release: v1.3.3

Fix false-positive multi-default-route block that prevented TUN connections
on startup and after every disconnect on systems with Ethernet + Wi-Fi.

Route conflict detection now finds the minimum metric across all default
routes and only counts routes at that metric. Higher-metric routes are
failover entries and are no longer treated as conflicts. Virtual interfaces
(lo, docker*, veth*, br-*, virbr*, dummy*) are also excluded from the count.

Adds a bypassMultiRouteCheck toggle (Settings → Advanced) as an explicit
escape hatch for setups that still produce false positives.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: bernardopg

AdGuardVpnService.qml

@@ -21,7 +21,8 @@ Item {
             autoRefreshLocations: true,
             autoConnectOnStartup: false,
             autoReconnectOnDrop: false,
-            favoriteLocationIsos: []
+            favoriteLocationIsos: [],
+            bypassMultiRouteCheck: false
         })
 
     property string adguardBinary: defaults.adguardBinary
@@ -34,6 +35,7 @@ Item {
     property bool autoConnectOnStartup: defaults.autoConnectOnStartup
     property bool autoReconnectOnDrop: defaults.autoReconnectOnDrop
     property var favoriteLocationIsos: defaults.favoriteLocationIsos
+    property bool bypassMultiRouteCheck: defaults.bypassMultiRouteCheck
     property bool startupAutoConnectAttempted: false
     property bool suppressReconnectOnce: false
 
@@ -159,6 +161,7 @@ Item {
         autoConnectOnStartup = asBool(load("autoConnectOnStartup", defaults.autoConnectOnStartup), defaults.autoConnectOnStartup);
         autoReconnectOnDrop = asBool(load("autoReconnectOnDrop", defaults.autoReconnectOnDrop), defaults.autoReconnectOnDrop);
         favoriteLocationIsos = normalizeFavoriteLocationIsos(load("favoriteLocationIsos", defaults.favoriteLocationIsos));
+        bypassMultiRouteCheck = asBool(load("bypassMultiRouteCheck", defaults.bypassMultiRouteCheck), defaults.bypassMultiRouteCheck);
 
         restartTimers();
         checkCliAvailability();
@@ -796,8 +799,10 @@ Item {
                     ;;
             esac
 
-            if [ "${tunPreflightRequired ? "1" : "0"}" = "1" ] && command -v ip >/dev/null 2>&1; then
-                DEFAULT_ROUTE_COUNT="$(ip -o route show to default | wc -l | tr -d ' ')"
+            if [ "${tunPreflightRequired ? "1" : "0"}" = "1" ] && [ "${bypassMultiRouteCheck ? "1" : "0"}" = "0" ] && command -v ip >/dev/null 2>&1; then
+                _ROUTES="$(ip -o route show to default)"
+                _MIN_MET="$(printf '%s\n' "$_ROUTES" | awk '{m="0"; for(i=1;i<=NF;i++){if($i=="metric"){m=$(i+1);break}}; print m+0}' | sort -n | head -1)"
+                DEFAULT_ROUTE_COUNT="$(printf '%s\n' "$_ROUTES" | awk -v minm="$_MIN_MET" '{iface=""; m="0"; for(i=1;i<=NF;i++){if($i=="dev") iface=$(i+1); if($i=="metric") m=$(i+1)}; if(iface~/^(lo$|docker|veth|br-|virbr|dummy)/) next; if(m+0==minm+0) print}' | wc -l | tr -d ' ')"
                 if [ "\${DEFAULT_ROUTE_COUNT:-0}" -gt 1 ]; then
                     printf 'multi-default'
                     exit 44

AdGuardVpnSettings.qml

@@ -317,4 +317,19 @@ PluginSettings {
         description: root.t("settings.auto_reconnect_drop.description", "Automatically reconnect when the tunnel drops unexpectedly.")
         defaultValue: false
     }
+
+    StyledText {
+        width: parent.width
+        text: root.t("settings.group.advanced", "Advanced")
+        font.pixelSize: Theme.fontSizeSmall
+        font.weight: Font.DemiBold
+        color: Theme.surfaceVariantText
+    }
+
+    ToggleSetting {
+        settingKey: "bypassMultiRouteCheck"
+        label: root.t("settings.bypass_multi_route.label", "Bypass Multi-Route Check")
+        description: root.t("settings.bypass_multi_route.description", "Skip the pre-connection check for multiple default routes. Enable if TUN connections are blocked by a false positive on startup or after disconnect.")
+        defaultValue: false
+    }
 }

CHANGELOG.md

@@ -9,6 +9,21 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Sem
 
 ---
 
+## [1.3.3] - 2026-04-22
+
+### Fixed
+
+- Multi-default-route preflight check now only counts routes sharing the minimum metric. Physical interfaces with different metrics (e.g. Ethernet metric 100 + Wi-Fi metric 600) are no longer treated as a routing conflict, eliminating false-positive TUN-connect blocks on startup and after every disconnect.
+- Virtual interfaces (`lo`, `docker*`, `veth*`, `br-*`, `virbr*`, `dummy*`) are excluded from the route count to prevent false positives from container runtimes.
+
+### Added
+
+- **Bypass Multi-Route Check** toggle in Settings → Advanced to explicitly skip the preflight route check on setups where it still produces false positives.
+
+> **Full notes ->** [docs/releases/v1.3.3.md](./docs/releases/v1.3.3.md)
+
+---
+
 ## [1.3.2] - 2026-04-12
 
 ### Changed

docs/releases/v1.3.3.md

@@ -0,0 +1,19 @@
+# AdGuard VPN Plugin v1.3.3
+
+This hotfix release eliminates a persistent false positive that blocked TUN connections on startup and after every disconnect on systems with more than one physical network interface.
+
+## Highlights
+
+- Fixed the multi-default-route preflight check that incorrectly blocked TUN connections when two physical interfaces (e.g. Ethernet + Wi-Fi) each had a default route with different metrics.
+- Route conflict detection now only counts routes that share the same minimum metric — higher-metric routes are fallbacks, not conflicts.
+- Virtual interfaces (`lo`, `docker*`, `veth*`, `br-*`, `virbr*`, `dummy*`) are excluded from the route count to prevent false positives from container runtimes.
+- Added **Bypass Multi-Route Check** toggle (Settings → Advanced) as an explicit escape hatch for setups where the preflight still produces false positives.
+
+## Compatibility
+
+- Requires DankMaterialShell `>= 1.4.0`.
+- Requires `adguardvpn-cli` available in PATH (or configured binary path).
+
+## Notes
+
+- Previous release: `v1.3.2`

i18n/en.js

@@ -171,5 +171,8 @@ var translations = ({
     "settings.language.ur_PK": "Urdu",
     "settings.language.ms_MY": "Malay",
     "settings.unit.sec": "sec",
-    "settings.unit.items": "items"
+    "settings.unit.items": "items",
+    "settings.group.advanced": "Advanced",
+    "settings.bypass_multi_route.label": "Bypass Multi-Route Check",
+    "settings.bypass_multi_route.description": "Skip the pre-connection check for multiple default routes. Enable if TUN connections are blocked by a false positive on startup or after disconnect."
 });

i18n/pt_BR.js

@@ -171,5 +171,8 @@ var translations = ({
     "settings.language.ur_PK": "Urdu",
     "settings.language.ms_MY": "Malaio",
     "settings.unit.sec": "seg",
-    "settings.unit.items": "itens"
+    "settings.unit.items": "itens",
+    "settings.group.advanced": "Avançado",
+    "settings.bypass_multi_route.label": "Ignorar Verificação de Múltiplas Rotas",
+    "settings.bypass_multi_route.description": "Ignora a verificação de múltiplas rotas padrão antes de conectar. Ative se conexões TUN forem bloqueadas por falso positivo na inicialização ou após desconexão."
 });

plugin.json

@@ -2,7 +2,7 @@
   "id": "adguardVPplugin",
   "name": "AdGuard VPN",
   "description": "Control, configure, and monitor adguardvpn-cli directly from DankBar",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "author": "Bernardo Gomes",
   "type": "widget",
   "capabilities": ["vpn", "network", "dankbar-widget"],