fix(proxy-init): split enforce-redirect into nat REDIRECT + mangle DROP

huang195 · huang195 · commit f884dc42ec5c · 2026-06-05T17:48:42.000-04:00
An end-to-end test (real transparent listener + real init-iptables.sh in a
privileged container, agent dialing an off-box upstream) caught that the nat
table forbids `-j DROP` ("the use of DROP is therefore inhibited"). The
original enforce-redirect put the non-TCP DROP in the nat AB_REDIRECT chain, so
the init script errored at runtime.

Fix: two chains.
- nat OUTPUT / AB_REDIRECT: exemptions + REDIRECT external TCP to
  TRANSPARENT_PORT (no DROP).
- mangle OUTPUT / AB_NOTCP: ESTABLISHED,RELATED + same exemptions, then
  `-p tcp -j RETURN` (TCP falls through to the nat REDIRECT) and a terminal
  DROP for external non-TCP (UDP/QUIC). mangle runs before nat in the OUTPUT
  hook, so non-TCP drops on its original destination and TCP reaches the nat
  REDIRECT. Both inserted at position 1 to preempt Istio's appended chains.

Updates test-enforce-redirect.sh to assert the two-chain structure (nat has no
DROP; mangle AB_NOTCP has the tcp-RETURN + DROP) and reads the non-TCP DROP
counter from mangle. README updated to document the two-chain design.

End-to-end verified: under enforce-redirect a uid!=PROXY_UID agent dialing an
external upstream directly is captured (reaches it via the transparent listener,
SO_ORIGINAL_DST recovers the original dst); under enforce-drop the same
connection times out; re-enabling enforce-redirect recovers delivery.

Assisted-By: Claude (Anthropic AI) &lt;noreply@anthropic.com&gt;
Signed-off-by: Hai Huang &lt;huang195@gmail.com&gt;
diff --git a/authbridge/proxy-init/README.md b/authbridge/proxy-init/README.md
@@ -43,27 +43,28 @@ default 8082), which recovers the original destination via
 Because nothing is dropped, agents that ignore `HTTP_PROXY` keep working
 — which is what lets enforcement be always-on.
 
-`init-iptables.sh` builds a dedicated `AB_REDIRECT` chain hooked from
-**`nat` OUTPUT at position 1** (REDIRECT is a nat-table target), with
-this order:
-
-1. `RETURN` ztunnel's own sockets (fwmark `0x539`) — no-op without ambient.
-2. `RETURN` the proxy's own re-originated egress (`--uid-owner $PROXY_UID`, default 1337) — avoids the redirect loop.
-3. `RETURN` loopback (the app → forward proxy hop) and in-cluster CIDRs (`CLUSTER_CIDRS`, mesh/DNS) — left direct.
-4. `REDIRECT` external **TCP** to `TRANSPARENT_PORT` — captured.
-5. `DROP` everything else — external **non-TCP** (UDP/QUIC), so HTTP/3 cannot bypass; well-behaved clients fall back to TCP and get captured.
-
-An IPv6 mirror applies the same exemptions, REDIRECTs external v6 TCP,
-and drops other v6 egress. There is no conntrack `ESTABLISHED` rule —
-nat only evaluates the first packet of a flow, so replies and
-established connections are not re-translated.
-
-`enforce-redirect` is inserted at `nat OUTPUT` position 1, ahead of
-Istio's appended (`-A`) `ISTIO_OUTPUT` chain, so it preempts ambient's
-nat redirect for external destinations — exactly as `redirect` mode does
-for the Envoy path. See
+`init-iptables.sh` installs **two** chains, because `REDIRECT` is a
+nat-table target but the nat table forbids `DROP` (`iptables` errors with
+"the use of DROP is therefore inhibited"):
+
+- **`nat` OUTPUT / `AB_REDIRECT`** (position 1): `RETURN` ztunnel mark
+  `0x539`, the proxy UID (`--uid-owner $PROXY_UID`, avoids the loop),
+  loopback, and `CLUSTER_CIDRS`; then `REDIRECT` external **TCP** to
+  `TRANSPARENT_PORT`.
+- **`mangle` OUTPUT / `AB_NOTCP`** (position 1): the same exemptions
+  (plus `ESTABLISHED,RELATED` first, so UDP conntrack replies like DNS
+  pass), then `-p tcp -j RETURN` (TCP is handled by the nat REDIRECT) and
+  a terminal `DROP` for external **non-TCP** (UDP/QUIC), so HTTP/3 cannot
+  bypass — well-behaved clients fall back to TCP and get captured.
+
+Because the OUTPUT hook order is `raw → mangle → nat → filter`, the
+mangle chain drops non-TCP on its original destination while TCP falls
+through to the nat REDIRECT. Both chains are inserted at position 1,
+ahead of Istio's appended (`-A`) chains, so they preempt ambient's nat
+redirect for external destinations — exactly as `redirect` mode does for
+the Envoy path. IPv6 mirrors apply the same rules. See
 [`test-enforce-redirect.sh`](./test-enforce-redirect.sh), which proves
-both the capture and the preemption via packet counters.
+the capture, the preemption, and the non-TCP drop via packet counters.
 
 `CLUSTER_CIDRS` has the same Kind-shaped default and OCP/EKS override
 requirement as documented under `enforce-drop` below.
diff --git a/authbridge/proxy-init/init-iptables.sh b/authbridge/proxy-init/init-iptables.sh
@@ -333,35 +333,62 @@ setup_enforce_drop() {
 # Unlike enforce-drop there is no conntrack ESTABLISHED rule: nat only evaluates
 # the first packet of a flow, so replies and established connections are not
 # re-translated.
+# Two chains are needed because REDIRECT is a nat-table target but the nat table
+# forbids DROP ("the use of DROP is therefore inhibited"):
+#   * nat   OUTPUT / AB_REDIRECT — REDIRECT external TCP to TRANSPARENT_PORT.
+#   * mangle OUTPUT / AB_NOTCP   — DROP external non-TCP (UDP/QUIC) so HTTP/3
+#                                  cannot bypass; `-p tcp -j RETURN` lets TCP
+#                                  fall through to the nat REDIRECT.
+# mangle runs before nat in the OUTPUT hook, so non-TCP is dropped on its
+# original destination and TCP is passed to the nat REDIRECT. Both are inserted
+# at position 1 to precede Istio's appended chains.
 setup_enforce_redirect() {
-  CHAIN="AB_REDIRECT"
+  REDIR_CHAIN="AB_REDIRECT"
+  NOTCP_CHAIN="AB_NOTCP"
 
-  echo "enforce-redirect: installing fail-closed egress capture (nat OUTPUT, chain ${CHAIN})"
-  echo "enforce-redirect: external TCP -> 127.0.0.1:${TRANSPARENT_PORT}; exempt proxy UID=${PROXY_UID}; direct in-cluster CIDRs=${CLUSTER_CIDRS}"
+  echo "enforce-redirect: installing fail-closed egress capture"
+  echo "enforce-redirect: external TCP -> 127.0.0.1:${TRANSPARENT_PORT} (nat REDIRECT); external non-TCP -> DROP (mangle)"
+  echo "enforce-redirect: exempt proxy UID=${PROXY_UID}; direct in-cluster CIDRs=${CLUSTER_CIDRS}"
 
-  # --- IPv4 ---
-  ${IPT} -t nat -N "${CHAIN}" 2>/dev/null || true
-  ${IPT} -t nat -F "${CHAIN}"
+  # --- IPv4: nat REDIRECT for TCP ---
+  ${IPT} -t nat -N "${REDIR_CHAIN}" 2>/dev/null || true
+  ${IPT} -t nat -F "${REDIR_CHAIN}"
   # ztunnel's own sockets (ambient) carry fwmark 0x539 — let them through.
-  ${IPT} -t nat -A "${CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
+  ${IPT} -t nat -A "${REDIR_CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
   # the AuthBridge proxy's own re-originated egress (runs as PROXY_UID) — avoids
   # redirecting the proxy's upstream dial back into itself.
-  ${IPT} -t nat -A "${CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
+  ${IPT} -t nat -A "${REDIR_CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
   # app -> forward proxy over loopback (HTTP_PROXY target), and any loopback.
-  ${IPT} -t nat -A "${CHAIN}" -o lo -j RETURN
-  ${IPT} -t nat -A "${CHAIN}" -d 127.0.0.0/8 -j RETURN
+  ${IPT} -t nat -A "${REDIR_CHAIN}" -o lo -j RETURN
+  ${IPT} -t nat -A "${REDIR_CHAIN}" -d 127.0.0.0/8 -j RETURN
   # in-cluster traffic (pods / services / DNS) — left direct, carried by the mesh.
   for cidr in $(echo "${CLUSTER_CIDRS}" | tr ',' ' '); do
-    [ -n "${cidr}" ] && ${IPT} -t nat -A "${CHAIN}" -d "${cidr}" -j RETURN
+    [ -n "${cidr}" ] && ${IPT} -t nat -A "${REDIR_CHAIN}" -d "${cidr}" -j RETURN
   done
   # external TCP that bypassed the forward proxy — capture it transparently.
-  ${IPT} -t nat -A "${CHAIN}" -p tcp -j REDIRECT --to-port "${TRANSPARENT_PORT}"
-  # external non-TCP (UDP/QUIC) — cannot be redirected to a TCP listener; drop so
-  # HTTP/3 cannot bypass. Clients fall back to TCP, which the rule above captures.
-  ${IPT} -t nat -A "${CHAIN}" -j DROP
-  # Hook at position 1 so we run before any appended Istio nat chain.
-  if ! ${IPT} -t nat -C OUTPUT -j "${CHAIN}" 2>/dev/null; then
-    ${IPT} -t nat -I OUTPUT 1 -j "${CHAIN}"
+  ${IPT} -t nat -A "${REDIR_CHAIN}" -p tcp -j REDIRECT --to-port "${TRANSPARENT_PORT}"
+  if ! ${IPT} -t nat -C OUTPUT -j "${REDIR_CHAIN}" 2>/dev/null; then
+    ${IPT} -t nat -I OUTPUT 1 -j "${REDIR_CHAIN}"
+  fi
+
+  # --- IPv4: mangle DROP for non-TCP ---
+  ${IPT} -t mangle -N "${NOTCP_CHAIN}" 2>/dev/null || true
+  ${IPT} -t mangle -F "${NOTCP_CHAIN}"
+  # established/related replies (incl. UDP conntrack, e.g. DNS replies) first.
+  ${IPT} -t mangle -A "${NOTCP_CHAIN}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+  ${IPT} -t mangle -A "${NOTCP_CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
+  ${IPT} -t mangle -A "${NOTCP_CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
+  ${IPT} -t mangle -A "${NOTCP_CHAIN}" -o lo -j RETURN
+  ${IPT} -t mangle -A "${NOTCP_CHAIN}" -d 127.0.0.0/8 -j RETURN
+  for cidr in $(echo "${CLUSTER_CIDRS}" | tr ',' ' '); do
+    [ -n "${cidr}" ] && ${IPT} -t mangle -A "${NOTCP_CHAIN}" -d "${cidr}" -j RETURN
+  done
+  # TCP is handled by the nat REDIRECT above — let it pass mangle untouched.
+  ${IPT} -t mangle -A "${NOTCP_CHAIN}" -p tcp -j RETURN
+  # everything else == external non-TCP egress (UDP/QUIC) — drop it.
+  ${IPT} -t mangle -A "${NOTCP_CHAIN}" -j DROP
+  if ! ${IPT} -t mangle -C OUTPUT -j "${NOTCP_CHAIN}" 2>/dev/null; then
+    ${IPT} -t mangle -I OUTPUT 1 -j "${NOTCP_CHAIN}"
   fi
   echo "enforce-redirect: IPv4 egress capture configured"
 
@@ -370,21 +397,38 @@ setup_enforce_redirect() {
   # loopback + link-local (fe80::/10 unicast, ff02::/16 NDP/MLD multicast) and
   # the proxy UID / ztunnel mark; REDIRECT external v6 TCP; DROP other v6 egress.
   if command -v "${IP6T%% *}" >/dev/null 2>&1 && ${IP6T} -t nat -L >/dev/null 2>&1; then
-    ${IP6T} -t nat -N "${CHAIN}" 2>/dev/null || true
-    ${IP6T} -t nat -F "${CHAIN}"
-    ${IP6T} -t nat -A "${CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
-    ${IP6T} -t nat -A "${CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
-    ${IP6T} -t nat -A "${CHAIN}" -o lo -j RETURN
-    ${IP6T} -t nat -A "${CHAIN}" -d ::1/128 -j RETURN
-    ${IP6T} -t nat -A "${CHAIN}" -d fe80::/10 -j RETURN
-    ${IP6T} -t nat -A "${CHAIN}" -d ff02::/16 -j RETURN
+    ${IP6T} -t nat -N "${REDIR_CHAIN}" 2>/dev/null || true
+    ${IP6T} -t nat -F "${REDIR_CHAIN}"
+    ${IP6T} -t nat -A "${REDIR_CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
+    ${IP6T} -t nat -A "${REDIR_CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
+    ${IP6T} -t nat -A "${REDIR_CHAIN}" -o lo -j RETURN
+    ${IP6T} -t nat -A "${REDIR_CHAIN}" -d ::1/128 -j RETURN
+    ${IP6T} -t nat -A "${REDIR_CHAIN}" -d fe80::/10 -j RETURN
+    ${IP6T} -t nat -A "${REDIR_CHAIN}" -d ff02::/16 -j RETURN
+    for cidr in $(echo "${CLUSTER_CIDRS6}" | tr ',' ' '); do
+      [ -n "${cidr}" ] && ${IP6T} -t nat -A "${REDIR_CHAIN}" -d "${cidr}" -j RETURN
+    done
+    ${IP6T} -t nat -A "${REDIR_CHAIN}" -p tcp -j REDIRECT --to-port "${TRANSPARENT_PORT}"
+    if ! ${IP6T} -t nat -C OUTPUT -j "${REDIR_CHAIN}" 2>/dev/null; then
+      ${IP6T} -t nat -I OUTPUT 1 -j "${REDIR_CHAIN}"
+    fi
+
+    ${IP6T} -t mangle -N "${NOTCP_CHAIN}" 2>/dev/null || true
+    ${IP6T} -t mangle -F "${NOTCP_CHAIN}"
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -o lo -j RETURN
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -d ::1/128 -j RETURN
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -d fe80::/10 -j RETURN
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -d ff02::/16 -j RETURN
     for cidr in $(echo "${CLUSTER_CIDRS6}" | tr ',' ' '); do
-      [ -n "${cidr}" ] && ${IP6T} -t nat -A "${CHAIN}" -d "${cidr}" -j RETURN
+      [ -n "${cidr}" ] && ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -d "${cidr}" -j RETURN
     done
-    ${IP6T} -t nat -A "${CHAIN}" -p tcp -j REDIRECT --to-port "${TRANSPARENT_PORT}"
-    ${IP6T} -t nat -A "${CHAIN}" -j DROP
-    if ! ${IP6T} -t nat -C OUTPUT -j "${CHAIN}" 2>/dev/null; then
-      ${IP6T} -t nat -I OUTPUT 1 -j "${CHAIN}"
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -p tcp -j RETURN
+    ${IP6T} -t mangle -A "${NOTCP_CHAIN}" -j DROP
+    if ! ${IP6T} -t mangle -C OUTPUT -j "${NOTCP_CHAIN}" 2>/dev/null; then
+      ${IP6T} -t mangle -I OUTPUT 1 -j "${NOTCP_CHAIN}"
     fi
     echo "enforce-redirect: IPv6 egress capture configured"
   else
diff --git a/authbridge/proxy-init/test-enforce-redirect.sh b/authbridge/proxy-init/test-enforce-redirect.sh
@@ -5,14 +5,16 @@
 #
 # It validates, in a private network namespace:
 #   1. Rule STRUCTURE — the AB_REDIRECT chain is hooked from nat OUTPUT at
-#      position 1 with the expected RETURN exemptions, a `-p tcp` REDIRECT to
-#      TRANSPARENT_PORT, and a terminal DROP; and no mangle rules are created.
+#      position 1 with the expected RETURN exemptions and a `-p tcp` REDIRECT to
+#      TRANSPARENT_PORT (no DROP — the nat table forbids it); and the AB_NOTCP
+#      chain is hooked from mangle OUTPUT with `-p tcp RETURN` then a terminal
+#      DROP for external non-TCP egress.
 #   2. CAPTURE (not drop) + AMBIENT ROBUSTNESS — external TCP egress is
 #      REDIRECTed to TRANSPARENT_PORT, preempting a simulated Istio ambient
 #      "nat OUTPUT REDIRECT" appended after our chain. Proven via packet
 #      counters: our REDIRECT increments, the simulated ISTIO REDIRECT does not.
 #   3. NON-TCP DROP — an external UDP datagram (QUIC/HTTP-3 bypass attempt) hits
-#      the terminal DROP, proving non-TCP external egress cannot bypass.
+#      the mangle AB_NOTCP DROP, proving non-TCP external egress cannot bypass.
 #
 # Requirements: root (for unshare --net + iptables), iproute2, iptables-nft,
 # bash, the dummy kernel module. Runs on Linux / CI (e.g. ubuntu-latest); not on
@@ -51,26 +53,37 @@ env MODE=enforce-redirect PROXY_UID=1337 CLUSTER_CIDRS=10.0.0.0/8 \
     IPTABLES_CMD="${IPT}" IP6TABLES_CMD=ip6tables-nft \
     sh "${INIT}" || { echo "FAIL: init script exited non-zero"; exit 1; }
 
-dump=$("${IPT}" -t nat -S)
-echo "--- nat ruleset ---"; echo "${dump}"
+natdump=$("${IPT}" -t nat -S)
+mangledump=$("${IPT}" -t mangle -S)
+echo "--- nat ruleset ---"; echo "${natdump}"
+echo "--- mangle ruleset ---"; echo "${mangledump}"
 
-assert() { if echo "${dump}" | grep -qE "$2"; then echo "PASS: $1"; else echo "FAIL: $1"; fail=1; fi; }
-assert "AB_REDIRECT hooked from OUTPUT" '^-A OUTPUT -j AB_REDIRECT'
-assert "ztunnel mark RETURN"            'AB_REDIRECT .*mark.*0x539.*-j RETURN'
-assert "proxy UID RETURN"               'AB_REDIRECT .*--uid-owner 1337 -j RETURN'
-assert "loopback iface RETURN"          'AB_REDIRECT -o lo -j RETURN'
-assert "loopback cidr RETURN"           'AB_REDIRECT -d 127.0.0.0/8 -j RETURN'
-assert "cluster cidr RETURN"            'AB_REDIRECT -d 10.0.0.0/8 -j RETURN'
-assert "tcp REDIRECT to transparent"    "AB_REDIRECT -p tcp -j REDIRECT --to-ports ${TPORT}"
-assert "terminal DROP (non-tcp)"        'AB_REDIRECT -j DROP'
+assert() { if echo "$3" | grep -qE "$2"; then echo "PASS: $1"; else echo "FAIL: $1"; fail=1; fi; }
+# nat AB_REDIRECT — TCP capture (no DROP; nat forbids it).
+assert "AB_REDIRECT hooked from nat OUTPUT" '^-A OUTPUT -j AB_REDIRECT' "${natdump}"
+assert "nat ztunnel mark RETURN"            'AB_REDIRECT .*mark.*0x539.*-j RETURN' "${natdump}"
+assert "nat proxy UID RETURN"               'AB_REDIRECT .*--uid-owner 1337 -j RETURN' "${natdump}"
+assert "nat loopback iface RETURN"          'AB_REDIRECT -o lo -j RETURN' "${natdump}"
+assert "nat loopback cidr RETURN"           'AB_REDIRECT -d 127.0.0.0/8 -j RETURN' "${natdump}"
+assert "nat cluster cidr RETURN"            'AB_REDIRECT -d 10.0.0.0/8 -j RETURN' "${natdump}"
+assert "nat tcp REDIRECT to transparent"    "AB_REDIRECT -p tcp -j REDIRECT --to-ports ${TPORT}" "${natdump}"
+if echo "${natdump}" | grep -qE 'AB_REDIRECT -j DROP'; then
+  echo "FAIL: nat AB_REDIRECT must not contain DROP (nat table forbids it)"; fail=1
+else echo "PASS: nat AB_REDIRECT has no DROP (correctly delegated to mangle)"; fi
+# mangle AB_NOTCP — non-TCP drop, TCP passes through to the nat REDIRECT.
+assert "AB_NOTCP hooked from mangle OUTPUT"  '^-A OUTPUT -j AB_NOTCP' "${mangledump}"
+assert "mangle established/related RETURN"   'AB_NOTCP -m conntrack --ctstate (ESTABLISHED,RELATED|RELATED,ESTABLISHED) -j RETURN' "${mangledump}"
+assert "mangle proxy UID RETURN"             'AB_NOTCP .*--uid-owner 1337 -j RETURN' "${mangledump}"
+assert "mangle cluster cidr RETURN"          'AB_NOTCP -d 10.0.0.0/8 -j RETURN' "${mangledump}"
+assert "mangle tcp RETURN (defer to nat)"    'AB_NOTCP -p tcp -j RETURN' "${mangledump}"
+assert "mangle terminal DROP (non-tcp)"      'AB_NOTCP -j DROP' "${mangledump}"
 
 pos1=$("${IPT}" -t nat -L OUTPUT --line-numbers -n | awk '$1=="1"{print $2}')
-if [ "${pos1}" = "AB_REDIRECT" ]; then echo "PASS: AB_REDIRECT at OUTPUT position 1"
-else echo "FAIL: AB_REDIRECT not at OUTPUT position 1 (got '${pos1}')"; fail=1; fi
-
-manglecount=$("${IPT}" -t mangle -S | grep -cE 'AB_REDIRECT|AB_EGRESS' || true)
-if [ "${manglecount:-0}" -eq 0 ]; then echo "PASS: no mangle-table rules created"
-else echo "FAIL: enforce-redirect created mangle rules"; fail=1; fi
+if [ "${pos1}" = "AB_REDIRECT" ]; then echo "PASS: AB_REDIRECT at nat OUTPUT position 1"
+else echo "FAIL: AB_REDIRECT not at nat OUTPUT position 1 (got '${pos1}')"; fail=1; fi
+mpos1=$("${IPT}" -t mangle -L OUTPUT --line-numbers -n | awk '$1=="1"{print $2}')
+if [ "${mpos1}" = "AB_NOTCP" ]; then echo "PASS: AB_NOTCP at mangle OUTPUT position 1"
+else echo "FAIL: AB_NOTCP not at mangle OUTPUT position 1 (got '${mpos1}')"; fail=1; fi
 
 echo "### Capture + preemption test: append a simulated ISTIO_OUTPUT nat REDIRECT"
 "${IPT}" -t nat -A OUTPUT -p tcp -d "${EXTERNAL}" -j REDIRECT --to-ports 19999
@@ -89,8 +102,8 @@ fi
 
 echo "### Non-TCP drop test: send an external UDP datagram (QUIC bypass attempt)"
 timeout 2 bash -c "echo -n x >/dev/udp/${EXTERNAL}/53" 2>/dev/null || true
-dropc=$("${IPT}" -t nat -L AB_REDIRECT -n -v | awk '/DROP/{print $1; exit}')
-echo "AB_REDIRECT DROP pkts=${dropc:-?}"
+dropc=$("${IPT}" -t mangle -L AB_NOTCP -n -v | awk '/DROP/{print $1; exit}')
+echo "mangle AB_NOTCP DROP pkts=${dropc:-?}"
 if [ "${dropc:-0}" -gt 0 ]; then
   echo "PASS: external UDP dropped (HTTP/3 cannot bypass)"
 else
