The safety net behind GhostMesh's router/Linux TUN mode
TUN mode redirects a device's default route and DNS through the tunnel — the riskiest possible change on a router or a box you only reach over SSH, because a bad config can cut off the very connection you'd use to fix it. GhostMesh guards that change with two independent watchdogs.
Why this matters more on a router than a desktop
On a desktop, a routing mistake is annoying but you're sitting in front of the machine. On a router administered only through the same link TUN mode is about to redirect, a mistake can lock you out entirely — the classic 'changed the firewall rule, lost the SSH session' failure mode.
Two independent layers of protection
Each watchdog can fail independently without leaving the device stranded, because they don't depend on each other or on the same process staying alive.
| Layer | Runs as | What it catches |
|---|---|---|
| In-process | Part of srsp-client itself | Reverts the routes/DNS it just applied if no upstream becomes reachable within the confirm timeout (default 30s), then falls back to proxy-only |
| Shell-level | A detached watchdog process, armed before anything starts | Keeps working even if srsp-client is killed outright, or if TUN mode itself is what cut off the session used to start it |
What gets rolled back
Both layers remove only what GhostMesh itself added — never a router's or server's pre-existing default route. That's what makes it safe to run the manual break-glass rollback command at any time, not just during a failure.
- Proxy mode has nothing to roll back in the first place, since it never touches routing or DNS.
- TUN mode's rollback is scoped to exactly the routes/DNS entries GhostMesh applied on connect.
- The shell-level watchdog is armed before the connection attempt starts, so it protects even a failure during the very first handshake.
FAQ
What's the default timeout before rollback triggers?
30 seconds (confirm_timeout_secs) with no reachable upstream, at which point the in-process watchdog reverts its own changes and falls back to proxy-only.
Does the watchdog remove my router's own default route?
No. Both layers remove only what GhostMesh itself added on connect — your prior default route is never touched.
What if srsp-client crashes instead of just failing to connect?
The shell-level watchdog is a separate detached process armed before the connection starts, so it keeps working even if srsp-client is killed outright or the TUN change itself cuts the session that started it.