docs(tproxy): document the src_valid_mark=0 prerequisite (silent martian drop)

docs/config/inbound/listeners/tproxy.en.md

@@ -11,6 +11,22 @@ listeners:
 
 ## [General Fields](./index.md)
 
+!!! warning "System prerequisite: src_valid_mark must be 0"
+
+    TPROXY requires kernel-side setup (fwmark + policy routing table + local route, usually configured
+    by a front-end) and **`net.ipv4.conf.all.src_valid_mark` must be `0`**. Note that this sysctl is
+    evaluated as `max(conf/all, conf/<iface>)`, so setting it to 0 for a single interface (e.g. `br-lan`)
+    is not enough. If it is `1`, forwarded connections get their fwmark used in the reverse-path lookup of
+    `fib_validate_source()`, land on the local route (`RTN_LOCAL`) and are **silently dropped** as martian
+    sources:
+
+    - Symptom: **all LAN clients lose Internet access** (TCP/UDP black hole, DNS still works) while the
+      **router itself keeps working**, and app/core/firewall logs and drop counters show nothing unusual;
+    - Common source: Tailscale 1.98+ (default `NetfilterMode=on`) writes `1` on startup, see
+      [tailscale/tailscale#19796](https://github.com/tailscale/tailscale/issues/19796);
+    - Fix: `tailscale set --netfilter-mode=off` and reboot, or `sysctl -w net.ipv4.conf.all.src_valid_mark=0`;
+    - Check: `sysctl -n net.ipv4.conf.all.src_valid_mark` should print `0`.
+
 ## Protocol Configuration
 
 ### udp

docs/config/inbound/listeners/tproxy.md

@@ -11,6 +11,21 @@ listeners:
 
 ## [通用字段](./index.md)
 
+!!! warning "系统前置要求：src_valid_mark 必须为 0"
+
+    TPROXY 需要内核侧的配合（fwmark + 策略路由表 + 本地路由，通常由前端自动配置），并且
+    **`net.ipv4.conf.all.src_valid_mark` 必须为 `0`**。注意该 sysctl 取 `max(conf/all, conf/<iface>)`，
+    所以只把某一个接口（如 `br-lan`）设为 0 是无效的。若它被置为 `1`，转发进来的连接会在内核
+    `fib_validate_source()` 的源地址反查中带着 fwmark 命中本地路由表，判定为 `RTN_LOCAL` 后被当作
+    martian source **静默丢弃**：
+
+    - 现象：**局域网客户端全部无法上网**（TCP/UDP 黑洞、DNS 正常），而**路由器本机正常**，
+      且插件/核心/防火墙的日志与丢包计数全部正常，极其难以排查；
+    - 常见来源：Tailscale 1.98+（默认 `NetfilterMode=on`）启动时会写入 `1`，见
+      [tailscale/tailscale#19796](https://github.com/tailscale/tailscale/issues/19796)；
+    - 解决：`tailscale set --netfilter-mode=off` 后重启，或 `sysctl -w net.ipv4.conf.all.src_valid_mark=0`；
+    - 检查：`sysctl -n net.ipv4.conf.all.src_valid_mark` 应为 `0`。
+
 ## 协议配置
 
 ### udp