Add kernel options for WireGuard client routing

Required by NetworkManager.

_posts/sysadm/2026-02-08-custom-gentoo-linux-kernel.tl

@@ -2,7 +2,7 @@
 layout: default
 title: Custom Gentoo Linux kernel
 date: 2026-02-08 17:44 +0100
-tags: kernel Gentoo
+tags: Gentoo kernel security Bluetooth WireGuard
 ---
 
 h2. Upgrading kernel
@@ -72,7 +72,8 @@ Option names and configuration symbols are based on Linux Kernel v6.12.
 
 h3. Bluetooth
 
-Sending files over interface using e.g. @blueman@:
+Sending files over interface using e.g.
+"blueman":https://github.com/blueman-project/blueman:
 
 * RFCOMM protocol support (@BT_RFCOMM@)
 
@@ -83,8 +84,24 @@ build toolchain:
 * Indirect Branch Tracking (@X86_KERNEL_IBT@)
 * X86 userspace shadow stack (@X86_USER_SHADOW_STACK@)
 
-h3. Wireguard
+h3. WireGuard
+
+Options for "Improved rule-based
+routing":https://www.wireguard.com/netns/#improved-rule-based-routing, as
+required by NetworkManager 1.52.1:
 
 * IP: policy routing (@IP_MULTIPLE_TABLES@)
+* Packet mangling (@IP_NF_MANGLE@)
+* raw table support (@IP_NF_RAW@)
+* "CONNMARK" target support (@NETFILTER_XT_TARGET_CONNMARK@)
+* "addrtype" address type match support (@NETFILTER_XT_MATCH_ADDRTYPE@)
+* "comment" match support (@NETFILTER_XT_MATCH_COMMENT@)
+* "mark" match support (@NETFILTER_XT_MATCH_MARK@)
+
+"Netfilter":https://www.netfilter.org/ targets and matches required by
+NetworkManager can be audited using:
+{% highlight bash %}
+nmcli general logging level DEBUG domains FIREWALL
+{% endhighlight %}
 
 ###. TODO: merge wiki kernel install