Fix MMDS iptables rule to use ACCEPT instead of RETURN

The RETURN target in user-defined chains does not prevent subsequent
rules in the parent chain from matching. When MMDS traffic hits RETURN,
it continues evaluation at the next rule in PREROUTING/OUTPUT where
user REDIRECT rules can still hijack the traffic.

Using ACCEPT terminates all NAT rule evaluation for the packet,
preventing any subsequent REDIRECT rules from matching MMDS traffic.

Author: cursoragent

packages/envd/internal/host/mmds_route_linux.go

@@ -18,7 +18,7 @@ func PinMMDSRoute(ctx context.Context) {
 	commands := [][]string{
 		{"-N", "E2B_MMDS"},
 		{"-F", "E2B_MMDS"},
-		{"-A", "E2B_MMDS", "-d", "169.254.169.254", "-p", "tcp", "--dport", "80", "-j", "RETURN"},
+		{"-A", "E2B_MMDS", "-d", "169.254.169.254", "-p", "tcp", "--dport", "80", "-j", "ACCEPT"},
 		{"-D", "PREROUTING", "-j", "E2B_MMDS"},
 		{"-I", "PREROUTING", "1", "-j", "E2B_MMDS"},
 		{"-D", "OUTPUT", "-j", "E2B_MMDS"},