When VPN traffic is DNAT'd to local namespaces/VMs, reply packets have
a different source IP (namespace veth) so the policy route's
"from <VPN_IP>" rule doesn't match. CONNMARK marks all connections
arriving on the VPN interface and restores the mark on reply packets,
routing them back through the tunnel via fwmark rule.
New flag: -connmark (requires -policy-route-table)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Built-in DHCP (raw Ethernet frames through tunnel), automatic reconnection,
host route management, classless static routes (option 121/249), DNS config.
Single static binary, Linux only.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>