All time arguments now use -secs suffix with integer seconds for
consistency (-reconnect-delay-secs, -keepalive-timeout-secs).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Tracks last server receive time (atomic) and runs a watchdog goroutine
that closes the connection if no data arrives within the timeout,
triggering reconnection. Also fixes Close() to guard Conn.Close()
inside sync.Once so concurrent/repeated calls are safe.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When VPN traffic is DNAT'd to local namespaces/VMs, reply packets have
a different source IP (namespace veth) so the policy route's
"from <VPN_IP>" rule doesn't match. CONNMARK marks all connections
arriving on the VPN interface and restores the mark on reply packets,
routing them back through the tunnel via fwmark rule.
New flag: -connmark (requires -policy-route-table)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
