wg-quick: linux: prevent traffic from momentarily leaking into tunnel

The wireguard route table ip rule should stay as a no-op until the
`suppress_prefixlength 0 table main` rule is in effect. Therefore, add
the wireguard default route to its route table after the latter rule is
added.

Signed-off-by: Tom Yan <tom.ty89@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index e4d4c4f08fc32b14ec3942d10fa951c39de16899..69e5bef05cfdae39e7bc66995ef6a097384717a9 100755 (executable)
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -220,9 +220,9 @@ add_default() {
        fi
        local proto=-4 iptables=iptables pf=ip
        [[ $1 == *:* ]] && proto=-6 iptables=ip6tables pf=ip6
-       cmd ip $proto route add "$1" dev "$INTERFACE" table $table
        cmd ip $proto rule add not fwmark $table table $table
        cmd ip $proto rule add table main suppress_prefixlength 0
+       cmd ip $proto route add "$1" dev "$INTERFACE" table $table
 
        local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd 
        printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"