fix: update interface detection code to support additional interfaces Docker adds.

debian-package/debian/changelog

@@ -1,3 +1,12 @@
+vpn-router (0.3.1-1) unstable; urgency=medium
+
+  * Ignore virtual interfaces when mode auto looks for the internal
+    interface. The Docker bridge docker0, which has an address, was counted
+    as a second internal interface, so vpn-router-setup and
+    vpn-router-docker failed on a host with Docker installed.
+
+ -- Sławomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 23 Oct 2026 13:44:00 +0200
+
 vpn-router (0.3.0-1) unstable; urgency=medium
 
   * Secure the ports Docker publishes. Rules in a chain of their own,

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -309,12 +309,22 @@ def detect_interfaces():
     return external, candidates[0]
 
 
+def _is_virtual(name):
+    """True for an interface the kernel creates without a device behind it.
+
+    Loopback, bridges, veth pairs and tunnels live under /sys/devices/virtual,
+    which is where the Docker bridge is; a NIC of the virtual machine does not.
+    """
+    link = pathlib.Path('/sys/class/net') / name
+    return '/devices/virtual/' in str(link.resolve())
+
+
 def _addressed_interfaces():
-    """Interface names holding at least one IPv4 address, excluding loopback."""
+    """Names of the NICs holding at least one IPv4 address; virtual interfaces are left out."""
     names = []
     for line in _ip_route('-o', '-4', 'addr', 'show').splitlines():
         fields = line.split()
-        if len(fields) >= 4 and fields[1] != 'lo' and fields[1] not in names:
+        if len(fields) >= 4 and fields[1] not in names and not _is_virtual(fields[1]):
             names.append(fields[1])
     return names