[BUG]: VPN may be bypassed even when upstream interface is set to tun0 #310

Kernel Version

6.12.69-android16-Wild

Kernel Source Link (REQUIRED)

https://github.com/WildKernels/GKI_KernelSU_SUSFS/releases/download/r20/6.12.69-android16-2026-03-ReSukiSU-AnyKernel3.zip

Droidspaces Version

v6.5.5

Rooting Method

KernelSU (ReSukiSU)

Device OEM & Model

Google Pixel 11 Pro XL

Android Version & ROM

Android 17, stock ROM

Execution Mode

DAEMON

Networking Mode

NAT

Describe the Bug

My observation: on the host android with VPN enabled (NordVPN specifically), and with a container with upstream interface explicitly set to tun0, the internet traffic is still not routed through the VPN. I have verified the VPN is creating the interface at tun0.

It seems like my VPN is represented using split routes such as:

0.0.0.0/5 dev tun0
8.0.0.0/7 dev tun0
11.0.0.0/8 dev tun0
12.0.0.0/6 dev tun0
16.0.0.0/4 dev tun0
32.0.0.0/3 dev tun0
64.0.0.0/2 dev tun0
128.0.0.0/3 dev tun0
...
208.0.0.0/4 dev tun0

instead of a default dev tun0

AI: --upstream=tun0 assumes the selected interface's routing table contains an IPv4 0.0.0.0/0 route, but Android VpnService networks may represent a full-tunnel VPN using complementary/split prefixes rather than a literal default route.

You can also read my debugging session: https://chatgpt.com/share/6aa5f546-e3a0-83ec-883c-9cb4db32efa4, ChatGPT wrote a draft bug report that is a bit longer, and contains a suggested fix, but I have chosen to omit them here.

Steps to Reproduce

1. Turn on NordVPN
2. Open a container with --upstream=tun0
3. Observe that the traffic isn't routed through the VPN

Logs / Screenshots

Droidspaces-bugreport_2026-09-13_01-08-05.tar.gz

Required Acknowledgments

• I have verified this is not a duplicate issue.
• I am using a kernel compiled strictly according to Droidspaces' official documentation.
• I am NOT using a kernel with 69+ random configs, CRC nukes, or a broken ABI.
• I have confirmed this issue persists in both Daemon and Direct modes.
• I admit that I am a clown for checking this box, confirming I have NOT read these rules.
• I admit I did zero research, didn't ask my AI waifu for a fix, and am dropping this here because I'm 100% sure the fault lies with Droidspaces.