[Unit]
Description=Block direct leaks from the VPN LAN to the upstream interface
Before=sing-box.service vpn-egress-sync.service
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/vpn-egressctl guard-apply
RemainAfterExit=yes
UMask=0077
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
RestrictRealtime=yes
LockPersonality=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK
ReadOnlyPaths=/etc/vpn-egress/policy.json
CapabilityBoundingSet=CAP_NET_ADMIN
AmbientCapabilities=CAP_NET_ADMIN

[Install]
WantedBy=multi-user.target