Can start manually but service doesn't work

[Turab]

The latest version (1.5.1) broke the service.

When run from the shell with just "spoofdpi", it runs with the TOML config just fine.

But when run with "systemctl start spoofdpi" (whose service file has only "spoofdpi" as exec command), it raises this error:

spoofdpi[36399]: INF 2026-05-12T09:47:08+03:00 3fa06e5512a19e25 [app]   cache; dst=dynamic
spoofdpi[36399]: application failed to start
spoofdpi[36399]: create server: failed to find default route: route ip+net: netlinkrib: address family not supported by protocol
systemd[1]: spoofdpi.service: Main process exited, code=exited, status=1/FAILURE
systemd[1]: spoofdpi.service: Failed with result 'exit-code'.

Config file is the same, execution command is the same. Why would it fail as a service while the executable works standalone?

[xvzc]

Could you provide your toml config and the content of .service file?

[Turab]

Service file:

[Unit]
Description=SpoofDPI Service
Wants=network-online.target
After=network-online.target

[Service]
SyslogIdentifier=spoofdpi
Restart=always
RestartSec=5
Type=simple
User=root
Group=root
#EnvironmentFile=/etc/conf.d/spoofdpi
ExecStart=/usr/bin/spoofdpi
TimeoutStopSec=15
CapabilityBoundingSet=CAP_NET_RAW
IPAddressAllow=localhost link-local multicast
LockPersonality=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=noaccess
ProtectSystem=strict
RestrictAddressFamilies=AF_INET AF_INET6
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallFilter=@basic-io @file-system @io-event @ipc @network-io @process @signal @system-service

[Install]
WantedBy=default.target

Config file (/etc/spoofdpi.toml)

[dns]
addr = "xxx.xxx.xxx.xxx:53"
#addr = "1.1.1.1:53"
https-url = "https://xxx.xxx/dns-query"
mode = "https"
cache = true
qtype= "ipv4"

# Bypass for local networks
[[rules]]
  name = "local networks - skip completely"
  priority = 100
  match.addr = [
    { cidr = "192.168.0.0/24", port = "all" },
    { cidr = "10.0.0.0/8",     port = "all" },
    { cidr = "172.16.0.0/12",  port = "all" },
    { cidr = "100.64.0.0/10",  port = "all" }   # ISP CG-NAT
  ]

[app]
listen-addr = "127.0.0.1:8081"
no-tui = true
log-level= "debug"

[xvzc]

There was some change during the detection of the default interface in the current release. I might have to rollback to the previouse method since it seems to cause some issue when running with systemctl.
The fix will be apllied in the next release. Please use the last working release until then. Thanks.

[xvzc]

@Turab Could you try replacing the value of RestrictAddressFamilies with AF_INET AF_INET6 AF_NETLINK AF_PACKET?

[Turab]

I did. Now the error changed to:

spoofdpi[17920]: application failed to start
spoofdpi[17920]: create server: failed to find default route: failed to get default gateway: can't access /proc/net/route

[Turab]

I see that you pushed a new version and it seems to have fixed the service issue, while it introduced another one.

Now the rules directive broke and it rejects even the copy/paste example from the official documentation.

You can see the [[rules]] section in my TOML file above. Since it complained about it, I removed that section and tested it with this one line from the docs:

[[rules]]
  name = "local networks - skip completely"
  priority = 100  # Yüksek öncelik → önce bu kontrol edilsin
  match = { addr = [{ cidr = "192.168.0.0/24", port = "all" }] }

But in both of them, it produces this error:

spoofdpi[41209]: rule 0: match: match must have at least one 'domain' or 'cidrs' entry

[xvzc]

Try the latest release — note that the config attributes match.domain and match.cidr have been renamed to match.domains and match.cidrs. You may also need to tweak your spoofdpi.service file like this:

RestrictAddressFamilies=AF_INET AF_INET6 AF_NETLINK AF_PACKET
ProcSubset=all

[Turab]

Now I have changed match.addr.cidr to match.cidrs and it worked. I think you also removed "ports" option?

[xvzc]

Yeah the port option was also removed for consistency and support File-based match lists