From b49e63f8efdbe7071ec0784829833010fbfb4567 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E4=B8=96=E7=95=8C?= <i@sekai.icu>
Date: Fri, 17 Oct 2025 16:26:45 +0800
Subject: [PATCH] Fix compatibility with MPTCP

---
 redirect_nftables_rules.go | 37 +++++++++++++++++++++++++++++++++++++
 tun.go                     |  1 +
 2 files changed, 38 insertions(+)

diff --git a/redirect_nftables_rules.go b/redirect_nftables_rules.go
index ba4ee87..2d71fff 100644
--- a/redirect_nftables_rules.go
+++ b/redirect_nftables_rules.go
@@ -534,6 +534,43 @@ func (r *autoRedirect) nftablesCreateExcludeRules(nft *nftables.Conn, table *nft
 		nftablesCreateExcludeDestinationIPSet(nft, table, chain, 4, "inet6_route_exclude_address_set", nftables.TableFamilyIPv6, false)
 	}
 
+	mptcpVerdict := expr.VerdictDrop
+	if r.tunOptions.ExcludeMPTCP {
+		mptcpVerdict = expr.VerdictReturn
+	}
+	nft.AddRule(&nftables.Rule{
+		Table: table,
+		Chain: chain,
+		Exprs: []expr.Any{
+			&expr.Meta{
+				Key:      expr.MetaKeyL4PROTO,
+				Register: 1,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     []byte{unix.IPPROTO_TCP},
+			},
+			&expr.Exthdr{
+				DestRegister: 1,
+				Type:         30,
+				Offset:       0,
+				Len:          1,
+				Flags:        unix.NFT_EXTHDR_F_PRESENT,
+				Op:           expr.ExthdrOpTcpopt,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     []byte{1},
+			},
+			&expr.Counter{},
+			&expr.Verdict{
+				Kind: mptcpVerdict,
+			},
+		},
+	})
+
 	return nil
 }
 
diff --git a/tun.go b/tun.go
index d831742..c32cd8a 100644
--- a/tun.go
+++ b/tun.go
@@ -83,6 +83,7 @@ type Options struct {
 	AutoRedirectMarkMode     bool
 	AutoRedirectInputMark    uint32
 	AutoRedirectOutputMark   uint32
+	ExcludeMPTCP             bool
 	Inet4LoopbackAddress     []netip.Addr
 	Inet6LoopbackAddress     []netip.Addr
 	StrictRoute              bool