Monitoring Interfaces: sweep the stale main-table route when alias mode deploys

A row deployed plain and later switched to alias via "Save without deploying"
+ the row-level Deploy button (which, unlike Save & Deploy, never tears down
the old config) kept its old main-table host route. In alias mode that route
still captures the shared TARGET_IP in the main table ahead of the other
WAN's device - the exact hijack alias mode exists to prevent.

The boot script's alias branch now deletes this interface's main-table host
route (dev-scoped, so another row legitimately routing the same TARGET_IP
via its own interface is untouched), and the idempotency guard requires its
absence - so the cron watchdog also self-heals state left behind by earlier
builds. Verified end-to-end in a NET_ADMIN container: plain deploy, alias
deploy over it, idempotent re-run.

Author: Optic00

src/NetworkOptimizer.Web/Services/MonitoringInterfaceDeploymentService.cs

@@ -779,25 +779,35 @@ ip addr flush dev ""$IFACE"" 2>/dev/null
 # 3. host route to the modem/ONT. Aliased interfaces skip the main-table route entirely
 # (ambiguous when two WANs share TARGET_IP) and instead route via a private per-interface
 # table, selected by an fwmark set on ALIAS_IP before DNAT rewrites it to TARGET_IP. All
-# four alias artifacts are checked together before touching any of them: tearing down and
-# re-adding on every tick (rather than only when something's actually missing or wrong)
+# four alias artifacts - plus the absence of a stale main-table route left by a pre-alias
+# deployment of this row - are checked together before touching any of them: tearing down
+# and re-adding on every tick (rather than only when something's actually missing or wrong)
 # would defeat the ""only log when changed"" eMMC guard below AND open a window, every
 # single tick, where the mark rule is briefly absent - during which an in-flight flow to
 # the alias can leak via the main table toward the OTHER WAN's device, the exact hijack
 # this feature exists to prevent.
 if [ ""$ALIAS_ENABLED"" = ""1"" ]; then
     if ip route show table ""$TABLE"" ""$TARGET_IP/32"" 2>/dev/null | grep -q ""dev $IFACE"" &&
        ip route show table ""$TABLE"" ""$TARGET_IP/32"" 2>/dev/null | grep -q ""src $LOCAL_IP"" &&
+       ! ip route show ""$TARGET_IP/32"" 2>/dev/null | grep -q ""dev $IFACE"" &&
        ip rule show | grep -qF ""fwmark $MARK/$MASK lookup $TABLE"" &&
        iptables -w 5 -t mangle -C PREROUTING -d ""$ALIAS_IP"" -j MARK --set-xmark ""$MARK/$MASK"" 2>/dev/null &&
        iptables -w 5 -t nat -C PREROUTING -m mark --mark ""$MARK/$MASK"" -j DNAT --to-destination ""$TARGET_IP"" 2>/dev/null; then
-        : # all four alias artifacts already present and correct - nothing to do this tick
+        : # all four alias artifacts present and no stale main-table route - nothing to do this tick
     else
         cleanup_marked_rules mangle
         cleanup_marked_rules nat
         ip rule show | grep -q ""lookup $TABLE\b"" && ip rule del fwmark ""$MARK/$MASK"" lookup ""$TABLE"" 2>/dev/null
         ip route flush table ""$TABLE"" 2>/dev/null
 
+        # A pre-alias plain deployment of this row left its host route in the MAIN table,
+        # where it keeps capturing the shared TARGET_IP ahead of the other WAN's device -
+        # the exact hijack alias mode exists to prevent. dev-scoped delete: another row may
+        # legitimately route the same TARGET_IP via ITS OWN interface.
+        if ip route show ""$TARGET_IP/32"" 2>/dev/null | grep -q ""dev $IFACE""; then
+            ip route del ""$TARGET_IP/32"" dev ""$IFACE"" && changed=1 || fail=1
+        fi
+
         ip route replace ""$TARGET_IP/32"" dev ""$IFACE"" src ""$LOCAL_IP"" table ""$TABLE"" && changed=1 || fail=1
         ip rule add fwmark ""$MARK/$MASK"" lookup ""$TABLE"" && changed=1 || fail=1
         iptables -w 5 -t mangle -A PREROUTING -d ""$ALIAS_IP"" -j MARK --set-xmark ""$MARK/$MASK"" && changed=1 || fail=1

tests/NetworkOptimizer.Web.Tests/MonitoringInterfaceDeploymentServiceTests.cs

@@ -150,6 +150,22 @@ public void BootScript_IdempotencyGuard_AlsoChecksRouteSrc()
         script.Should().Contain("ip route show table \"$TABLE\" \"$TARGET_IP/32\" 2>/dev/null | grep -q \"src $LOCAL_IP\"");
     }
 
+    [Fact]
+    public void BootScript_Aliased_SweepsStaleMainTableRoute()
+    {
+        // A row deployed plain and later switched to alias mode via "Save without
+        // deploying" + the row-level Deploy button (which, unlike SaveAndDeploy, never
+        // tears down the old config) keeps its old main-table host route. In alias mode
+        // that route still captures the shared TARGET_IP in the main table - the exact
+        // other-WAN hijack alias mode exists to prevent. The alias branch must delete it,
+        // and the idempotency guard must require its absence (a fast path that only checks
+        // the four alias artifacts would skip the sweep forever).
+        var script = MonitoringInterfaceDeploymentService.GenerateBootScript(ValidAliased());
+
+        script.Should().Contain("! ip route show \"$TARGET_IP/32\" 2>/dev/null | grep -q \"dev $IFACE\" &&");
+        script.Should().Contain("ip route del \"$TARGET_IP/32\" dev \"$IFACE\" && changed=1 || fail=1");
+    }
+
     [Fact]
     public void BootScript_CleanupMarkedRules_LoopReadsFromFileNotPipe_SoFailureFlagSurvives()
     {