Pin resolved WireGuard endpoint route before VPN startup

qbittorrent/CHANGELOG.md

@@ -1,6 +1,4 @@
-## 5.2.0-19 (13-05-2026)
-- OpenVPN: simplify recursive routing fix — use a single blackhole route for the VPN server IP in table 1000 (no AWK, no ipcalc, no physical device detection required)
-
+## 5.2.0-16 (13-05-2026)
 - Minor bugs fixed
 
 ## 5.2.0-2 (2026-05-10)

qbittorrent/config.yaml

@@ -143,4 +143,4 @@ schema:
 slug: qbittorrent
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "5.2.0-19"
+version: "5.2.0-16"

qbittorrent/rootfs/usr/local/sbin/vpn

@@ -93,6 +93,33 @@ _check_host() {
     fi
 }
 
+_add_endpoint_route() {
+    local endpoint_ip="$1"
+    local result=0
+
+    _check_host "${endpoint_ip}" || result=$?
+
+    if [ "${result}" -eq 1 ]; then
+        local default_route
+        default_route="$(ip -4 route show default | head -n1)"
+        if [ -z "${default_route}" ]; then
+            bashio::log.warning "No IPv4 default route found to pin VPN endpoint ${endpoint_ip}."
+            return 0
+        fi
+        _cmd "ip -4 route replace ${endpoint_ip}/32 ${default_route}" || return 1
+    elif [ "${result}" -eq 2 ]; then
+        local default_route
+        default_route="$(ip -6 route show default | head -n1)"
+        if [ -z "${default_route}" ]; then
+            bashio::log.warning "No IPv6 default route found to pin VPN endpoint ${endpoint_ip}."
+            return 0
+        fi
+        _cmd "ip -6 route replace ${endpoint_ip}/128 ${default_route}" || return 1
+    else
+        bashio::log.warning "Skipping endpoint route pinning for invalid endpoint IP: ${endpoint_ip}"
+    fi
+}
+
 _resolvconf() {
     local mode=$1
     local resolv_conf="/etc/resolv.conf"
@@ -435,6 +462,7 @@ wireguard() {
             for endpoint_ip in "${endpoint_ips[@]}"; do
                 bashio::log.info "Resolved WireGuard endpoint hostname ${config["EndpointHost"]} to IP: ${endpoint_ip}"
                 config["EndpointIP"]="${endpoint_ip}"
+                _add_endpoint_route "${config["EndpointIP"]}" || return 1
                 if _wireguard_up; then
                     bashio::log.info "WireGuard interface ${config["Interface"]} is up."
                     bashio::exit.ok 'WireGuard started.'
@@ -445,6 +473,7 @@ wireguard() {
         else
             bashio::log.debug "WireGuard endpoint ${config["EndpointHost"]} is a valid IP address. Using as is."
             config["EndpointIP"]="${config["EndpointHost"]}"
+            _add_endpoint_route "${config["EndpointIP"]}" || return 1
             if _wireguard_up; then
                 bashio::log.info "WireGuard interface ${config["Interface"]} is up."
                 bashio::exit.ok 'WireGuard started.'
@@ -535,32 +564,9 @@ _openvpn_down() {
     pkill -f "openvpn --config ${config["ConfigFile"]}" || true
     # Safety-net cleanup in case the --down callback was never invoked
     _routing_del || true
-    # Safety-net: remove blackhole route for VPN server if postdown was never invoked
-    if [ -f "${OPENVPN_STATE_DIR}/server_ip" ]; then
-        local saved_ip
-        saved_ip=$(cat "${OPENVPN_STATE_DIR}/server_ip" 2>/dev/null || true)
-        if [ -n "${saved_ip}" ]; then
-            ip -4 route del blackhole "${saved_ip}/32" table "${config["Table"]}" 2>/dev/null || true
-        fi
-        rm -f "${OPENVPN_STATE_DIR}/server_ip"
-    fi
 }
 
-_openvpn_postup() {
-    # Prevent recursive routing: add a blackhole route for the VPN server IP in
-    # table 1000. qBittorrent is bound to tun0, so its traffic is policy-routed
-    # into table 1000 (rule: from <tun_ip> -> table 1000).  Without this, packets
-    # destined for the VPN server go through tun0, OpenVPN detects the loop and
-    # drops them.  The blackhole makes qBittorrent's traffic to the server IP fail
-    # immediately (EHOSTUNREACH) instead of looping.  OpenVPN itself is not bound
-    # to tun0, so its traffic uses the main table and reaches the server normally.
-    if [ -n "${trusted_ip:-}" ]; then
-        bashio::log.info "Adding blackhole route for VPN server ${trusted_ip} in table ${config["Table"]} to prevent recursive routing."
-        ip -4 route add blackhole "${trusted_ip}/32" table "${config["Table"]}" 2>/dev/null \
-            && echo "${trusted_ip}" > "${OPENVPN_STATE_DIR}/server_ip" \
-            || bashio::log.warning "Could not add blackhole route for VPN server ${trusted_ip}."
-    fi
-
+_openpvn_postup() {
     # Add routing rules for VPN interface and DNS servers
     _routing_add || return 1
     # Add firewall rules for VPN interface (only when UPnP port mapping is enabled)
@@ -571,19 +577,7 @@ _openvpn_postup() {
     _resolvconf "update" || return 1
 }
 
-_openvpn_postdown() {
-    # Remove blackhole route for VPN server (added in postup to prevent recursive routing)
-    local server_ip=""
-    if [ -n "${trusted_ip:-}" ]; then
-        server_ip="${trusted_ip}"
-    elif [ -f "${OPENVPN_STATE_DIR}/server_ip" ]; then
-        server_ip=$(cat "${OPENVPN_STATE_DIR}/server_ip" 2>/dev/null || true)
-    fi
-    if [ -n "${server_ip}" ]; then
-        ip -4 route del blackhole "${server_ip}/32" table "${config["Table"]}" 2>/dev/null || true
-        rm -f "${OPENVPN_STATE_DIR}/server_ip"
-    fi
-
+_openpvn_postdown() {
     # Update resolv.conf to remove VPN DNS servers
     _resolvconf "reset" || true
     # Remove routing rules for VPN interface and DNS servers
@@ -639,10 +633,10 @@ openvpn() {
         bashio::log.info "OpenVPN on interface ${config["Interface"]} is down."
         bashio::exit.ok 'OpenVPN stopped.'
     elif [ "${mode}" = "postup" ]; then
-        _openvpn_postup
+        _openpvn_postup
         bashio::exit.ok 'OpenVPN routes added.'
     elif [ "${mode}" = "postdown" ]; then
-        _openvpn_postdown
+        _openpvn_postdown
         bashio::exit.ok 'OpenVPN routes deleted.'
     else
         bashio::log.error "Invalid OpenVPN mode specified. Use 'up', 'down', 'postup', or 'postdown'."