feat: 默认子网改为 192.168.77.0/24，安装脚本授权 CAP_NET_ADMIN 与 iptables 配置

- 默认 VPN 子网由 192.168.3.0/24 改为 192.168.77.0/24（db seed、前端表单默认值与 placeholder 同步）
- install_linux.sh 顶部增加 VPN_SUBNET 可配置变量
- systemd unit 增加 AmbientCapabilities/CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW，服务以 lmvpn 用户运行即可创建 TUN，无需 root
- 脚本自动开启 net.ipv4.ip_forward 并持久化到 /etc/sysctl.d/99-lmvpn.conf
- 脚本自动检测出口网卡，幂等配置 iptables NAT MASQUERADE 与 FORWARD 放行规则
- 优先 netfilter-persistent 持久化，回退 iptables-save 写 /etc/iptables/rules.v4

frontend/src/views/VpnView.vue

@@ -63,7 +63,7 @@ const saveMsg = ref('')
 
 const form = ref<Settings>({
   enabled: false,
-  subnet: '192.168.3.0/24',
+  subnet: '192.168.77.0/24',
   mtu: 1420,
   interface_name: '',
   allow_client_to_client: false,
@@ -331,7 +331,7 @@ onMounted(() => {
         </div>
         <div>
           <label class="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">子网 (CIDR)</label>
-          <input v-model="form.subnet" type="text" placeholder="192.168.3.0/24" class="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-white" />
+          <input v-model="form.subnet" type="text" placeholder="192.168.77.0/24" class="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-white" />
         </div>
         <div>
           <label class="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">MTU</label>
@@ -437,7 +437,7 @@ onMounted(() => {
           </div>
           <div>
             <label class="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">IP 地址</label>
-            <input v-model="resvForm.ip_address" type="text" placeholder="192.168.3.10" class="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-white" />
+            <input v-model="resvForm.ip_address" type="text" placeholder="192.168.77.10" class="w-full px-3 py-2 border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-700 text-gray-900 dark:text-white" />
           </div>
           <p v-if="resvError" class="text-sm text-red-500">{{ resvError }}</p>
         </div>

install_linux.sh

@@ -1,6 +1,12 @@
 #!/usr/bin/env bash
 set -e
 
+# ─────────────────────────────────────────────────────────────
+# VPN 子网（与后台 VPN 设置中的子网保持一致）
+# 若后台修改了子网，需同步修改此处并重新执行脚本，或手动更新 iptables 规则
+# ─────────────────────────────────────────────────────────────
+VPN_SUBNET="192.168.77.0/24"
+
 if [ "$(id -u)" -ne 0 ]; then
     echo "请使用 root 用户执行此脚本: sudo bash install_linux.sh"
     exit 1
@@ -33,6 +39,48 @@ cp lmvpn /opt/lmvpn/
 cp -r dist /opt/lmvpn/
 chown -R lmvpn:lmvpn /opt/lmvpn
 
+echo ">>> 配置内核 IP 转发..."
+# 临时生效
+sysctl -w net.ipv4.ip_forward=1 >/dev/null
+# 持久化
+cat > /etc/sysctl.d/99-lmvpn.conf << EOF
+net.ipv4.ip_forward = 1
+EOF
+sysctl -p /etc/sysctl.d/99-lmvpn.conf >/dev/null
+
+echo ">>> 配置 iptables NAT 与转发规则..."
+# 自动检测默认路由出口网卡
+WAN_IFACE=$(ip route show default 2>/dev/null | awk '{print $5; exit}')
+if [ -z "$WAN_IFACE" ]; then
+    echo "警告: 未能自动检测出口网卡，跳过 iptables 配置，请手动设置"
+else
+    echo "出口网卡: $WAN_IFACE"
+
+    # 幂等：先删除旧规则（忽略错误），再添加
+    # NAT: VPN 子网经出口网卡做源地址转换
+    iptables -t nat -D POSTROUTING -s "$VPN_SUBNET" -o "$WAN_IFACE" -j MASQUERADE 2>/dev/null || true
+    iptables -t nat -A POSTROUTING -s "$VPN_SUBNET" -o "$WAN_IFACE" -j MASQUERADE
+
+    # FORWARD: 放行 VPN 子网进出
+    iptables -D FORWARD -s "$VPN_SUBNET" -j ACCEPT 2>/dev/null || true
+    iptables -D FORWARD -d "$VPN_SUBNET" -j ACCEPT 2>/dev/null || true
+    iptables -A FORWARD -s "$VPN_SUBNET" -j ACCEPT
+    iptables -A FORWARD -d "$VPN_SUBNET" -j ACCEPT
+
+    # 持久化 iptables 规则
+    if command -v netfilter-persistent >/dev/null 2>&1; then
+        netfilter-persistent save
+        echo "iptables 规则已通过 netfilter-persistent 持久化"
+    elif command -v iptables-save >/dev/null 2>&1; then
+        mkdir -p /etc/iptables
+        iptables-save > /etc/iptables/rules.v4
+        echo "iptables 规则已写入 /etc/iptables/rules.v4"
+        echo "注意: 重启后规则持久化需配合 iptables-persistent 包，建议安装: apt install iptables-persistent"
+    else
+        echo "警告: 未找到 iptables-save，规则仅在本次运行有效，请手动持久化"
+    fi
+fi
+
 echo ">>> 安装 systemd 服务..."
 cat > /etc/systemd/system/lmvpn.service << 'EOF'
 [Unit]
@@ -47,6 +95,10 @@ ExecStart=/opt/lmvpn/lmvpn
 Restart=on-failure
 RestartSec=5
 
+# 授予 TUN 设备创建与网络管理能力，无需 root 运行
+AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
+
 [Install]
 WantedBy=multi-user.target
 EOF

internal/db/db.go

@@ -110,7 +110,7 @@ func seedDefaultVpnSettings() error {
 	s = model.VpnSetting{
 		ID:               model.VpnSettingSingletonID,
 		Enabled:          false,
-		Subnet:           "192.168.3.0/24",
+		Subnet:           "192.168.77.0/24",
 		MTU:              1420,
 		InterfaceName:    "",
 		DoLocalIPConfig:  true,