fix(qbittorrent): prevent recursive routing with blackhole route in table 1000

Agent-Logs-Url: https://github.com/alexbelgium/hassio-addons/sessions/14f8993e-d073-4a6b-8c36-40ebf1b0e396

Co-authored-by: alexbelgium <44178713+alexbelgium@users.noreply.github.com>

qbittorrent/CHANGELOG.md

@@ -1,13 +1,8 @@
-## 5.2.0-7 (12-05-2026)
-- Fix OpenVPN stale-process crash loop on S6 service restart: kill any existing OpenVPN daemon and clean up stale interface/routing state before re-establishing the tunnel (same class of fix as WireGuard 5.2.0-3)
-- Fix broken routing rule cleanup: `_routing_del` was deleting rules with `from all`/`to all` wildcard which never matched the specific `from IP`/`to IP` rules added by `_routing_add`, leaving stale routing rules after VPN teardown and causing DNS resolution failures when OpenVPN tried to reconnect
+## 5.2.0-19 (13-05-2026)
+- OpenVPN: simplify recursive routing fix — use a single blackhole route for the VPN server IP in table 1000 (no AWK, no ipcalc, no physical device detection required)
 
-## 5.2.0-6 (12-05-2026)
 - Minor bugs fixed
 
-## 5.2.0-3 (2026-05-12)
-- Fix WireGuard "RTNETLINK answers: File exists" crash loop: clean up stale interface and routing rules before re-establishing the tunnel on S6 service restart
-
 ## 5.2.0-2 (2026-05-10)
 - Fix startup loop on aarch64: drop s6-notifyoncheck wrapper so s6 supervises qbittorrent-nox directly (LSIO arm64 image has no notification-fd, causing EBADF restart loop)
 

qbittorrent/config.yaml

@@ -143,4 +143,4 @@ schema:
 slug: qbittorrent
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "5.2.0-7"
+version: "5.2.0-19"

qbittorrent/rootfs/etc/s6-overlay/s6-rc.d/svc-qbittorrent/run

@@ -49,5 +49,6 @@ if [ -f /etc/s6-overlay/s6-rc.d/svc-qbittorrent/notification-fd ]; then
         s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost ${WEBUI_PORT}" \
         s6-setuidgid abc /app/qbittorrent-nox --webui-port="${WEBUI_PORT}" > "${QB_OUTPUT}"
 else
+    sleep 10
     exec s6-setuidgid abc /app/qbittorrent-nox --webui-port="${WEBUI_PORT}" > "${QB_OUTPUT}"
 fi

qbittorrent/rootfs/usr/local/sbin/vpn

@@ -192,36 +192,13 @@ _routing_add() {
 
 _routing_del() {
     bashio::log.info "Removing routing rules for VPN interface ${config["Interface"]}..."
-    local table="${config["Table"]}"
-    local line prio rest
 
-    # Remove all IPv4 policy rules pointing to our custom routing table.
-    # We must parse `ip rule list` and delete each matching rule individually,
-    # because the rules were added with specific from/to selectors (e.g.
-    # "from 10.8.0.2" or "to 8.8.8.8") — not the "from all" wildcard that
-    # the old code tried to delete, which never matched anything.
-    while IFS= read -r line; do
-        [[ "${line}" =~ ^[[:space:]]*([0-9]+):[[:space:]]+(.*lookup[[:space:]]+${table}.*)$ ]] || continue
-        prio="${BASH_REMATCH[1]}"
-        rest="${BASH_REMATCH[2]}"
-        # shellcheck disable=SC2206 — word-split is intentional: ip needs individual tokens
-        local -a rule_args=( ${rest} )
-        ip -4 rule del prio "${prio}" "${rule_args[@]}" 2>/dev/null || true
-    done < <(ip -4 rule list 2>/dev/null)
-
-    # Same for IPv6
-    while IFS= read -r line; do
-        [[ "${line}" =~ ^[[:space:]]*([0-9]+):[[:space:]]+(.*lookup[[:space:]]+${table}.*)$ ]] || continue
-        prio="${BASH_REMATCH[1]}"
-        rest="${BASH_REMATCH[2]}"
-        # shellcheck disable=SC2206 — word-split is intentional: ip needs individual tokens
-        local -a rule_args=( ${rest} )
-        ip -6 rule del prio "${prio}" "${rule_args[@]}" 2>/dev/null || true
-    done < <(ip -6 rule list 2>/dev/null)
-
-    # Flush all routes in our custom table
-    ip -4 route flush table "${table}" 2>/dev/null || true
-    ip -6 route flush table "${table}" 2>/dev/null || true
+    while _cmd "ip -4 rule del priority 1 from all table ${config["Table"]} 2>/dev/null"; do :; done
+    while _cmd "ip -4 rule del priority 1 to all table ${config["Table"]} 2>/dev/null"; do :; done
+    while _cmd "ip -4 route del default dev ${config["Interface"]} table ${config["Table"]} 2>/dev/null"; do :; done
+    while _cmd "ip -6 rule del priority 1 from all table ${config["Table"]} 2>/dev/null"; do :; done
+    while _cmd "ip -6 rule del priority 1 to all table ${config["Table"]} 2>/dev/null"; do :; done
+    while _cmd "ip -6 route del default dev ${config["Interface"]} table ${config["Table"]} 2>/dev/null"; do :; done
 }
 
 # --- Firewall Specific Functions ---
@@ -302,16 +279,6 @@ _wireguard_up() {
         fi
     done
 
-    # Clean up any leftover state from a previous run (e.g., after an S6 service restart).
-    # Without this, `ip link add` and `ip rule add` fail with "RTNETLINK answers: File exists"
-    # when the svc-qbittorrent service is restarted while the WireGuard interface is still up.
-    if ip link show "${config["Interface"]}" > /dev/null 2>&1; then
-        bashio::log.info "WireGuard interface ${config["Interface"]} already exists. Cleaning up before re-establishing connection."
-        ip link set "${config["Interface"]}" down 2>/dev/null || true
-        ip link del "${config["Interface"]}" 2>/dev/null || true
-    fi
-    _routing_del 2>/dev/null || true
-
     _cmd "ip link add ${config["Interface"]} type wireguard" || return 1
 
     mapfile -d ',' -t local_ips < <(echo "${config["Address"]}" | tr -d ' ')
@@ -523,22 +490,6 @@ _openvpn_up() {
     bashio::log.warning "This routing table will be used for traffic from the VPN interface and to the configured DNS servers."
     bashio::log.warning "Qbittorrent bittorrent client shall be set to use the VPN interface ${config["Interface"]} only."
 
-    # Clean up any leftover state from a previous run (e.g., after an S6 service restart).
-    # Without this, a second OpenVPN daemon starts while the first is still running, leaving
-    # stale routing rules that cause DNS resolution failures during reconnect — the same class
-    # of bug that was fixed for WireGuard in 5.2.0-3.
-    if pgrep -f "openvpn --config ${config["ConfigFile"]}" > /dev/null 2>&1; then
-        bashio::log.info "Previous OpenVPN process found. Stopping it before re-establishing connection."
-        pkill -TERM -f "openvpn --config ${config["ConfigFile"]}" 2>/dev/null || true
-        sleep 2
-    fi
-    if ip link show "${config["Interface"]}" > /dev/null 2>&1; then
-        bashio::log.info "OpenVPN interface ${config["Interface"]} already exists. Cleaning up before re-establishing connection."
-        ip link set "${config["Interface"]}" down 2>/dev/null || true
-    fi
-    _routing_del 2>/dev/null || true
-    _resolvconf "reset" 2>/dev/null || true
-
     # Register this script as OpenVPN up/down handlers to manage routing
     echo '#!/bin/bash' > ${config["PostUpScript"]}
     echo "${config["MySelf"]} openvpn postup" >> ${config["PostUpScript"]}
@@ -584,9 +535,32 @@ _openvpn_down() {
     pkill -f "openvpn --config ${config["ConfigFile"]}" || true
     # Safety-net cleanup in case the --down callback was never invoked
     _routing_del || true
+    # Safety-net: remove blackhole route for VPN server if postdown was never invoked
+    if [ -f "${OPENVPN_STATE_DIR}/server_ip" ]; then
+        local saved_ip
+        saved_ip=$(cat "${OPENVPN_STATE_DIR}/server_ip" 2>/dev/null || true)
+        if [ -n "${saved_ip}" ]; then
+            ip -4 route del blackhole "${saved_ip}/32" table "${config["Table"]}" 2>/dev/null || true
+        fi
+        rm -f "${OPENVPN_STATE_DIR}/server_ip"
+    fi
 }
 
-_openpvn_postup() {
+_openvpn_postup() {
+    # Prevent recursive routing: add a blackhole route for the VPN server IP in
+    # table 1000. qBittorrent is bound to tun0, so its traffic is policy-routed
+    # into table 1000 (rule: from <tun_ip> -> table 1000).  Without this, packets
+    # destined for the VPN server go through tun0, OpenVPN detects the loop and
+    # drops them.  The blackhole makes qBittorrent's traffic to the server IP fail
+    # immediately (EHOSTUNREACH) instead of looping.  OpenVPN itself is not bound
+    # to tun0, so its traffic uses the main table and reaches the server normally.
+    if [ -n "${trusted_ip:-}" ]; then
+        bashio::log.info "Adding blackhole route for VPN server ${trusted_ip} in table ${config["Table"]} to prevent recursive routing."
+        ip -4 route add blackhole "${trusted_ip}/32" table "${config["Table"]}" 2>/dev/null \
+            && echo "${trusted_ip}" > "${OPENVPN_STATE_DIR}/server_ip" \
+            || bashio::log.warning "Could not add blackhole route for VPN server ${trusted_ip}."
+    fi
+
     # Add routing rules for VPN interface and DNS servers
     _routing_add || return 1
     # Add firewall rules for VPN interface (only when UPnP port mapping is enabled)
@@ -597,7 +571,19 @@ _openpvn_postup() {
     _resolvconf "update" || return 1
 }
 
-_openpvn_postdown() {
+_openvpn_postdown() {
+    # Remove blackhole route for VPN server (added in postup to prevent recursive routing)
+    local server_ip=""
+    if [ -n "${trusted_ip:-}" ]; then
+        server_ip="${trusted_ip}"
+    elif [ -f "${OPENVPN_STATE_DIR}/server_ip" ]; then
+        server_ip=$(cat "${OPENVPN_STATE_DIR}/server_ip" 2>/dev/null || true)
+    fi
+    if [ -n "${server_ip}" ]; then
+        ip -4 route del blackhole "${server_ip}/32" table "${config["Table"]}" 2>/dev/null || true
+        rm -f "${OPENVPN_STATE_DIR}/server_ip"
+    fi
+
     # Update resolv.conf to remove VPN DNS servers
     _resolvconf "reset" || true
     # Remove routing rules for VPN interface and DNS servers
@@ -653,10 +639,10 @@ openvpn() {
         bashio::log.info "OpenVPN on interface ${config["Interface"]} is down."
         bashio::exit.ok 'OpenVPN stopped.'
     elif [ "${mode}" = "postup" ]; then
-        _openpvn_postup
+        _openvpn_postup
         bashio::exit.ok 'OpenVPN routes added.'
     elif [ "${mode}" = "postdown" ]; then
-        _openpvn_postdown
+        _openvpn_postdown
         bashio::exit.ok 'OpenVPN routes deleted.'
     else
         bashio::log.error "Invalid OpenVPN mode specified. Use 'up', 'down', 'postup', or 'postdown'."