Fix Cascade egress verify to bind awg0 IP (v2.2.1).

Use client-subnet policy routing for curl checks instead of cascade peer Address; soft-warn when echo services fail but the route is OK.
2026-07-27 04:27:00 +03:00
parent ac76a0e540
commit 80160d0ef4
9 changed files with 168 additions and 26 deletions
@@ -227,10 +227,14 @@ GitHub Actions workflows in `.github/workflows/`:

 ## 📋 Fix / changelog (this fork)

+### v2.2.1
+*   **Cascade egress verify fix**: bind curl to ENTRY `awg0`/`wg0` IP (client-subnet policy route), not cascade peer Address.
+*   Soft-warn (no rollback) when policy route via `cascade` is OK but public-IP echo services fail.
+
 ### v2.2.0
 *   **Cascade (double VPN) restored** — stable entry→exit tunnel for AmneziaWG / WireGuard.
 *   Inspired by [ryderams/amneziawg-cascade](https://github.com/ryderams/amneziawg-cascade); logic runs over panel SSH (**no remote curl|bash**).
-*   Safety: require exit **handshake** when enabled; optional **egress verify** via cascade Address; subnet conflict check; exit `/32` return route with start.sh markers.
+*   Safety: require exit **handshake** when enabled; optional **egress verify**; subnet conflict check; exit `/32` return route with start.sh markers.
 *   UI on the server page with per-step settings (pin exit route, MSS clamp, verify egress, …). Defaults prefer **awg2**.

 ### v2.1.0