validate-mtu, nexthop and tun address config

client/internal/routemanager/client.go

@@ -261,6 +261,12 @@ func (c *clientNetwork) recalculateRouteAndUpdatePeerAndSystem() error {
 			return fmt.Errorf("remove route from peer: %v", err)
 		}
 	} else {
+		if c.network == netip.MustParsePrefix("0.0.0.0/0") {
+			s, err := c.statusRecorder.GetPeer(c.routes[chosen].Peer)
+			if err == nil && s.IP != "" {
+				exitIP = netip.MustParseAddr(s.IP)
+			}
+		}
 		// otherwise add the route to the system
 		if err := addVPNRoute(c.network, c.getAsInterface()); err != nil {
 			return fmt.Errorf("route %s couldn't be added for peer %s, err: %v",

client/internal/routemanager/systemops.go

@@ -29,6 +29,7 @@ var ErrRouteNotFound = errors.New("route not found")
 var ErrRouteNotAllowed = errors.New("route not allowed")
 
 var tunIP netip.Addr
+var exitIP netip.Addr
 
 // TODO: fix: for default our wg address now appears as the default gw
 func addRouteForCurrentDefaultGateway(prefix netip.Prefix) error {
@@ -198,10 +199,14 @@ func addRouteToNonVPNIntf(prefix netip.Prefix, vpnIntf *iface.WGIface, initialNe
 // in two /1 prefixes to avoid replacing the existing default route
 func genericAddVPNRoute(prefix netip.Prefix, intf *net.Interface) error {
 	if prefix == defaultv4 {
-		if err := addToRouteTable(splitDefaultv4_1, tunIP, intf); err != nil {
+		ip := tunIP
+		if exitIP.IsValid() {
+			ip = exitIP
+		}
+		if err := addToRouteTable(splitDefaultv4_1, ip, intf); err != nil {
 			return err
 		}
-		if err := addToRouteTable(splitDefaultv4_2, tunIP, intf); err != nil {
+		if err := addToRouteTable(splitDefaultv4_2, ip, intf); err != nil {
 			if err2 := removeFromRouteTable(splitDefaultv4_1, netip.Addr{}, intf); err2 != nil {
 				log.Warnf("Failed to rollback route addition: %s", err2)
 			}