	Type      uint8
 	Scope     uint8
 	Proto     uint8
+	AdvMSS    uint32
 }
 
 func (r *Route) fromMessage(message rtnetlink.RouteMessage) {
@@ -35,6 +36,9 @@ func (r *Route) fromMessage(message rtnetlink.RouteMessage) {
 	r.Type = message.Type
 	r.Scope = message.Scope
 	r.Proto = message.Protocol
+	if metrics := message.Attributes.Metrics; metrics != nil {
+		r.AdvMSS = metrics.AdvMSS
+	}
 }
 
 func (r Route) message() *rtnetlink.RouteMessage {
@@ -58,7 +62,6 @@ func (r Route) message() *rtnetlink.RouteMessage {
 		Protocol:  r.Proto,
 		Attributes: rtnetlink.RouteAttributes{
 			OutIface: r.LinkIndex,
-			Dst:      *dst, // there should always be a dst for routes
 			Gateway:  netipAddrToNetIP(r.Gw),
 			Priority: r.Priority,
 			Table:    extendedTable,
@@ -67,6 +70,15 @@ func (r Route) message() *rtnetlink.RouteMessage {
 	if src != nil { // src is optional
 		message.Attributes.Src = *src
 	}
+	if dst != nil {
+		message.Attributes.Dst = *dst
+	}
+	if r.AdvMSS != 0 {
+		if message.Attributes.Metrics == nil {
+			message.Attributes.Metrics = &rtnetlink.RouteMetrics{}
+		}
+		message.Attributes.Metrics.AdvMSS = r.AdvMSS
+	}
 	return message
 }
 

internal/pmtud/constants/lengths.go

@@ -0,0 +1,24 @@
+package constants
+
+const (
+	MaxEthernetFrameSize uint32 = 1500
+	// MinIPv4MTU is defined according to
+	// https://en.wikipedia.org/wiki/Maximum_transmission_unit#MTUs_for_common_media
+	MinIPv4MTU uint32 = 68
+	MinIPv6MTU uint32 = 1280
+
+	IPv4HeaderLength uint32 = 20
+	IPv6HeaderLength uint32 = 40
+	UDPHeaderLength  uint32 = 8
+	// BaseTCPHeaderLength is the TCP header length without options,
+	// which is the minimum TCP header length.
+	BaseTCPHeaderLength uint32 = 20
+	// MaxTCPHeaderLength is the TCP header length with the maximum options length of 40 bytes.
+	// Note this is a hard maximum because of the 4-bit data offset field in the TCP header (15x4=60).
+	MaxTCPHeaderLength     uint32 = 60
+	WireguardHeaderLength  uint32 = 32
+	OpenVPNHeaderMaxLength uint32 = 1 + // opcode
+		8 + // session id
+		4 + // packet id
+		28 // max possible auth tag/iv
+)

internal/pmtud/constants/syscall_unix.go

@@ -0,0 +1,16 @@
+//go:build linux || darwin
+
+package constants
+
+import "golang.org/x/sys/unix"
+
+//nolint:revive
+const (
+	SOCK_RAW    = unix.SOCK_RAW
+	SOCK_STREAM = unix.SOCK_STREAM
+	AF_INET     = unix.AF_INET
+	AF_INET6    = unix.AF_INET6
+	IPPROTO_TCP = unix.IPPROTO_TCP
+	EAGAIN      = unix.EAGAIN
+	EWOULDBLOCK = unix.EWOULDBLOCK
+)

internal/pmtud/constants/syscall_windows.go

@@ -0,0 +1,13 @@
+package constants
+
+import "golang.org/x/sys/windows"
+
+const (
+	SOCK_RAW    = windows.SOCK_RAW
+	SOCK_STREAM = windows.SOCK_STREAM
+	AF_INET     = windows.AF_INET
+	AF_INET6    = windows.AF_INET6
+	IPPROTO_TCP = windows.IPPROTO_TCP
+	EAGAIN      = windows.WSAEWOULDBLOCK
+	EWOULDBLOCK = windows.WSAEWOULDBLOCK
+)

internal/pmtud/df_linux.go

@@ -1,10 +0,0 @@
-package pmtud
-
-import (
-	"syscall"
-)
-
-func setDontFragment(fd uintptr) (err error) {
-	return syscall.SetsockoptInt(int(fd), syscall.IPPROTO_IP,
-		syscall.IP_MTU_DISCOVER, syscall.IP_PMTUDISC_PROBE)
-}

internal/pmtud/df_windows.go

@@ -1,13 +0,0 @@
-//go:build windows
-
-package pmtud
-
-import (
-	"syscall"
-)
-
-func setDontFragment(fd uintptr) (err error) {
-	// https://docs.microsoft.com/en-us/troubleshoot/windows/win32/header-library-requirement-socket-ipproto-ip
-	// #define IP_DONTFRAGMENT        14     /* don't fragment IP datagrams */
-	return syscall.SetsockoptInt(syscall.Handle(fd), syscall.IPPROTO_IP, 14, 1)
-}

internal/pmtud/errors.go

@@ -1,29 +0,0 @@
-package pmtud
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"strings"
-	"time"
-)
-
-var (
-	ErrICMPNotPermitted                            = errors.New("ICMP not permitted")
-	ErrICMPDestinationUnreachable                  = errors.New("ICMP destination unreachable")
-	ErrICMPCommunicationAdministrativelyProhibited = errors.New("communication administratively prohibited")
-	ErrICMPBodyUnsupported                         = errors.New("ICMP body type is not supported")
-)
-
-func wrapConnErr(err error, timedCtx context.Context, pingTimeout time.Duration) error { //nolint:revive
-	switch {
-	case strings.HasSuffix(err.Error(), "sendto: operation not permitted"):
-		err = fmt.Errorf("%w", ErrICMPNotPermitted)
-	case errors.Is(timedCtx.Err(), context.DeadlineExceeded):
-		err = fmt.Errorf("%w (timed out after %s)", net.ErrClosed, pingTimeout)
-	case timedCtx.Err() != nil:
-		err = timedCtx.Err()
-	}
-	return err
-}

internal/pmtud/icmp/apple_ipv4.go

@@ -1,4 +1,4 @@
-package pmtud
+package icmp
 
 import (
 	"net"

internal/pmtud/icmp/check.go

@@ -1,4 +1,4 @@
-package pmtud
+package icmp
 
 import (
 	"bytes"
@@ -9,17 +9,17 @@ import (
 )
 
 var (
-	ErrICMPNextHopMTUTooLow  = errors.New("ICMP Next Hop MTU is too low")
-	ErrICMPNextHopMTUTooHigh = errors.New("ICMP Next Hop MTU is too high")
+	ErrNextHopMTUTooLow  = errors.New("ICMP Next Hop MTU is too low")
+	ErrNextHopMTUTooHigh = errors.New("ICMP Next Hop MTU is too high")
 )
 
 func checkMTU(mtu, minMTU, physicalLinkMTU uint32) (err error) {
 	switch {
 	case mtu < minMTU:
-		return fmt.Errorf("%w: %d", ErrICMPNextHopMTUTooLow, mtu)
+		return fmt.Errorf("%w: %d", ErrNextHopMTUTooLow, mtu)
 	case mtu > physicalLinkMTU:
 		return fmt.Errorf("%w: %d is larger than physical link MTU %d",
-			ErrICMPNextHopMTUTooHigh, mtu, physicalLinkMTU)
+			ErrNextHopMTUTooHigh, mtu, physicalLinkMTU)
 	default:
 		return nil
 	}
@@ -34,13 +34,13 @@ func checkInvokingReplyIDMatch(icmpProtocol int, received []byte,
 	}
 	inboundBody, ok := inboundMessage.Body.(*icmp.Echo)
 	if !ok {
-		return false, fmt.Errorf("%w: %T", ErrICMPBodyUnsupported, inboundMessage.Body)
+		return false, fmt.Errorf("%w: %T", ErrBodyUnsupported, inboundMessage.Body)
 	}
 	outboundBody := outboundMessage.Body.(*icmp.Echo) //nolint:forcetypeassert
 	return inboundBody.ID == outboundBody.ID, nil
 }
 
-var ErrICMPIDMismatch = errors.New("ICMP id mismatch")
+var ErrIDMismatch = errors.New("ICMP id mismatch")
 
 func checkEchoReply(icmpProtocol int, received []byte,
 	outboundMessage *icmp.Message, truncatedBody bool,
@@ -51,12 +51,12 @@ func checkEchoReply(icmpProtocol int, received []byte,
 	}
 	inboundBody, ok := inboundMessage.Body.(*icmp.Echo)
 	if !ok {
-		return fmt.Errorf("%w: %T", ErrICMPBodyUnsupported, inboundMessage.Body)
+		return fmt.Errorf("%w: %T", ErrBodyUnsupported, inboundMessage.Body)
 	}
 	outboundBody := outboundMessage.Body.(*icmp.Echo) //nolint:forcetypeassert
 	if inboundBody.ID != outboundBody.ID {
 		return fmt.Errorf("%w: sent id %d and received id %d",
-			ErrICMPIDMismatch, outboundBody.ID, inboundBody.ID)
+			ErrIDMismatch, outboundBody.ID, inboundBody.ID)
 	}
 	err = checkEchoBodies(outboundBody.Data, inboundBody.Data, truncatedBody)
 	if err != nil {
@@ -65,19 +65,19 @@ func checkEchoReply(icmpProtocol int, received []byte,
 	return nil
 }
 
-var ErrICMPEchoDataMismatch = errors.New("ICMP data mismatch")
+var ErrEchoDataMismatch = errors.New("ICMP data mismatch")
 
 func checkEchoBodies(sent, received []byte, receivedTruncated bool) (err error) {
 	if len(received) > len(sent) {
 		return fmt.Errorf("%w: sent %d bytes and received %d bytes",
-			ErrICMPEchoDataMismatch, len(sent), len(received))
+			ErrEchoDataMismatch, len(sent), len(received))
 	}
 	if receivedTruncated {
 		sent = sent[:len(received)]
 	}
 	if !bytes.Equal(received, sent) {
 		return fmt.Errorf("%w: sent %x and received %x",
-			ErrICMPEchoDataMismatch, sent, received)
+			ErrEchoDataMismatch, sent, received)
 	}
 	return nil
 }

internal/pmtud/icmp/df_linux.go

@@ -0,0 +1,14 @@
+package icmp
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+func setDontFragment(fd uintptr, ipv4 bool) (err error) {
+	if ipv4 {
+		return unix.SetsockoptInt(int(fd), unix.IPPROTO_IP,
+			unix.IP_MTU_DISCOVER, unix.IP_PMTUDISC_PROBE)
+	}
+	return unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6,
+		unix.IPV6_MTU_DISCOVER, unix.IPV6_PMTUDISC_PROBE)
+}

internal/pmtud/icmp/df_unspecified.go

@@ -1,10 +1,10 @@
 //go:build !linux && !windows
 
-package pmtud
+package icmp
 
 // setDontFragment for platforms other than Linux and Windows
 // is not implemented, so we just return assuming the don't
 // fragment flag is set on IP packets.
-func setDontFragment(fd uintptr) (err error) {
+func setDontFragment(fd uintptr, ipv4 bool) (err error) {
 	return nil
 }

internal/pmtud/icmp/df_windows.go

@@ -0,0 +1,14 @@
+package icmp
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+func setDontFragment(fd uintptr, ipv4 bool) (err error) {
+	if ipv4 {
+		// https://docs.microsoft.com/en-us/troubleshoot/windows/win32/header-library-requirement-socket-ipproto-ip
+		// #define IP_DONTFRAGMENT        14     /* don't fragment IP datagrams */
+		return windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, 14, 1)
+	}
+	return windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, 14, 1)
+}

internal/pmtud/icmp/errors.go

@@ -0,0 +1,30 @@
+package icmp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+var (
+	ErrNotPermitted                            = errors.New("ICMP not permitted")
+	ErrDestinationUnreachable                  = errors.New("ICMP destination unreachable")
+	ErrCommunicationAdministrativelyProhibited = errors.New("communication administratively prohibited")
+	ErrBodyUnsupported                         = errors.New("ICMP body type is not supported")
+	ErrMTUNotFound                             = errors.New("MTU not found")
+	errTimeout                                 = errors.New("operation timed out")
+)
+
+func wrapConnErr(err error, timedCtx context.Context, pingTimeout time.Duration) error { //nolint:revive
+	switch {
+	case strings.HasSuffix(err.Error(), "sendto: operation not permitted"):
+		err = fmt.Errorf("%w", ErrNotPermitted)
+	case errors.Is(timedCtx.Err(), context.DeadlineExceeded):
+		err = fmt.Errorf("%w: after %s", errTimeout, pingTimeout)
+	case timedCtx.Err() != nil:
+		err = timedCtx.Err()
+	}
+	return err
+}

internal/pmtud/icmp/icmp.go

@@ -0,0 +1,52 @@
+package icmp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+)
+
+// PathMTUDiscover discovers the path MTU to the given IP address
+// using ICMP.
+// It first tries to get the next hop MTU using ICMP messages.
+// If that fails, it falls back to sending echo requests with
+// different packet sizes to find the maximum MTU.
+// The function returns [ErrMTUNotFound] if the MTU could not be determined.
+func PathMTUDiscover(ctx context.Context, ip netip.Addr,
+	physicalLinkMTU uint32, timeout time.Duration, logger Logger,
+) (mtu uint32, err error) {
+	if ip.Is4() {
+		logger.Debugf("finding IPv4 next hop MTU to %s", ip)
+		mtu, err = findIPv4NextHopMTU(ctx, ip, physicalLinkMTU, timeout, logger)
+		switch {
+		case err == nil:
+			return mtu, nil
+		case errors.Is(err, errTimeout) || errors.Is(err, ErrCommunicationAdministrativelyProhibited): // blackhole
+		default:
+			return 0, fmt.Errorf("finding IPv4 next hop MTU to %s: %w", ip, err)
+		}
+	} else {
+		logger.Debugf("requesting IPv6 ICMP packet-too-big reply from %s", ip)
+		mtu, err = getIPv6PacketTooBig(ctx, ip, physicalLinkMTU, timeout, logger)
+		switch {
+		case err == nil:
+			return mtu, nil
+		case errors.Is(err, errTimeout): // blackhole
+		default:
+			return 0, fmt.Errorf("getting IPv6 packet-too-big message: %w", err)
+		}
+	}
+
+	// Fall back method: send echo requests with different packet
+	// sizes and check which ones succeed to find the maximum MTU.
+	logger.Debugf("falling back to sending different sized echo packets to %s", ip)
+	minMTU := constants.MinIPv4MTU
+	if ip.Is6() {
+		minMTU = constants.MinIPv6MTU
+	}
+	return pmtudMultiSizes(ctx, ip, minMTU, physicalLinkMTU, timeout, logger)
+}

internal/pmtud/icmp/interfaces.go

@@ -0,0 +1,7 @@
+package icmp
+
+type Logger interface {
+	Debug(msg string)
+	Debugf(msg string, args ...any)
+	Warnf(msg string, args ...any)
+}

internal/pmtud/icmp/ipv4.go

@@ -1,4 +1,4 @@
-package pmtud
+package icmp
 
 import (
 	"context"
@@ -11,14 +11,13 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
 	"golang.org/x/net/icmp"
 	"golang.org/x/net/ipv4"
 )
 
 const (
-	// see https://en.wikipedia.org/wiki/Maximum_transmission_unit#MTUs_for_common_media
-	minIPv4MTU     uint32 = 68
-	icmpv4Protocol int    = 1
+	icmpv4Protocol = 1
 )
 
 func listenICMPv4(ctx context.Context) (conn net.PacketConn, err error) {
@@ -26,7 +25,8 @@ func listenICMPv4(ctx context.Context) (conn net.PacketConn, err error) {
 	listenConfig.Control = func(_, _ string, rawConn syscall.RawConn) error {
 		var setDFErr error
 		err := rawConn.Control(func(fd uintptr) {
-			setDFErr = setDontFragment(fd) // runs when calling ListenPacket
+			const ipv4 = true
+			setDFErr = setDontFragment(fd, ipv4) // runs when calling ListenPacket
 		})
 		if err == nil {
 			err = setDFErr
@@ -38,7 +38,7 @@ func listenICMPv4(ctx context.Context) (conn net.PacketConn, err error) {
 	packetConn, err := listenConfig.ListenPacket(ctx, "ip4:icmp", listenAddress)
 	if err != nil {
 		if strings.HasSuffix(err.Error(), "socket: operation not permitted") {
-			err = fmt.Errorf("%w: you can try adding NET_RAW capability to resolve this", ErrICMPNotPermitted)
+			err = fmt.Errorf("%w: you can try adding NET_RAW capability to resolve this", ErrNotPermitted)
 		}
 		return nil, err
 	}
@@ -83,7 +83,9 @@ func findIPv4NextHopMTU(ctx context.Context, ip netip.Addr,
 
 	buffer := make([]byte, physicalLinkMTU)
 
-	for { // for loop in case we read an echo reply for another ICMP request
+	// for loop in case we read an ICMP message from another ICMP request
+	// or TCP/UDP traffic triggering an ICMP response.
+	for {
 		// Note we need to read the whole packet in one call to ReadFrom, so the buffer
 		// must be large enough to read the entire reply packet. See:
 		// https://groups.google.com/g/golang-nuts/c/5dy2Q4nPs08/m/KmuSQAGEtG4J
@@ -108,24 +110,27 @@ func findIPv4NextHopMTU(ctx context.Context, ip netip.Addr,
 		switch typedBody := inboundMessage.Body.(type) {
 		case *icmp.DstUnreach:
 			const fragmentationRequiredAndDFFlagSetCode = 4
+			const portUnreachable = 3
 			const communicationAdministrativelyProhibitedCode = 13
 			switch inboundMessage.Code {
 			case fragmentationRequiredAndDFFlagSetCode:
+			case portUnreachable: // triggered by TCP or UDP from applications
+				continue // ignore and wait for the next message
 			case communicationAdministrativelyProhibitedCode:
 				return 0, fmt.Errorf("%w: %w (code %d)",
-					ErrICMPDestinationUnreachable,
-					ErrICMPCommunicationAdministrativelyProhibited,
+					ErrDestinationUnreachable,
+					ErrCommunicationAdministrativelyProhibited,
 					inboundMessage.Code)
 			default:
 				return 0, fmt.Errorf("%w: code %d",
-					ErrICMPDestinationUnreachable, inboundMessage.Code)
+					ErrDestinationUnreachable, inboundMessage.Code)
 			}
 
 			// See https://datatracker.ietf.org/doc/html/rfc1191#section-4
 			// Note: the go library does not handle this NextHopMTU section.
 			nextHopMTU := packetBytes[6:8]
 			mtu = uint32(binary.BigEndian.Uint16(nextHopMTU))
-			err = checkMTU(mtu, minIPv4MTU, physicalLinkMTU)
+			err = checkMTU(mtu, constants.MinIPv4MTU, physicalLinkMTU)
 			if err != nil {
 				return 0, fmt.Errorf("checking next-hop-mtu found: %w", err)
 			}
@@ -153,7 +158,7 @@ func findIPv4NextHopMTU(ctx context.Context, ip netip.Addr,
 				inboundID, outboundID)
 			continue
 		default:
-			return 0, fmt.Errorf("%w: %T", ErrICMPBodyUnsupported, typedBody)
+			return 0, fmt.Errorf("%w: %T", ErrBodyUnsupported, typedBody)
 		}
 	}
 }

internal/pmtud/icmp/ipv6.go

@@ -1,4 +1,4 @@
-package pmtud
+package icmp
 
 import (
 	"context"
@@ -6,24 +6,36 @@ import (
 	"net"
 	"net/netip"
 	"strings"
+	"syscall"
 	"time"
 
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
 	"golang.org/x/net/icmp"
 	"golang.org/x/net/ipv6"
 )
 
 const (
-	minIPv6MTU     = 1280
 	icmpv6Protocol = 58
 )
 
 func listenICMPv6(ctx context.Context) (conn net.PacketConn, err error) {
 	var listenConfig net.ListenConfig
+	listenConfig.Control = func(_, _ string, rawConn syscall.RawConn) error {
+		var setDFErr error
+		err := rawConn.Control(func(fd uintptr) {
+			const ipv4 = false
+			setDFErr = setDontFragment(fd, ipv4) // runs when calling ListenPacket
+		})
+		if err == nil {
+			err = setDFErr
+		}
+		return err
+	}
 	const listenAddress = ""
 	packetConn, err := listenConfig.ListenPacket(ctx, "ip6:ipv6-icmp", listenAddress)
 	if err != nil {
 		if strings.HasSuffix(err.Error(), "socket: operation not permitted") {
-			err = fmt.Errorf("%w: you can try adding NET_RAW capability to resolve this", ErrICMPNotPermitted)
+			err = fmt.Errorf("%w: you can try adding NET_RAW capability to resolve this", ErrNotPermitted)
 		}
 		return nil, err
 	}
@@ -85,7 +97,7 @@ func getIPv6PacketTooBig(ctx context.Context, ip netip.Addr,
 		case *icmp.PacketTooBig:
 			// https://datatracker.ietf.org/doc/html/rfc1885#section-3.2
 			mtu = uint32(typedBody.MTU) //nolint:gosec
-			err = checkMTU(mtu, minIPv6MTU, physicalLinkMTU)
+			err = checkMTU(mtu, constants.MinIPv6MTU, physicalLinkMTU)
 			if err != nil {
 				return 0, fmt.Errorf("checking MTU: %w", err)
 			}
@@ -103,7 +115,7 @@ func getIPv6PacketTooBig(ctx context.Context, ip netip.Addr,
 			if err != nil {
 				return 0, fmt.Errorf("checking invoking message id: %w", err)
 			} else if idMatch {
-				return 0, fmt.Errorf("%w", ErrICMPDestinationUnreachable)
+				return 0, fmt.Errorf("%w", ErrDestinationUnreachable)
 			}
 			logger.Debug("discarding received ICMP destination unreachable reply with an unknown id")
 			continue
@@ -116,7 +128,7 @@ func getIPv6PacketTooBig(ctx context.Context, ip netip.Addr,
 				inboundID, outboundID)
 			continue
 		default:
-			return 0, fmt.Errorf("%w: %T", ErrICMPBodyUnsupported, typedBody)
+			return 0, fmt.Errorf("%w: %T", ErrBodyUnsupported, typedBody)
 		}
 	}
 }

internal/pmtud/icmp/message.go

@@ -1,4 +1,4 @@
-package pmtud
+package icmp
 
 import (
 	cryptorand "crypto/rand"

internal/pmtud/icmp/multi.go

@@ -0,0 +1,193 @@
+package icmp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"strings"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/pmtud/test"
+	"golang.org/x/net/icmp"
+)
+
+type icmpTestUnit struct {
+	mtu       uint32
+	echoID    uint16
+	sentBytes int
+	ok        bool
+}
+
+func pmtudMultiSizes(ctx context.Context, ip netip.Addr,
+	minMTU, maxPossibleMTU uint32, pingTimeout time.Duration,
+	logger Logger,
+) (maxMTU uint32, err error) {
+	var ipVersion string
+	var conn net.PacketConn
+	if ip.Is4() {
+		ipVersion = "v4"
+		conn, err = listenICMPv4(ctx)
+	} else {
+		ipVersion = "v6"
+		conn, err = listenICMPv6(ctx)
+	}
+	if err != nil {
+		if strings.HasSuffix(err.Error(), "socket: operation not permitted") {
+			err = fmt.Errorf("%w: you can try adding NET_RAW capability to resolve this", ErrNotPermitted)
+		}
+		return 0, fmt.Errorf("listening for ICMP packets: %w", err)
+	}
+
+	mtusToTest := test.MakeMTUsToTest(minMTU, maxPossibleMTU)
+	if len(mtusToTest) == 1 { // only minMTU because minMTU == maxPossibleMTU
+		return minMTU, nil
+	}
+	logger.Debugf("ICMP testing the following MTUs: %v", mtusToTest)
+
+	tests := make([]icmpTestUnit, len(mtusToTest))
+	for i := range mtusToTest {
+		tests[i] = icmpTestUnit{mtu: mtusToTest[i]}
+	}
+
+	timedCtx, cancel := context.WithTimeout(ctx, pingTimeout)
+	defer cancel()
+	go func() {
+		<-timedCtx.Done()
+		conn.Close()
+	}()
+
+	for i := range tests {
+		id, message := buildMessageToSend(ipVersion, tests[i].mtu)
+		tests[i].echoID = id
+
+		encodedMessage, err := message.Marshal(nil)
+		if err != nil {
+			return 0, fmt.Errorf("encoding ICMP message: %w", err)
+		}
+		tests[i].sentBytes = len(encodedMessage)
+
+		_, err = conn.WriteTo(encodedMessage, &net.IPAddr{IP: ip.AsSlice()})
+		if err != nil {
+			if strings.HasSuffix(err.Error(), "sendto: operation not permitted") {
+				err = fmt.Errorf("%w", ErrNotPermitted)
+			}
+			return 0, fmt.Errorf("writing ICMP message: %w", err)
+		}
+	}
+
+	err = collectReplies(conn, ipVersion, tests, logger)
+	switch {
+	case err == nil: // max possible MTU is working
+		return tests[len(tests)-1].mtu, nil
+	case err != nil && errors.Is(err, net.ErrClosed):
+		// we have timeouts (IPv4 testing or IPv6 PMTUD blackholes)
+		// so find the highest MTU which worked.
+		// Note we start from index len(tests) - 2 since the max MTU
+		// cannot be working if we had a timeout.
+		for i := len(tests) - 2; i >= 0; i-- { //nolint:mnd
+			if tests[i].ok {
+				return pmtudMultiSizes(ctx, ip, tests[i].mtu, tests[i+1].mtu-1,
+					pingTimeout, logger)
+			}
+		}
+
+		// All MTUs failed.
+		return 0, fmt.Errorf("%w: ICMP might be blocked", ErrMTUNotFound)
+	case err != nil:
+		return 0, fmt.Errorf("collecting ICMP echo replies: %w", err)
+	default:
+		panic("unreachable")
+	}
+}
+
+// The theoretical limit is 4GiB for IPv6 MTU path discovery jumbograms, but that would
+// create huge buffers which we don't really want to support anyway.
+// The standard frame maximum MTU is 1500 bytes, and there are Jumbo frames with
+// a conventional maximum of 9000 bytes. However, some manufacturers support up
+// 9216-20 = 9196 bytes for the maximum MTU. We thus use buffers of size 9196 to
+// match eventual Jumbo frames. More information at:
+// https://en.wikipedia.org/wiki/Maximum_transmission_unit#MTUs_for_common_media
+const maxPossibleMTU = 9196
+
+func collectReplies(conn net.PacketConn, ipVersion string,
+	tests []icmpTestUnit, logger Logger,
+) (err error) {
+	echoIDToTestIndex := make(map[uint16]int, len(tests))
+	for i, test := range tests {
+		echoIDToTestIndex[test.echoID] = i
+	}
+
+	buffer := make([]byte, maxPossibleMTU)
+
+	idsFound := 0
+	for idsFound < len(tests) {
+		// Note we need to read the whole packet in one call to ReadFrom, so the buffer
+		// must be large enough to read the entire reply packet. See:
+		// https://groups.google.com/g/golang-nuts/c/5dy2Q4nPs08/m/KmuSQAGEtG4J
+		bytesRead, _, err := conn.ReadFrom(buffer)
+		if err != nil {
+			return fmt.Errorf("reading from ICMP connection: %w", err)
+		}
+		packetBytes := buffer[:bytesRead]
+
+		ipPacketLength := len(packetBytes)
+
+		var icmpProtocol int
+		switch ipVersion {
+		case "v4":
+			icmpProtocol = icmpv4Protocol
+		case "v6":
+			icmpProtocol = icmpv6Protocol
+		default:
+			panic(fmt.Sprintf("unknown IP version: %s", ipVersion))
+		}
+
+		// Parse the ICMP message
+		// Note: this parsing works for a truncated 556 bytes ICMP reply packet.
+		message, err := icmp.ParseMessage(icmpProtocol, packetBytes)
+		if err != nil {
+			return fmt.Errorf("parsing message: %w", err)
+		}
+
+		switch message.Body.(type) {
+		case *icmp.Echo:
+		case *icmp.DstUnreach, *icmp.TimeExceeded:
+			logger.Debugf("ignoring ICMP message (type: %d, code: %d)", message.Type, message.Code)
+			continue
+		default:
+			return fmt.Errorf("%w: %T", ErrBodyUnsupported, message.Body)
+		}
+
+		echoBody, _ := message.Body.(*icmp.Echo)
+
+		id := uint16(echoBody.ID) //nolint:gosec
+		testIndex, testing := echoIDToTestIndex[id]
+		if !testing { // not an id we expected so ignore it
+			logger.Warnf("ignoring ICMP reply with unexpected ID %d (type: %d, code: %d, length: %d)",
+				echoBody.ID, message.Type, message.Code, ipPacketLength)
+			continue
+		}
+		idsFound++
+		sentBytes := tests[testIndex].sentBytes
+
+		// echo reply should be at most the number of bytes sent,
+		// and can be lower, more precisely 556 bytes, in case
+		// the host we are reaching wants to stay out of trouble
+		// and ensure its echo reply goes through without
+		// fragmentation, see the following page:
+		// https://datatracker.ietf.org/doc/html/rfc1122#page-59
+		const conservativeReplyLength = 556
+		truncated := ipPacketLength < sentBytes &&
+			ipPacketLength == conservativeReplyLength
+		// Check the packet size is the same if the reply is not truncated
+		if !truncated && sentBytes != ipPacketLength {
+			return fmt.Errorf("%w: sent %dB and received %dB",
+				ErrEchoDataMismatch, sentBytes, ipPacketLength)
+		}
+		// Truncated reply or matching reply size
+		tests[testIndex].ok = true
+	}
+	return nil
+}

internal/pmtud/ip/family.go

@@ -0,0 +1,27 @@
+package ip
+
+import (
+	"net/netip"
+	"slices"
+
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+)
+
+func GetFamilies(dsts []netip.AddrPort) (families []int) {
+	const maxFamilies = 2
+	families = make([]int, 0, maxFamilies)
+	for _, dst := range dsts {
+		family := GetFamily(dst)
+		if !slices.Contains(families, family) {
+			families = append(families, family)
+		}
+	}
+	return families
+}
+
+func GetFamily(dst netip.AddrPort) int {
+	if dst.Addr().Is4() {
+		return constants.AF_INET
+	}
+	return constants.AF_INET6
+}

internal/pmtud/ip/ipheader.go

@@ -0,0 +1,79 @@
+package ip
+
+import (
+	"encoding/binary"
+	"net/netip"
+
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+)
+
+func HeaderLength(ipv4 bool) uint32 {
+	if ipv4 {
+		return constants.IPv4HeaderLength
+	}
+	return constants.IPv6HeaderLength
+}
+
+func HeaderV4(srcIP, dstIP netip.Addr, payloadLength uint32) []byte {
+	ipHeader := make([]byte, constants.IPv4HeaderLength)
+	const version byte = 4
+	const headerLength byte = 20 / 4                                          // in 32-bit words
+	ipHeader[0] = (version << 4) | headerLength                               //nolint:mnd
+	ipHeader[1] = 0                                                           // type of Service
+	putUint16(ipHeader[2:], uint16(constants.IPv4HeaderLength+payloadLength)) //nolint:gosec
+	ipHeader[4], ipHeader[5] = 0, 0                                           // identification
+	const flagsAndOffset uint16 = 0x4000                                      // DF bit set
+	putUint16(ipHeader[6:], flagsAndOffset)
+	ipHeader[8] = 64 // ttl
+	ipHeader[9] = constants.IPPROTO_TCP
+	srcIPBytes := srcIP.As4()
+	copy(ipHeader[12:16], srcIPBytes[:])
+	dstIPBytes := dstIP.As4()
+	copy(ipHeader[16:20], dstIPBytes[:])
+
+	checksum := ipChecksum(ipHeader)
+	ipHeader[10] = byte(checksum >> 8)   //nolint:mnd
+	ipHeader[11] = byte(checksum & 0xff) //nolint:mnd
+
+	return ipHeader
+}
+
+// ipChecksum calculates the checksum for the IP header.
+//
+//nolint:mnd
+func ipChecksum(header []byte) uint16 {
+	sum := uint32(0)
+	for i := 0; i < len(header)-1; i += 2 {
+		sum += uint32(header[i])<<8 + uint32(header[i+1])
+	}
+	if len(header)%2 != 0 {
+		sum += uint32(header[len(header)-1]) << 8
+	}
+	for (sum >> 16) > 0 {
+		sum = (sum & 0xFFFF) + (sum >> 16)
+	}
+	return ^uint16(sum) //nolint:gosec
+}
+
+// HeaderV6 makes an IPv6 header.
+// payloadLen is the length of the payload following the header.
+// nextHeader can be byte([constants.IPPROTO_TCP]) for example.
+func HeaderV6(srcIP, dstIP netip.Addr,
+	payloadLen uint16, nextHeader byte,
+) []byte {
+	ipv6Header := make([]byte, constants.IPv6HeaderLength)
+	ipv6Header[0] = 0x60 // version (4 bits) | traffic Class (4 bits)
+	ipv6Header[1] = 0x00 // traffic Class (4 bits) | flow label (4 bits)
+
+	// Flow Label (remaining 16 bits)
+	ipv6Header[2] = 0x00
+	ipv6Header[3] = 0x00
+
+	binary.BigEndian.PutUint16(ipv6Header[4:], payloadLen)
+	ipv6Header[6] = nextHeader
+	const hopLimit = 64
+	ipv6Header[7] = hopLimit
+	copy(ipv6Header[8:24], srcIP.AsSlice())
+	copy(ipv6Header[24:40], dstIP.AsSlice())
+	return ipv6Header
+}

internal/pmtud/ip/ipheader_darwin.go

@@ -0,0 +1,9 @@
+package ip
+
+import (
+	"encoding/binary"
+)
+
+func putUint16(b []byte, v uint16) {
+	binary.NativeEndian.PutUint16(b, v)
+}

internal/pmtud/ip/ipheader_unspecified.go

@@ -0,0 +1,9 @@
+//go:build !darwin
+
+package ip
+
+import "encoding/binary"
+
+func putUint16(b []byte, v uint16) {
+	binary.BigEndian.PutUint16(b, v)
+}

internal/pmtud/ip/ipv4_unix.go

@@ -0,0 +1,9 @@
+//go:build linux || darwin
+
+package ip
+
+import "golang.org/x/sys/unix"
+
+func SetIPv4HeaderIncluded(fd int) error {
+	return unix.SetsockoptInt(fd, unix.IPPROTO_IP, unix.IP_HDRINCL, 1)
+}

internal/pmtud/ip/ipv4_unspecified.go

@@ -0,0 +1,7 @@
+//go:build !linux && !windows && !darwin
+
+package ip
+
+func SetIPv4HeaderIncluded(fd int) error {
+	panic("not implemented")
+}

internal/pmtud/ip/ipv4_windows.go

@@ -0,0 +1,10 @@
+package ip
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+func SetIPv4HeaderIncluded(handle windows.Handle) error {
+	const ipHdrIncluded = windows.IP_HDRINCL
+	return windows.SetsockoptInt(handle, windows.IPPROTO_IP, ipHdrIncluded, 1)
+}

internal/pmtud/ip/source.go

@@ -0,0 +1,113 @@
+package ip
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"syscall"
+
+	"github.com/jsimonetti/rtnetlink"
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+)
+
+// SrcAddr determines the appropriate source IP address to use when sending a packet to the
+// specified destination. It also reserves an ephemeral source port for the specified protocol
+// to ensure that the port is not used by other processes. The cleanup function returned should
+// be called to release the reserved port when done.
+func SrcAddr(dst netip.AddrPort, proto int) (src netip.AddrPort, cleanup func(), err error) {
+	srcAddr, err := srcIP(dst.Addr())
+	if err != nil {
+		return netip.AddrPort{}, nil, fmt.Errorf("finding source IP: %w", err)
+	}
+
+	srcPort, cleanup, err := srcPort(srcAddr, proto)
+	if err != nil {
+		return netip.AddrPort{}, nil, fmt.Errorf("reserving source port: %w", err)
+	}
+
+	return netip.AddrPortFrom(srcAddr, srcPort), cleanup, nil
+}
+
+var (
+	errNoRoute            = fmt.Errorf("no route to destination")
+	ErrNetworkUnreachable = errors.New("network unreachable")
+)
+
+func srcIP(dst netip.Addr) (netip.Addr, error) {
+	conn, err := rtnetlink.Dial(nil)
+	if err != nil {
+		return netip.Addr{}, err
+	}
+	defer conn.Close()
+
+	family := uint8(constants.AF_INET)
+	if dst.Is6() {
+		family = constants.AF_INET6
+	}
+
+	// Request route to destination
+	requestMessage := &rtnetlink.RouteMessage{
+		Family: family,
+		Attributes: rtnetlink.RouteAttributes{
+			Dst: dst.AsSlice(),
+		},
+	}
+	messages, err := conn.Route.Get(requestMessage)
+	if err != nil {
+		var sysErr syscall.Errno
+		if errors.As(err, &sysErr) && sysErr == syscall.ENETUNREACH {
+			err = ErrNetworkUnreachable
+		}
+		return netip.Addr{}, fmt.Errorf("getting routes to %s: %w", dst, err)
+	}
+
+	for _, message := range messages {
+		if message.Attributes.Src == nil {
+			continue
+		}
+		ipv6 := message.Attributes.Src.To4() == nil
+		if ipv6 {
+			return netip.AddrFrom16([16]byte(message.Attributes.Src)), nil
+		}
+		return netip.AddrFrom4([4]byte(message.Attributes.Src)), nil
+	}
+
+	return netip.Addr{}, fmt.Errorf("%w: in %d route(s)", errNoRoute, len(messages))
+}
+
+// srcPort reserves an ephemeral source port by opening a socket for the
+// protocol specified and binds it to the provided source address.
+// It doesn't actually listen on the port.
+// The cleanup function returned should be called to release the port when done.
+func srcPort(srcAddr netip.Addr, proto int) (srcPort uint16, cleanup func(), err error) {
+	family := constants.AF_INET
+	if srcAddr.Is6() {
+		family = constants.AF_INET6
+	}
+
+	fd, err := socket(family, constants.SOCK_STREAM, proto)
+	if err != nil {
+		return 0, nil, fmt.Errorf("creating reservation socket: %w", err)
+	}
+	cleanup = func() {
+		_ = closeSocket(fd)
+	}
+
+	// Bind to port 0 to get an ephemeral port
+	const port = 0
+	bindAddr := makeSockAddr(srcAddr, port)
+
+	err = bind(fd, bindAddr)
+	if err != nil {
+		cleanup()
+		return 0, nil, fmt.Errorf("binding reservation socket: %w", err)
+	}
+
+	srcPort, err = extractPortFromFD(fd)
+	if err != nil {
+		cleanup()
+		return 0, nil, fmt.Errorf("extracting port from socket fd: %w", err)
+	}
+
+	return srcPort, cleanup, nil
+}

internal/pmtud/ip/source_unix.go

@@ -0,0 +1,51 @@
+//go:build linux || darwin
+
+package ip
+
+import (
+	"fmt"
+	"net/netip"
+
+	"golang.org/x/sys/unix"
+)
+
+func socket(domain int, typ int, proto int) (fd int, err error) {
+	return unix.Socket(domain, typ, proto)
+}
+
+func closeSocket(fd int) error {
+	return unix.Close(fd)
+}
+
+func bind(fd int, addr unix.Sockaddr) error {
+	return unix.Bind(fd, addr)
+}
+
+func makeSockAddr(ip netip.Addr, port uint16) unix.Sockaddr {
+	if ip.Is4() {
+		return &unix.SockaddrInet4{
+			Port: int(port),
+			Addr: ip.As4(),
+		}
+	}
+	return &unix.SockaddrInet6{
+		Port: 0,
+		Addr: ip.As16(),
+	}
+}
+
+func extractPortFromFD(fd int) (uint16, error) {
+	sockAddr, err := unix.Getsockname(fd)
+	if err != nil {
+		return 0, fmt.Errorf("getting sockname: %w", err)
+	}
+
+	switch typedSockAddr := sockAddr.(type) {
+	case *unix.SockaddrInet4:
+		return uint16(typedSockAddr.Port), nil //nolint:gosec
+	case *unix.SockaddrInet6:
+		return uint16(typedSockAddr.Port), nil //nolint:gosec
+	default:
+		panic(fmt.Sprintf("unexpected sockaddr type: %T", typedSockAddr))
+	}
+}

internal/pmtud/ip/source_windows.go

@@ -0,0 +1,49 @@
+package ip
+
+import (
+	"fmt"
+	"net/netip"
+
+	"golang.org/x/sys/windows"
+)
+
+func socket(domain int, typ int, proto int) (fd windows.Handle, err error) {
+	return windows.Socket(domain, typ, proto)
+}
+
+func closeSocket(fd windows.Handle) error {
+	return windows.Close(fd)
+}
+
+func bind(fd windows.Handle, addr windows.Sockaddr) error {
+	return windows.Bind(fd, addr)
+}
+
+func makeSockAddr(ip netip.Addr, port uint16) windows.Sockaddr {
+	if ip.Is4() {
+		return &windows.SockaddrInet4{
+			Port: int(port),
+			Addr: ip.As4(),
+		}
+	}
+	return &windows.SockaddrInet6{
+		Port: int(port),
+		Addr: ip.As16(),
+	}
+}
+
+func extractPortFromFD(fd windows.Handle) (uint16, error) {
+	sockAddr, err := windows.Getsockname(fd)
+	if err != nil {
+		return 0, fmt.Errorf("getting sockname: %w", err)
+	}
+
+	switch typedSockAddr := sockAddr.(type) {
+	case *windows.SockaddrInet4:
+		return uint16(typedSockAddr.Port), nil //nolint:gosec
+	case *windows.SockaddrInet6:
+		return uint16(typedSockAddr.Port), nil //nolint:gosec
+	default:
+		panic(fmt.Sprintf("unexpected sockaddr type: %T", typedSockAddr))
+	}
+}

internal/pmtud/pmtud.go

@@ -4,268 +4,88 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math"
-	"net"
 	"net/netip"
-	"strings"
 	"time"
 
-	"golang.org/x/net/icmp"
+	"github.com/qdm12/gluetun/internal/firewall/iptables"
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/qdm12/gluetun/internal/pmtud/icmp"
+	"github.com/qdm12/gluetun/internal/pmtud/tcp"
 )
 
-var ErrMTUNotFound = errors.New("path MTU discovery failed to find MTU")
+var (
+	ErrICMPOkTCPFail   = errors.New("PMTUD succeeded with ICMP but failed with TCP")
+	ErrICMPFailTCPFail = errors.New("PMTUD failed with both ICMP and TCP")
+)
 
-// PathMTUDiscover discovers the maximum MTU for the path to the given ip address.
+// PathMTUDiscover discovers the maximum MTU using both ICMP and TCP.
+// Multiple ICMP addresses and TCP addresses can be specified for redundancy.
+// ICMP PMTUD is run first. If successful, the range of possible MTU values to
+// check for TCP PMTUD is reduced to [maxMTU-150, maxMTU] where maxMTU is the
+// maximum MTU found with ICMP PMTUD. Otherwise, TCP PMTUD is run with the
+// whole range of possible MTU values up to the physical link MTU to check.
 // If the physicalLinkMTU is zero, it defaults to 1500 which is the ethernet standard MTU.
 // If the pingTimeout is zero, it defaults to 1 second.
 // If the logger is nil, a no-op logger is used.
 // It returns [ErrMTUNotFound] if the MTU could not be determined.
-func PathMTUDiscover(ctx context.Context, ip netip.Addr,
-	physicalLinkMTU uint32, pingTimeout time.Duration, logger Logger) (
+func PathMTUDiscover(ctx context.Context, icmpAddrs []netip.Addr, tcpAddrs []netip.AddrPort,
+	physicalLinkMTU uint32, tryTimeout time.Duration, fw tcp.Firewall, logger Logger) (
 	mtu uint32, err error,
 ) {
 	if physicalLinkMTU == 0 {
 		const ethernetStandardMTU = 1500
 		physicalLinkMTU = ethernetStandardMTU
 	}
-	if pingTimeout == 0 {
-		pingTimeout = time.Second
+	if tryTimeout == 0 {
+		tryTimeout = time.Second
 	}
 	if logger == nil {
 		logger = &noopLogger{}
 	}
 
-	if ip.Is4() {
-		logger.Debug("finding IPv4 next hop MTU")
-		mtu, err = findIPv4NextHopMTU(ctx, ip, physicalLinkMTU, pingTimeout, logger)
+	// Try finding the MTU using ICMP
+	maxPossibleMTU := physicalLinkMTU
+	icmpSuccess := false
+	for _, icmpIP := range icmpAddrs {
+		mtu, err := icmp.PathMTUDiscover(ctx, icmpIP, physicalLinkMTU,
+			tryTimeout, logger)
 		switch {
 		case err == nil:
-			return mtu, nil
-		case errors.Is(err, net.ErrClosed) || errors.Is(err, ErrICMPCommunicationAdministrativelyProhibited): // blackhole
+			logger.Debugf("ICMP path MTU discovery against %s found maximum valid MTU %d", icmpIP, mtu)
+			icmpSuccess = true
+			maxPossibleMTU = mtu
+		case errors.Is(err, icmp.ErrNotPermitted), errors.Is(err, icmp.ErrMTUNotFound):
+			logger.Debugf("ICMP path MTU discovery failed: %s", err)
 		default:
-			return 0, fmt.Errorf("finding IPv4 next hop MTU: %w", err)
+			return 0, fmt.Errorf("ICMP path MTU discovery: %w", err)
 		}
-	} else {
-		logger.Debug("requesting IPv6 ICMP packet-too-big reply")
-		mtu, err = getIPv6PacketTooBig(ctx, ip, physicalLinkMTU, pingTimeout, logger)
-		switch {
-		case err == nil:
-			return mtu, nil
-		case errors.Is(err, net.ErrClosed): // blackhole
-		default:
-			return 0, fmt.Errorf("getting IPv6 packet-too-big message: %w", err)
+		if icmpSuccess {
+			break
 		}
 	}
 
-	// Fall back method: send echo requests with different packet
-	// sizes and check which ones succeed to find the maximum MTU.
-	logger.Debug("falling back to sending different sized echo packets")
-	minMTU := minIPv4MTU
-	if ip.Is6() {
-		minMTU = minIPv6MTU
+	minMTU := constants.MinIPv4MTU
+	if tcpAddrs[0].Addr().Is6() {
+		minMTU = constants.MinIPv6MTU
 	}
-	return pmtudMultiSizes(ctx, ip, minMTU, physicalLinkMTU, pingTimeout, logger)
-}
-
-type pmtudTestUnit struct {
-	mtu       uint32
-	echoID    uint16
-	sentBytes int
-	ok        bool
-}
-
-func pmtudMultiSizes(ctx context.Context, ip netip.Addr,
-	minMTU, maxPossibleMTU uint32, pingTimeout time.Duration,
-	logger Logger,
-) (maxMTU uint32, err error) {
-	var ipVersion string
-	var conn net.PacketConn
-	if ip.Is4() {
-		ipVersion = "v4"
-		conn, err = listenICMPv4(ctx)
-	} else {
-		ipVersion = "v6"
-		conn, err = listenICMPv6(ctx)
+	if icmpSuccess {
+		const mtuMargin = 150
+		minMTU = max(maxPossibleMTU-mtuMargin, minMTU)
 	}
+	mtu, err = tcp.PathMTUDiscover(ctx, tcpAddrs, minMTU, maxPossibleMTU, tryTimeout, fw, logger)
 	if err != nil {
-		if strings.HasSuffix(err.Error(), "socket: operation not permitted") {
-			err = fmt.Errorf("%w: you can try adding NET_RAW capability to resolve this", ErrICMPNotPermitted)
-		}
-		return 0, fmt.Errorf("listening for ICMP packets: %w", err)
-	}
-
-	mtusToTest := makeMTUsToTest(minMTU, maxPossibleMTU)
-	if len(mtusToTest) == 1 { // only minMTU because minMTU == maxPossibleMTU
-		return minMTU, nil
-	}
-	logger.Debugf("testing the following MTUs: %v", mtusToTest)
-
-	tests := make([]pmtudTestUnit, len(mtusToTest))
-	for i := range mtusToTest {
-		tests[i] = pmtudTestUnit{mtu: mtusToTest[i]}
-	}
-
-	timedCtx, cancel := context.WithTimeout(ctx, pingTimeout)
-	defer cancel()
-	go func() {
-		<-timedCtx.Done()
-		conn.Close()
-	}()
-
-	for i := range tests {
-		id, message := buildMessageToSend(ipVersion, tests[i].mtu)
-		tests[i].echoID = id
-
-		encodedMessage, err := message.Marshal(nil)
-		if err != nil {
-			return 0, fmt.Errorf("encoding ICMP message: %w", err)
-		}
-		tests[i].sentBytes = len(encodedMessage)
-
-		_, err = conn.WriteTo(encodedMessage, &net.IPAddr{IP: ip.AsSlice()})
-		if err != nil {
-			if strings.HasSuffix(err.Error(), "sendto: operation not permitted") {
-				err = fmt.Errorf("%w", ErrICMPNotPermitted)
-			}
-			return 0, fmt.Errorf("writing ICMP message: %w", err)
-		}
-	}
-
-	err = collectReplies(conn, ipVersion, tests, logger)
-	switch {
-	case err == nil: // max possible MTU is working
-		return tests[len(tests)-1].mtu, nil
-	case err != nil && errors.Is(err, net.ErrClosed):
-		// we have timeouts (IPv4 testing or IPv6 PMTUD blackholes)
-		// so find the highest MTU which worked.
-		// Note we start from index len(tests) - 2 since the max MTU
-		// cannot be working if we had a timeout.
-		for i := len(tests) - 2; i >= 0; i-- { //nolint:mnd
-			if tests[i].ok {
-				return pmtudMultiSizes(ctx, ip, tests[i].mtu, tests[i+1].mtu-1,
-					pingTimeout, logger)
+		if errors.Is(err, iptables.ErrKernelModuleMissing) {
+			logger.Debugf("aborting TCP path MTU discovery: %s", err)
+			if icmpSuccess {
+				return maxPossibleMTU, nil // only rely on ICMP PMTUD results
 			}
 		}
-
-		// All MTUs failed.
-		return 0, fmt.Errorf("%w: ICMP might be blocked", ErrMTUNotFound)
-	case err != nil:
-		return 0, fmt.Errorf("collecting ICMP echo replies: %w", err)
-	default:
-		panic("unreachable")
+		if icmpSuccess {
+			return 0, fmt.Errorf("%w - discarding ICMP obtained MTU %d",
+				ErrICMPOkTCPFail, maxPossibleMTU)
+		}
+		return 0, fmt.Errorf("%w", ErrICMPFailTCPFail)
 	}
-}
-
-// Create the MTU slice of length 11 such that:
-// - the first element is the minMTU
-// - the last element is the maxMTU
-// - elements in-between are separated as close to each other
-// The number 11 is chosen to find the final MTU in 3 searches,
-// with a total search space of 1728 MTUs which is enough;
-// to find it in 2 searches requires 37 parallel queries which
-// could be blocked by firewalls.
-func makeMTUsToTest(minMTU, maxMTU uint32) (mtus []uint32) {
-	const mtusLength = 11 // find the final MTU in 3 searches
-	diff := maxMTU - minMTU
-	switch {
-	case minMTU > maxMTU:
-		panic("minMTU > maxMTU")
-	case diff <= mtusLength:
-		mtus = make([]uint32, 0, diff)
-		for mtu := minMTU; mtu <= maxMTU; mtu++ {
-			mtus = append(mtus, mtu)
-		}
-	default:
-		step := float64(diff) / float64(mtusLength-1)
-		mtus = make([]uint32, 0, mtusLength)
-		for mtu := float64(minMTU); len(mtus) < mtusLength-1; mtu += step {
-			mtus = append(mtus, uint32(math.Round(mtu)))
-		}
-		mtus = append(mtus, maxMTU) // last element is the maxMTU
-	}
-
-	return mtus
-}
-
-func collectReplies(conn net.PacketConn, ipVersion string,
-	tests []pmtudTestUnit, logger Logger,
-) (err error) {
-	echoIDToTestIndex := make(map[uint16]int, len(tests))
-	for i, test := range tests {
-		echoIDToTestIndex[test.echoID] = i
-	}
-
-	// The theoretical limit is 4GiB for IPv6 MTU path discovery jumbograms, but that would
-	// create huge buffers which we don't really want to support anyway.
-	// The standard frame maximum MTU is 1500 bytes, and there are Jumbo frames with
-	// a conventional maximum of 9000 bytes. However, some manufacturers support up
-	// 9216-20 = 9196 bytes for the maximum MTU. We thus use buffers of size 9196 to
-	// match eventual Jumbo frames. More information at:
-	// https://en.wikipedia.org/wiki/Maximum_transmission_unit#MTUs_for_common_media
-	const maxPossibleMTU = 9196
-	buffer := make([]byte, maxPossibleMTU)
-
-	idsFound := 0
-	for idsFound < len(tests) {
-		// Note we need to read the whole packet in one call to ReadFrom, so the buffer
-		// must be large enough to read the entire reply packet. See:
-		// https://groups.google.com/g/golang-nuts/c/5dy2Q4nPs08/m/KmuSQAGEtG4J
-		bytesRead, _, err := conn.ReadFrom(buffer)
-		if err != nil {
-			return fmt.Errorf("reading from ICMP connection: %w", err)
-		}
-		packetBytes := buffer[:bytesRead]
-
-		ipPacketLength := len(packetBytes)
-
-		var icmpProtocol int
-		switch ipVersion {
-		case "v4":
-			icmpProtocol = icmpv4Protocol
-		case "v6":
-			icmpProtocol = icmpv6Protocol
-		default:
-			panic(fmt.Sprintf("unknown IP version: %s", ipVersion))
-		}
-
-		// Parse the ICMP message
-		// Note: this parsing works for a truncated 556 bytes ICMP reply packet.
-		message, err := icmp.ParseMessage(icmpProtocol, packetBytes)
-		if err != nil {
-			return fmt.Errorf("parsing message: %w", err)
-		}
-
-		echoBody, ok := message.Body.(*icmp.Echo)
-		if !ok {
-			return fmt.Errorf("%w: %T", ErrICMPBodyUnsupported, message.Body)
-		}
-
-		id := uint16(echoBody.ID) //nolint:gosec
-		testIndex, testing := echoIDToTestIndex[id]
-		if !testing { // not an id we expected so ignore it
-			logger.Warnf("ignoring ICMP reply with unexpected ID %d (type: %d, code: %d, length: %d)",
-				echoBody.ID, message.Type, message.Code, ipPacketLength)
-			continue
-		}
-		idsFound++
-		sentBytes := tests[testIndex].sentBytes
-
-		// echo reply should be at most the number of bytes sent,
-		// and can be lower, more precisely 556 bytes, in case
-		// the host we are reaching wants to stay out of trouble
-		// and ensure its echo reply goes through without
-		// fragmentation, see the following page:
-		// https://datatracker.ietf.org/doc/html/rfc1122#page-59
-		const conservativeReplyLength = 556
-		truncated := ipPacketLength < sentBytes &&
-			ipPacketLength == conservativeReplyLength
-		// Check the packet size is the same if the reply is not truncated
-		if !truncated && sentBytes != ipPacketLength {
-			return fmt.Errorf("%w: sent %dB and received %dB",
-				ErrICMPEchoDataMismatch, sentBytes, ipPacketLength)
-		}
-		// Truncated reply or matching reply size
-		tests[testIndex].ok = true
-	}
-	return nil
+	logger.Debugf("TCP path MTU discovery found maximum valid MTU %d", mtu)
+	return mtu, nil
 }

internal/pmtud/tcp/helpers_test.go

@@ -0,0 +1,142 @@
+package tcp
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/qdm12/gluetun/internal/command"
+	"github.com/qdm12/gluetun/internal/firewall"
+	"github.com/qdm12/gluetun/internal/firewall/iptables"
+	"github.com/qdm12/gluetun/internal/netlink"
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/qdm12/gluetun/internal/routing"
+	"github.com/qdm12/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/unix"
+)
+
+// testFirewall must be global to prevent parallel tests from interfering
+// with each other since they would interact with the same filter table.
+// The first test to use should initialize it, and the rest will reuse it.
+var (
+	testFirewall     *firewall.Config //nolint:gochecknoglobals
+	testFirewallOnce sync.Once        //nolint:gochecknoglobals
+)
+
+// getFirewall returns a Firewall instance, initializing it if needed. If
+// iptables is not supported, it skips the test.
+func getFirewall(t *testing.T) *firewall.Config {
+	t.Helper()
+
+	testFirewallOnce.Do(func() {
+		noopLogger := &noopLogger{}
+		cmder := command.New()
+		var err error
+		testFirewall, err = firewall.NewConfig(t.Context(), noopLogger, cmder, nil, nil, nil)
+		if errors.Is(err, iptables.ErrNotSupported) {
+			t.Skip("iptables not installed, skipping TCP PMTUD tests")
+		}
+		require.NoError(t, err, "creating firewall config")
+	})
+	if testFirewall == nil {
+		t.Skip("iptables not installed, skipping TCP PMTUD tests")
+	}
+	return testFirewall
+}
+
+type noopLogger struct{}
+
+func (l *noopLogger) Patch(_ ...log.Option)     {}
+func (l *noopLogger) Debug(_ string)            {}
+func (l *noopLogger) Debugf(_ string, _ ...any) {}
+func (l *noopLogger) Info(_ string)             {}
+func (l *noopLogger) Warn(_ string)             {}
+func (l *noopLogger) Warnf(_ string, _ ...any)  {}
+func (l *noopLogger) Error(_ string)            {}
+
+var errRouteNotFound = errors.New("route not found")
+
+func findLoopbackMTU(netlinker *netlink.NetLink) (mtu uint32, err error) {
+	routes, err := netlinker.RouteList(netlink.FamilyV4)
+	if err != nil {
+		return 0, fmt.Errorf("getting routes list: %w", err)
+	}
+	for _, route := range routes {
+		if route.Dst.IsValid() && route.Dst.Addr().IsLoopback() {
+			link, err := netlinker.LinkByIndex(route.LinkIndex)
+			if err != nil {
+				return 0, fmt.Errorf("getting link by index: %w", err)
+			}
+			// Quirk: make sure it is maximum 65535, and not i.e. 65536
+			// or the IP header 16 bits will fail to fit that packet length value.
+			const maxMTU = 65535
+			return min(link.MTU, maxMTU), nil
+		}
+	}
+	return 0, fmt.Errorf("%w: no loopback route found", errRouteNotFound)
+}
+
+func findDefaultRouteMTU(netlinker *netlink.NetLink) (mtu uint32, err error) {
+	noopLogger := &noopLogger{}
+	routing := routing.New(netlinker, noopLogger)
+	defaultRoutes, err := routing.DefaultRoutes()
+	if err != nil {
+		return 0, fmt.Errorf("getting default routes: %w", err)
+	}
+	families := []uint8{constants.AF_INET, constants.AF_INET6}
+	for _, family := range families {
+		for _, route := range defaultRoutes {
+			if route.Family != family {
+				continue
+			}
+			link, err := netlinker.LinkByName(route.NetInterface)
+			if err != nil {
+				return 0, fmt.Errorf("getting link by name: %w", err)
+			}
+			mtu = max(mtu, link.MTU)
+		}
+	}
+	if mtu == 0 {
+		return 0, fmt.Errorf("%w: no default route found", errRouteNotFound)
+	}
+	return mtu, nil
+}
+
+func reserveClosedPort(t *testing.T) (port uint16) {
+	t.Helper()
+
+	fd, err := unix.Socket(constants.AF_INET, constants.SOCK_STREAM, constants.IPPROTO_TCP)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		err := unix.Close(fd)
+		assert.NoError(t, err)
+	})
+
+	addr := &unix.SockaddrInet4{
+		Port: 0,
+		Addr: [4]byte{127, 0, 0, 1},
+	}
+
+	err = unix.Bind(fd, addr)
+	if err != nil {
+		_ = unix.Close(fd)
+		t.Fatal(err)
+	}
+
+	sockAddr, err := unix.Getsockname(fd)
+	if err != nil {
+		_ = unix.Close(fd)
+		t.Fatal(err)
+	}
+
+	sockAddr4, ok := sockAddr.(*unix.SockaddrInet4)
+	if !ok {
+		_ = unix.Close(fd)
+		t.Fatal("not an IPv4 address")
+	}
+
+	return uint16(sockAddr4.Port) //nolint:gosec
+}

internal/pmtud/tcp/interfaces.go

@@ -0,0 +1,17 @@
+package tcp
+
+import (
+	"context"
+	"net/netip"
+)
+
+type Firewall interface {
+	TempDropOutputTCPRST(ctx context.Context, src, dst netip.AddrPort,
+		excludeMark int) (revert func(ctx context.Context) error, err error)
+}
+
+type Logger interface {
+	Debug(msg string)
+	Debugf(msg string, args ...any)
+	Warnf(msg string, args ...any)
+}

internal/pmtud/tcp/mocks_generate_test.go

@@ -0,0 +1,3 @@
+package tcp
+
+//go:generate mockgen -destination=mocks_test.go -package=$GOPACKAGE . Logger

internal/pmtud/tcp/mocks_test.go

@@ -0,0 +1,80 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/qdm12/gluetun/internal/pmtud/tcp (interfaces: Logger)
+
+// Package tcp is a generated GoMock package.
+package tcp
+
+import (
+	reflect "reflect"
+
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockLogger is a mock of Logger interface.
+type MockLogger struct {
+	ctrl     *gomock.Controller
+	recorder *MockLoggerMockRecorder
+}
+
+// MockLoggerMockRecorder is the mock recorder for MockLogger.
+type MockLoggerMockRecorder struct {
+	mock *MockLogger
+}
+
+// NewMockLogger creates a new mock instance.
+func NewMockLogger(ctrl *gomock.Controller) *MockLogger {
+	mock := &MockLogger{ctrl: ctrl}
+	mock.recorder = &MockLoggerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
+	return m.recorder
+}
+
+// Debug mocks base method.
+func (m *MockLogger) Debug(arg0 string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Debug", arg0)
+}
+
+// Debug indicates an expected call of Debug.
+func (mr *MockLoggerMockRecorder) Debug(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debug", reflect.TypeOf((*MockLogger)(nil).Debug), arg0)
+}
+
+// Debugf mocks base method.
+func (m *MockLogger) Debugf(arg0 string, arg1 ...interface{}) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0}
+	for _, a := range arg1 {
+		varargs = append(varargs, a)
+	}
+	m.ctrl.Call(m, "Debugf", varargs...)
+}
+
+// Debugf indicates an expected call of Debugf.
+func (mr *MockLoggerMockRecorder) Debugf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0}, arg1...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Debugf", reflect.TypeOf((*MockLogger)(nil).Debugf), varargs...)
+}
+
+// Warnf mocks base method.
+func (m *MockLogger) Warnf(arg0 string, arg1 ...interface{}) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{arg0}
+	for _, a := range arg1 {
+		varargs = append(varargs, a)
+	}
+	m.ctrl.Call(m, "Warnf", varargs...)
+}
+
+// Warnf indicates an expected call of Warnf.
+func (mr *MockLoggerMockRecorder) Warnf(arg0 interface{}, arg1 ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{arg0}, arg1...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warnf", reflect.TypeOf((*MockLogger)(nil).Warnf), varargs...)
+}

internal/pmtud/tcp/mss.go

@@ -0,0 +1,148 @@
+package tcp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/firewall/iptables"
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/qdm12/gluetun/internal/pmtud/ip"
+)
+
+var errTCPServersUnreachable = errors.New("all TCP servers are unreachable")
+
+// findHighestMSSDestination finds the destination with the highest
+// MSS amongst the provided destinations.
+func findHighestMSSDestination(ctx context.Context, familyToFD map[int]fileDescriptor,
+	dsts []netip.AddrPort, excludeMark int, maxPossibleMTU uint32,
+	timeout time.Duration, tracker *tracker, fw Firewall, logger Logger) (
+	dst netip.AddrPort, mss uint32, err error,
+) {
+	type result struct {
+		dst netip.AddrPort
+		mss uint32
+		err error
+	}
+	resultCh := make(chan result)
+
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	for _, dst := range dsts {
+		go func(dst netip.AddrPort) {
+			fd := familyToFD[ip.GetFamily(dst)]
+			mss, err := findMSS(ctx, fd, dst, excludeMark, tracker, fw, logger)
+			resultCh <- result{dst: dst, mss: mss, err: err}
+		}(dst)
+	}
+
+	for range dsts {
+		result := <-resultCh
+		if result.err != nil {
+			switch {
+			case err != nil: // error already occurred for another findMSS goroutine
+			case errors.Is(result.err, iptables.ErrKernelModuleMissing):
+				err = fmt.Errorf("finding MSS for %s: %w", result.dst, result.err)
+			case dst.Addr().Is6() && errors.Is(result.err, ip.ErrNetworkUnreachable):
+				// silently discard IPv6 network unreachable errors since they are common
+				// and expected when the host doesn't have IPv6 connectivity
+			default: // another error not due to the match module missing
+				logger.Debugf("finding MSS for %s failed: %s", result.dst, result.err)
+			}
+			continue
+		}
+		ipHeaderLength := ip.HeaderLength(result.dst.Addr().Is4())
+		maxNeededMSS := maxPossibleMTU - ipHeaderLength - constants.BaseTCPHeaderLength
+		switch {
+		case result.mss >= maxNeededMSS:
+			logger.Debugf("%s has an MSS of %d bytes which is equal or higher than "+
+				"the maximum needed MSS of %d bytes for the maximum possible MTU of %d bytes",
+				result.dst, result.mss, maxNeededMSS, maxPossibleMTU)
+			return result.dst, result.mss, nil
+		case result.mss > mss:
+			mss = result.mss
+			dst = result.dst
+		}
+	}
+
+	if mss == 0 { // no MSS found for any destination
+		return netip.AddrPort{}, 0, fmt.Errorf("%w (%d servers)", errTCPServersUnreachable, len(dsts))
+	}
+
+	maxPossibleMTU = ip.HeaderLength(dst.Addr().Is4()) + constants.BaseTCPHeaderLength + mss
+	logger.Debugf("server %s has the highest MSS %d allowing to test the MTU up to %d",
+		dst, mss, maxPossibleMTU)
+	return dst, mss, nil
+}
+
+var errMSSNotFound = errors.New("MSS option not found in reply")
+
+func findMSS(ctx context.Context, fd fileDescriptor, dst netip.AddrPort,
+	excludeMark int, tracker *tracker, firewall Firewall, logger Logger) (
+	mss uint32, err error,
+) {
+	const proto = constants.IPPROTO_TCP
+	src, cleanup, err := ip.SrcAddr(dst, proto)
+	if err != nil {
+		return 0, fmt.Errorf("getting source address: %w", err)
+	}
+	defer cleanup()
+
+	revert, err := firewall.TempDropOutputTCPRST(ctx, src, dst, excludeMark)
+	if err != nil {
+		return 0, fmt.Errorf("temporarily dropping outgoing TCP RST packets: %w", err)
+	}
+	defer func() {
+		// we don't want to skip reverting the firewall changes
+		// even if the context is already expired, so we use a
+		// background context here.
+		err := revert(context.Background())
+		if err != nil {
+			logger.Warnf("reverting firewall changes: %s", err)
+		}
+	}()
+
+	ch := make(chan []byte)
+	abort := make(chan struct{})
+	defer close(abort)
+	tracker.register(src.Port(), dst.Port(), ch, abort)
+	defer tracker.unregister(src.Port(), dst.Port())
+
+	dstSockAddr := makeSockAddr(dst)
+
+	synPacket, synSeq := createSYNPacket(src, dst, 0)
+	const sendToFlags = 0
+	err = sendTo(fd, synPacket, sendToFlags, dstSockAddr)
+	if err != nil {
+		return 0, fmt.Errorf("sending SYN packet: %w", err)
+	}
+
+	var reply []byte
+	select {
+	case <-ctx.Done():
+		_ = sendRST(fd, src, dst, synSeq+1)
+		return 0, ctx.Err()
+	case reply = <-ch:
+	}
+
+	replyHeader, err := parseTCPHeader(reply)
+	switch {
+	case err != nil:
+		return 0, fmt.Errorf("parsing reply TCP header: %w", err)
+	case replyHeader.typ != packetTypeSYNACK:
+		return 0, fmt.Errorf("%w: unexpected packet type %s", errTCPPacketNotSynAck, replyHeader.typ)
+	case replyHeader.ack != synSeq+1:
+		return 0, fmt.Errorf("%w: expected %d, got %d", errTCPSynAckAckMismatch, synSeq+1, replyHeader.ack)
+	case replyHeader.options.mss == 0:
+		return 0, fmt.Errorf("%w: MSS option not found in reply", errMSSNotFound)
+	}
+
+	err = sendRST(fd, src, dst, replyHeader.ack)
+	if err != nil {
+		return 0, fmt.Errorf("sending RST packet: %w", err)
+	}
+
+	return replyHeader.options.mss, nil
+}

internal/pmtud/tcp/mss_test.go

@@ -0,0 +1,60 @@
+//go:build linux
+
+package tcp
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/netlink"
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_findHighestMSSDestination(t *testing.T) {
+	t.Parallel()
+
+	netlinker := netlink.New(&noopLogger{})
+	defaultMTU, err := findDefaultRouteMTU(netlinker)
+	require.NoError(t, err, "finding default route MTU")
+
+	ctx, cancel := context.WithCancel(t.Context())
+
+	families := []int{constants.AF_INET, constants.AF_INET6}
+	familyToFD, stop, err := startRawSockets(families, excludeMark)
+	require.NoError(t, err)
+
+	tracker := newTracker(familyToFD)
+	trackerCh := make(chan error)
+	go func() {
+		trackerCh <- tracker.listen(ctx)
+	}()
+
+	t.Cleanup(func() {
+		stop()
+		cancel() // stop listening
+		err = <-trackerCh
+		require.NoError(t, err)
+	})
+
+	dsts := []netip.AddrPort{
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 443),
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{8, 8, 8, 8}), 443),
+		netip.AddrPortFrom(netip.MustParseAddr("2606:4700:4700::1111"), 443),
+		netip.AddrPortFrom(netip.MustParseAddr("2001:4860:4860::8888"), 443),
+	}
+	const timeout = time.Second
+	fw := getFirewall(t)
+	logger := &noopLogger{}
+
+	dst, mss, err := findHighestMSSDestination(t.Context(), familyToFD, dsts,
+		excludeMark, defaultMTU, timeout, tracker, fw, logger)
+	require.NoError(t, err, "finding highest MSS destination")
+	assert.Contains(t, dsts, dst, "destination should be in the provided list")
+	assert.Greater(t, mss, uint32(1000), "MSS should be greater than 1000")
+	assert.LessOrEqual(t, mss, constants.MaxEthernetFrameSize,
+		"MSS should be less than or equal to the maximum Ethernet frame size	")
+}

internal/pmtud/tcp/multi.go

@@ -0,0 +1,182 @@
+package tcp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/qdm12/gluetun/internal/pmtud/ip"
+	"github.com/qdm12/gluetun/internal/pmtud/test"
+)
+
+var (
+	ErrMTUNotFound = errors.New("MTU not found")
+	ErrMSSTooSmall = errors.New("TCP MSS is too small to find the MTU")
+)
+
+type testUnit struct {
+	mtu uint32
+	ok  bool
+}
+
+const excludeMark = 4545
+
+// PathMTUDiscover first finds the destination TCP server with the highest
+// available MSS, in order to be able to test the highest possible MTU.
+// If a server has an MSS larger than maxPossibleMTU, this one is used.
+// It then performs a binary search of the MTU between minMTU and maxPossibleMTU,
+// by sending IP packets with the Don't Fragment bit set and checking if they
+// are received or not, exploiting the stateful nature of TCP to be able to
+// correlate replies to the sent packets.
+// Note all dsts must be of the same IP family (all IPv4 or all IPv6).
+func PathMTUDiscover(ctx context.Context, dsts []netip.AddrPort,
+	minMTU, maxPossibleMTU uint32, tryTimeout time.Duration,
+	firewall Firewall, logger Logger,
+) (mtu uint32, err error) {
+	families := ip.GetFamilies(dsts)
+	familyToFD, stop, err := startRawSockets(families, excludeMark)
+	if err != nil {
+		return 0, fmt.Errorf("starting raw sockets: %w", err)
+	}
+	defer stop()
+
+	tracker := newTracker(familyToFD)
+
+	trackerCtx, trackerCancel := context.WithCancel(ctx)
+	defer trackerCancel()
+	trackerErrCh := make(chan error)
+	go func() {
+		trackerErrCh <- tracker.listen(trackerCtx)
+	}()
+
+	type mssResult struct {
+		dst netip.AddrPort
+		mss uint32
+		err error
+	}
+	mssResultCh := make(chan mssResult)
+
+	mssCtx, mssCancel := context.WithTimeout(ctx, tryTimeout)
+	defer mssCancel()
+	go func() {
+		dst, mss, err := findHighestMSSDestination(mssCtx, familyToFD, dsts, excludeMark,
+			maxPossibleMTU, tryTimeout, tracker, firewall, logger)
+		mssResultCh <- mssResult{dst: dst, mss: mss, err: err}
+	}()
+	var result mssResult
+	select {
+	case err = <-trackerErrCh:
+		mssCancel()
+		<-mssResultCh
+		return 0, fmt.Errorf("listening for TCP replies: %w", err)
+	case result = <-mssResultCh:
+	}
+	if result.err != nil {
+		trackerCancel()
+		<-trackerErrCh
+		return 0, fmt.Errorf("finding MSS: %w", result.err)
+	}
+	ipHeaderLength := ip.HeaderLength(result.dst.Addr().Is4())
+	maxPossibleMTU = ipHeaderLength + constants.BaseTCPHeaderLength + result.mss
+	if minMTU > maxPossibleMTU {
+		// Occasionally, the MSS is a lot smaller than the MTU found using ICMP
+		const safetyBuffer = 100
+		minMTU = maxPossibleMTU - safetyBuffer
+	}
+
+	fd := familyToFD[ip.GetFamily(result.dst)]
+
+	type pmtudResult struct {
+		mtu uint32
+		err error
+	}
+	resultCh := make(chan pmtudResult)
+	pmtudCtx, pmtudCancel := context.WithCancel(ctx)
+	defer pmtudCancel()
+	go func() {
+		mtu, err := pathMTUDiscover(pmtudCtx, fd, result.dst, minMTU, maxPossibleMTU,
+			excludeMark, tryTimeout, tracker, firewall, logger)
+		resultCh <- pmtudResult{mtu: mtu, err: err}
+	}()
+
+	select {
+	case err = <-trackerErrCh:
+		pmtudCancel()
+		<-resultCh
+		return 0, fmt.Errorf("listening for TCP replies: %w", err)
+	case result := <-resultCh:
+		trackerCancel()
+		<-trackerErrCh
+		return result.mtu, result.err
+	}
+}
+
+var errTimedOut = errors.New("timed out")
+
+func pathMTUDiscover(ctx context.Context, fd fileDescriptor,
+	dst netip.AddrPort, minMTU, maxPossibleMTU uint32, excludeMark int,
+	tryTimeout time.Duration, tracker *tracker, firewall Firewall,
+	logger Logger,
+) (mtu uint32, err error) {
+	mtusToTest := test.MakeMTUsToTest(minMTU, maxPossibleMTU)
+	if len(mtusToTest) == 1 { // only minMTU because minMTU == maxPossibleMTU
+		return minMTU, nil
+	}
+	logger.Debugf("TCP testing the following MTUs: %v", mtusToTest)
+
+	tests := make([]testUnit, len(mtusToTest))
+	for i := range mtusToTest {
+		tests[i] = testUnit{mtu: mtusToTest[i]}
+	}
+
+	errCause := fmt.Errorf("%w: after %s", errTimedOut, tryTimeout)
+	runCtx, runCancel := context.WithTimeoutCause(ctx, tryTimeout, errCause)
+	defer runCancel()
+	doneCh := make(chan struct{})
+	for i := range tests {
+		go func(i int) {
+			err := runTest(runCtx, dst, tests[i].mtu, excludeMark,
+				fd, tracker, firewall, logger)
+			tests[i].ok = err == nil
+			doneCh <- struct{}{}
+		}(i)
+	}
+
+	i := 0
+	for i < len(tests) {
+		select {
+		case <-runCtx.Done(): // timeout or parent context canceled
+			err = context.Cause(runCtx)
+			// collect remaining done signals
+			for i < len(tests) {
+				<-doneCh
+				i++
+			}
+		case <-doneCh:
+			i++
+		}
+	}
+
+	if err != nil && !errors.Is(err, errTimedOut) {
+		// context is canceled but did not timeout after tryTimeout
+		return 0, fmt.Errorf("running MTU tests: %w", err)
+	}
+
+	if tests[len(tests)-1].ok {
+		return tests[len(tests)-1].mtu, nil
+	}
+
+	for i := len(tests) - 2; i >= 0; i-- { //nolint:mnd
+		if tests[i].ok {
+			runCancel() // just to release resources although runCtx is no longer used
+			return pathMTUDiscover(ctx, fd, dst,
+				tests[i].mtu, tests[i+1].mtu-1, excludeMark,
+				tryTimeout, tracker, firewall, logger)
+		}
+	}
+
+	return 0, fmt.Errorf("%w: your connection might not be working at all", ErrMTUNotFound)
+}

internal/pmtud/tcp/packet.go

@@ -0,0 +1,166 @@
+package tcp
+
+import (
+	"encoding/binary"
+	"math/rand/v2"
+	"net/netip"
+
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/qdm12/gluetun/internal/pmtud/ip"
+)
+
+// createSYNPacket creates a TCP SYN packet for initiating a handshake.
+// SYN packets have normally no data payload, so you SHOULD set mtu to 0.
+// However, in some cases where the server closes the connection with RST immediately,
+// it can be useful to add some data payload to a SYN packet and check if the server still
+// replies. Only set mtu to a non zero value if you know what you are doing.
+func createSYNPacket(src, dst netip.AddrPort, mtu uint32) (packet []byte, seq uint32) {
+	seq = rand.Uint32()                            //nolint:gosec
+	const ack = 0                                  // SYN has no ACK number
+	payloadLength := constants.BaseTCPHeaderLength // no data payload
+	if mtu > 0 {
+		payloadLength = getPayloadLength(mtu, dst)
+	}
+	return createPacket(src, dst, seq, ack, payloadLength, synFlag), seq
+}
+
+// createACKPacket creates a TCP ACK packet.
+// If the mtu is set to 0, no payload is sent.
+// Otherwise, the payload is calculated to test the MTU given.
+func createACKPacket(src, dst netip.AddrPort, seq, ack uint32, mtu uint32) []byte {
+	payloadLength := constants.BaseTCPHeaderLength // no data payload
+	if mtu > 0 {
+		payloadLength = getPayloadLength(mtu, dst)
+	}
+	const flags = ackFlag | pshFlag
+	return createPacket(src, dst, seq, ack, payloadLength, flags)
+}
+
+func createRSTPacket(src, dst netip.AddrPort, seq, ack uint32) []byte {
+	const payloadLength = constants.BaseTCPHeaderLength // no data payload
+	return createPacket(src, dst, seq, ack, payloadLength, rstFlag)
+}
+
+func getPayloadLength(mtu uint32, dst netip.AddrPort) uint32 {
+	var ipHeaderLength uint32
+	if dst.Addr().Is4() {
+		ipHeaderLength = constants.IPv4HeaderLength
+	} else {
+		ipHeaderLength = constants.IPv6HeaderLength
+	}
+	if mtu < ipHeaderLength+constants.BaseTCPHeaderLength {
+		panic("MTU too small to hold IP and TCP headers")
+	}
+	return mtu - ipHeaderLength
+}
+
+func createPacket(src, dst netip.AddrPort,
+	seq, ack, payloadLength uint32, flags byte,
+) []byte {
+	if payloadLength < constants.BaseTCPHeaderLength {
+		panic("payload length is too small to hold TCP header")
+	}
+
+	var ipHeader []byte
+	if dst.Addr().Is4() {
+		ipHeader = ip.HeaderV4(src.Addr(), dst.Addr(), payloadLength)
+	} else {
+		// Pseudo-header, this is actually not part of the packet since
+		// the kernel will calculate and add it itself to the packet;
+		// it is only used for calculating the TCP checksum.
+		ipHeader = ip.HeaderV6(src.Addr(), dst.Addr(),
+			uint16(payloadLength), byte(constants.IPPROTO_TCP)) //nolint:gosec
+	}
+
+	tcpHeader := makeTCPHeader(src.Port(), dst.Port(), seq, ack, flags)
+
+	dataLength := int(payloadLength - constants.BaseTCPHeaderLength)
+	var data []byte
+	if dataLength > 0 {
+		data = generatePayload(uint16(dataLength)) //nolint:gosec
+	}
+	checksum := tcpChecksum(ipHeader, tcpHeader, data)
+	tcpHeader[16] = byte(checksum >> 8)   //nolint:mnd
+	tcpHeader[17] = byte(checksum & 0xff) //nolint:mnd
+
+	var packet []byte
+	i := 0
+	if dst.Addr().Is4() {
+		packet = make([]byte, len(ipHeader)+int(constants.BaseTCPHeaderLength)+dataLength)
+		copy(packet, ipHeader)
+		i += len(ipHeader)
+	} else {
+		packet = make([]byte, int(constants.BaseTCPHeaderLength)+dataLength)
+	}
+	copy(packet[i:], tcpHeader)
+	i += int(constants.BaseTCPHeaderLength)
+	copy(packet[i:], data)
+	return packet
+}
+
+// generatePayload creates a byte slice of 'length' size.
+// For lengths below 88B, it returns pseudo random data.
+// For lengths above, it returns a structured TLS Client Hello with padding,
+// which is more likely to be accepted by servers and not trigger RST replies.
+//
+//nolint:mnd
+func generatePayload(length uint16) []byte {
+	const minTLSClientHelloSize = 5 + // TLS record
+		4 + // handshake header
+		67 + // client hello
+		4 + // cipher suites
+		2 + // compression methods
+		2 + // extensions length
+		4 // padding extension header
+	if length < minTLSClientHelloSize {
+		data := make([]byte, length)
+		makeRandom(data)
+		return data
+	}
+
+	payload := make([]byte, length)
+
+	// --- TLS Record Layer ---
+	payload[0] = 0x16 // Handshake
+	payload[1] = 0x03 // Version 3.1
+	payload[2] = 0x01
+	binary.BigEndian.PutUint16(payload[3:5], length-5)
+
+	// --- Handshake Header ---
+	payload[5] = 0x01 // Client Hello
+	handshakeLength := make([]byte, 4)
+	// TLS Handshake length is 24-bit.
+	// We use a 4-byte buffer and copy the trailing 3 bytes.
+	binary.BigEndian.PutUint32(handshakeLength, uint32(length-9))
+	copy(payload[6:9], handshakeLength[1:])
+
+	// --- Client Hello Body ---
+	payload[9] = 0x03 // Version 3.3 (TLS 1.2)
+	payload[10] = 0x03
+	makeRandom(payload[11:43]) // 32 bytes of random
+	payload[43] = 32           // Session ID length
+
+	// Cipher Suites (Length: 2, Data: 2)
+	binary.BigEndian.PutUint16(payload[44:46], 2)
+	binary.BigEndian.PutUint16(payload[46:48], 0x009c) // TLS_RSA_WITH_AES_128_GCM_SHA256
+
+	payload[48] = 0x01 // Compression length
+	payload[49] = 0x00 // Null compression
+
+	// --- Extensions ---
+	binary.BigEndian.PutUint16(payload[50:52], length-52) // extension length
+
+	// --- Padding Extension (Type 21) ---
+	binary.BigEndian.PutUint16(payload[52:54], 21)
+	const bytesUsedSoFar = 88
+	paddingDataLength := length - bytesUsedSoFar
+	binary.BigEndian.PutUint16(payload[54:56], paddingDataLength)
+
+	return payload
+}
+
+func makeRandom(b []byte) {
+	for i := range b {
+		b[i] = byte(rand.Uint32()) //nolint:gosec
+	}
+}

internal/pmtud/tcp/tcp.go

@@ -0,0 +1,239 @@
+package tcp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/qdm12/gluetun/internal/pmtud/ip"
+)
+
+func startRawSockets(families []int, excludeMark int) (familyToSocket map[int]fileDescriptor, stop func(), err error) {
+	familyToSocket = make(map[int]fileDescriptor, len(families))
+	stops := make([]func(), 0, len(families))
+	for _, family := range families {
+		fd, stop, err := startRawSocket(family, excludeMark)
+		if err != nil {
+			for _, stop := range stops {
+				stop()
+			}
+			return nil, nil, fmt.Errorf("starting raw socket for family %d: %w", family, err)
+		}
+		stops = append(stops, stop)
+		familyToSocket[family] = fd
+	}
+
+	stop = func() {
+		for _, stop := range stops {
+			stop()
+		}
+	}
+	return familyToSocket, stop, nil
+}
+
+func startRawSocket(family, excludeMark int) (fd fileDescriptor, stop func(), err error) {
+	fdPlatform, err := socket(family, constants.SOCK_RAW, constants.IPPROTO_TCP)
+	if err != nil {
+		return 0, nil, fmt.Errorf("creating raw socket: %w", err)
+	}
+
+	err = setMark(fdPlatform, excludeMark)
+	if err != nil {
+		_ = closeSocket(fdPlatform)
+		return 0, nil, fmt.Errorf("setting mark option on raw socket: %w", err)
+	}
+
+	if family == constants.AF_INET {
+		err = ip.SetIPv4HeaderIncluded(fdPlatform)
+		if err != nil {
+			_ = closeSocket(fdPlatform)
+			return 0, nil, fmt.Errorf("setting header option on raw socket: %w", err)
+		}
+	}
+
+	// Allow sending packets larger than cached PMTU (for PMTUD probing)
+	err = setMTUDiscovery(fdPlatform, family == constants.AF_INET)
+	if err != nil {
+		_ = closeSocket(fdPlatform)
+		return 0, nil, fmt.Errorf("setting MTU discovery options: %w", err)
+	}
+
+	// use polling because some Linux systems do not cancel
+	// blocking syscalls such as recvfrom when the socket is closed,
+	// which would cause things to hang indefinitely.
+	err = setNonBlock(fdPlatform)
+	if err != nil {
+		_ = closeSocket(fdPlatform)
+		return 0, nil, fmt.Errorf("setting non-blocking mode: %w", err)
+	}
+
+	stop = func() {
+		_ = closeSocket(fdPlatform)
+	}
+	return fileDescriptor(fdPlatform), stop, nil
+}
+
+var (
+	errTCPPacketNotSynAck        = errors.New("TCP packet is not a SYN-ACK")
+	errTCPSynAckAckMismatch      = errors.New("TCP SYN-ACK ACK number does not match expected value")
+	errFinalPacketTypeUnexpected = errors.New("final TCP packet type is unexpected")
+	errTCPPacketLost             = errors.New("TCP packet was lost")
+)
+
+// Craft and send a raw TCP packet to test the MTU.
+// It expects either an RST reply (if no server is listening)
+// or a SYN-ACK/ACK reply (if a server is listening).
+func runTest(ctx context.Context, dst netip.AddrPort, mtu uint32,
+	excludeMark int, fd fileDescriptor, tracker *tracker,
+	firewall Firewall, logger Logger,
+) error {
+	const proto = constants.IPPROTO_TCP
+	src, cleanup, err := ip.SrcAddr(dst, proto)
+	if err != nil {
+		return fmt.Errorf("getting source address: %w", err)
+	}
+	defer cleanup()
+
+	revert, err := firewall.TempDropOutputTCPRST(ctx, src, dst, excludeMark)
+	if err != nil {
+		return fmt.Errorf("temporarily dropping outgoing TCP RST packets: %w", err)
+	}
+	defer func() {
+		// we don't want to skip reverting the firewall changes
+		// even if the context is already expired, so we use a
+		// background context here.
+		err := revert(context.Background())
+		if err != nil {
+			logger.Warnf("reverting firewall changes: %s", err)
+		}
+	}()
+
+	ch := make(chan []byte)
+	abort := make(chan struct{})
+	defer close(abort)
+	tracker.register(src.Port(), dst.Port(), ch, abort)
+	defer tracker.unregister(src.Port(), dst.Port())
+
+	dstSockAddr := makeSockAddr(dst)
+
+	synPacket, synSeq := createSYNPacket(src, dst, 0)
+	const sendToFlags = 0
+	err = sendTo(fd, synPacket, sendToFlags, dstSockAddr)
+	if err != nil {
+		return fmt.Errorf("sending SYN packet: %w", err)
+	}
+
+	var reply []byte
+	select {
+	case <-ctx.Done():
+		_ = sendRST(fd, src, dst, synSeq+1)
+		return ctx.Err()
+	case reply = <-ch:
+	}
+
+	firstReplyHeader, err := parseTCPHeader(reply)
+	switch {
+	case err != nil:
+		return fmt.Errorf("parsing first reply TCP header: %w", err)
+	case firstReplyHeader.typ == packetTypeRST,
+		firstReplyHeader.typ == packetTypeRSTACK:
+		// server actively closed the connection, try sending a SYN with data
+		return handleRSTReply(ctx, fd, ch, src, dst, mtu)
+	case firstReplyHeader.typ != packetTypeSYNACK:
+		return fmt.Errorf("%w: unexpected packet type %s", errTCPPacketNotSynAck, firstReplyHeader.typ)
+	case firstReplyHeader.ack != synSeq+1:
+		return fmt.Errorf("%w: expected %d, got %d", errTCPSynAckAckMismatch, synSeq+1, firstReplyHeader.ack)
+	}
+
+	if firstReplyHeader.options.mss != 0 {
+		// If the server sent an MSS option, make sure our test packet is not larger than that MSS.
+		tcpDataLength := getPayloadLength(mtu, dst) - constants.BaseTCPHeaderLength
+		if tcpDataLength > firstReplyHeader.options.mss {
+			diff := tcpDataLength - firstReplyHeader.options.mss
+			minMTU := constants.MinIPv4MTU
+			if dst.Addr().Is6() {
+				minMTU = constants.MinIPv6MTU
+			}
+			diff = min(diff, mtu-minMTU)
+			mtu -= diff
+		}
+	}
+
+	// Send an ACK packet to finish the 3-way handshake, together with the
+	// data to test the MTU, using TCP fast-open.
+	ackPacket := createACKPacket(src, dst, firstReplyHeader.ack, firstReplyHeader.seq+1, mtu)
+	err = sendTo(fd, ackPacket, sendToFlags, dstSockAddr)
+	if err != nil {
+		return fmt.Errorf("sending ACK packet: %w", err)
+	}
+
+	select {
+	case <-ctx.Done():
+		_ = sendRST(fd, src, dst, firstReplyHeader.ack)
+		return ctx.Err()
+	case reply = <-ch:
+	}
+
+	finalPacketHeader, err := parseTCPHeader(reply)
+	if err != nil {
+		return fmt.Errorf("parsing second reply TCP header: %w", err)
+	}
+
+	switch finalPacketHeader.typ { //nolint:exhaustive
+	case packetTypeRST:
+		return nil
+	case packetTypeACK:
+		err = sendRST(fd, src, dst, finalPacketHeader.ack)
+		if err != nil {
+			return fmt.Errorf("sending RST packet: %w", err)
+		}
+		return nil
+	case packetTypeSYNACK: // server never received our MTU-test ACK packet
+		return fmt.Errorf("%w: server responded with second SYN-ACK packet", errTCPPacketLost)
+	default:
+		_ = sendRST(fd, src, dst, finalPacketHeader.ack)
+		return fmt.Errorf("%w: %s", errFinalPacketTypeUnexpected, finalPacketHeader.typ)
+	}
+}
+
+var errTCPPacketNotRST = errors.New("TCP packet is not an RST")
+
+func handleRSTReply(ctx context.Context, fd fileDescriptor, ch <-chan []byte,
+	src, dst netip.AddrPort, mtu uint32,
+) error {
+	packet, synSeq := createSYNPacket(src, dst, mtu)
+	const sendToFlags = 0
+	err := sendTo(fd, packet, sendToFlags, makeSockAddr(dst))
+	if err != nil {
+		return fmt.Errorf("sending SYN MTU-test packet: %w", err)
+	}
+
+	var reply []byte
+	select {
+	case <-ctx.Done():
+		_ = sendRST(fd, src, dst, synSeq+1)
+		return ctx.Err() // timeout: the MTU test SYN packet was too big
+	case reply = <-ch:
+	}
+
+	replyPacketHeader, err := parseTCPHeader(reply)
+	if err != nil {
+		return fmt.Errorf("parsing reply TCP header: %w", err)
+	} else if replyPacketHeader.typ != packetTypeRST &&
+		replyPacketHeader.typ != packetTypeRSTACK {
+		return fmt.Errorf("%w: %s", errTCPPacketNotRST, replyPacketHeader.typ)
+	}
+	return nil
+}
+
+func sendRST(fd fileDescriptor, src, dst netip.AddrPort,
+	previousACK uint32,
+) error {
+	seq := previousACK
+	const ack = 0
+	rstPacket := createRSTPacket(src, dst, seq, ack)
+	const sendToFlags = 0
+	return sendTo(fd, rstPacket, sendToFlags, makeSockAddr(dst))
+}

internal/pmtud/tcp/tcp_darwin.go

@@ -0,0 +1,5 @@
+package tcp
+
+func stripIPv4Header(reply []byte) (result []byte, ok bool) {
+	return reply, true
+}

internal/pmtud/tcp/tcp_integration_test.go

@@ -0,0 +1,55 @@
+//go:build integration
+
+package tcp
+
+import (
+	"errors"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/qdm12/gluetun/internal/command"
+	"github.com/qdm12/gluetun/internal/firewall"
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+	"github.com/qdm12/log"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_PathMTUDiscover(t *testing.T) {
+	t.Parallel()
+
+	const tryTimeout = time.Second
+	deadline, ok := t.Deadline()
+	if ok {
+		timeLeft := time.Until(deadline)
+		const maxTimeNeeded = tryTimeout * 4 // MSS discovery + 3 MTU tries
+		require.GreaterOrEqual(t, timeLeft, maxTimeNeeded,
+			"not enough time remaining for TCP PMTUD test, need %s and got %s",
+			maxTimeNeeded, timeLeft)
+	}
+
+	logger := log.New(log.SetLevel(log.LevelDebug))
+
+	cmder := command.New()
+	fw, err := firewall.NewConfig(t.Context(), logger, cmder, nil, nil)
+	if errors.Is(err, firewall.ErrIPTablesNotSupported) {
+		t.Skip("iptables not installed, skipping TCP PMTUD tests")
+	}
+	require.NoError(t, err, "creating firewall config")
+
+	dsts := []netip.AddrPort{
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 53),
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{1, 1, 1, 1}), 443),
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{8, 8, 8, 8}), 53),
+		netip.AddrPortFrom(netip.AddrFrom4([4]byte{8, 8, 8, 8}), 443),
+		netip.AddrPortFrom(netip.MustParseAddr("2606:4700:4700::1111"), 443),
+		netip.AddrPortFrom(netip.MustParseAddr("2001:4860:4860::8888"), 443),
+	}
+	const minMTU = constants.MinIPv6MTU
+	const maxMTU = constants.MaxEthernetFrameSize
+	mtu, err := PathMTUDiscover(t.Context(), dsts, minMTU, maxMTU, tryTimeout, fw, logger)
+	require.NoError(t, err, "discovering path MTU")
+	assert.Greater(t, mtu, uint32(0), "MTU should be greater than 0")
+	t.Logf("discovered path MTU is %d", mtu)
+}

internal/pmtud/tcp/tcp_linux.go

@@ -0,0 +1,21 @@
+package tcp
+
+import "golang.org/x/sys/unix"
+
+// setMark sets a mark on each packets sent through this socket.
+// This is used in conjunction with iptables to block outgoing kernel automated
+// RST packets, since the kernel is not aware of us handling the connection manually.
+// For example:
+// iptables -A OUTPUT -p tcp --tcp-flags RST RST -m mark ! --mark 123 -j DROP
+//
+//nolint:dupword
+func setMark(fd, excludeMark int) error {
+	return unix.SetsockoptInt(fd, unix.SOL_SOCKET, unix.SO_MARK, excludeMark)
+}
+
+func setMTUDiscovery(fd int, ipv4 bool) error {
+	if ipv4 {
+		return unix.SetsockoptInt(fd, unix.IPPROTO_IP, unix.IP_MTU_DISCOVER, unix.IP_PMTUDISC_PROBE)
+	}
+	return unix.SetsockoptInt(fd, unix.IPPROTO_IPV6, unix.IPV6_MTU_DISCOVER, unix.IPV6_PMTUDISC_PROBE)
+}

internal/pmtud/tcp/tcp_notdarwin.go

@@ -0,0 +1,30 @@
+//go:build !darwin
+
+package tcp
+
+import (
+	"github.com/qdm12/gluetun/internal/pmtud/constants"
+)
+
+func stripIPv4Header(reply []byte) (result []byte, ok bool) {
+	if len(reply) < int(constants.IPv4HeaderLength) {
+		return nil, false // not an IPv4 packet
+	}
+
+	version := reply[0] >> 4 //nolint:mnd
+	const ipv4Version = 4
+	if version != ipv4Version {
+		return nil, false
+	}
+	// For IPv4 we need to skip the IP header, which is at least
+	// 20B and can be up to 60B.
+	// The Internet Header Length is the lower 4 bits of the first byte and
+	// represents the number of 32-bit words of the header length.
+	const ihlMask byte = 0x0F
+	const bytesInWord = 4
+	headerLength := int((reply[0] & ihlMask)) * bytesInWord
+	if len(reply) < headerLength {
+		return nil, false // not enough data for full IPv4 header
+	}
+	return reply[headerLength:], true
+}