Refactoring

Author: jiriteach

docker-compose.yml

@@ -4,8 +4,11 @@ services:
     container_name: cloudflare-warp-client
     restart: unless-stopped
 
-    # NET_ADMIN is required for WARP to create tunnel interfaces.
-    # SYS_MODULE allows loading kernel modules (e.g. wireguard) if needed.
+    # privileged is required so the container can write net.ipv4.conf.all.rp_filter=0
+    # and have it stick. Docker daemon continuously resets rp_filter=2 on bridge
+    # interfaces it manages; without privileged the container's proc writes are
+    # blocked or immediately overridden. cap_add entries are kept for clarity.
+    privileged: true
     cap_add:
       - NET_ADMIN
       - NET_RAW

entrypoint.sh

@@ -109,6 +109,32 @@ warp-cli --accept-tos connect
 
 echo "[info] WARP mesh connector is up and running."
 
+# ---------------------------------------------------------------------------
+# rp_filter keeper
+#
+# Docker daemon writes net.ipv4.conf.all.rp_filter=2 whenever it manages its
+# bridge networks. Because the effective rp_filter per interface is
+# MAX(conf/all, conf/<iface>), all=2 overrides any per-interface setting of 0.
+# This keeper re-applies 0 every 5 seconds so Docker's resets are corrected
+# before they can drop traffic. privileged: true in compose ensures the writes
+# are not blocked by capability or seccomp restrictions.
+# ---------------------------------------------------------------------------
+(
+    LAN_IFACE=$(ip route show default 2>/dev/null | awk '/default/ {print $5}' | head -1)
+    echo "[rp_filter-keeper] Starting. LAN interface: ${LAN_IFACE:-unknown}"
+    while true; do
+        echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter     2>/dev/null || true
+        echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter 2>/dev/null || true
+        if [ -n "$LAN_IFACE" ] && [ -f "/proc/sys/net/ipv4/conf/${LAN_IFACE}/rp_filter" ]; then
+            echo 0 > "/proc/sys/net/ipv4/conf/${LAN_IFACE}/rp_filter" 2>/dev/null || true
+        fi
+        if [ -f /proc/sys/net/ipv4/conf/CloudflareWARP/rp_filter ]; then
+            echo 0 > /proc/sys/net/ipv4/conf/CloudflareWARP/rp_filter 2>/dev/null || true
+        fi
+        sleep 5
+    done
+) &
+
 # ---------------------------------------------------------------------------
 # Connectivity watchdog
 #