基于iptables的按用户拆分隧道配置存在UDP数据包泄漏问题求助

我照着一份iptables拆分隧道的配置指南做了基础设置，还额外加了几条针对本地流量的规则，结果现在碰到个诡异的状况：用户ID 1050的UDP流量没按预期走VPN隧道（tun0接口），反而直接泄漏到了公网（ens3接口），而且这些流量用的端口还不是我防火墙允许的6881。

最奇怪的是，用这个用户测试TCP流量完全正常——所有TCP请求都乖乖走VPN，一点都不会泄漏到公网。我实在搞不懂UDP为啥会出这种问题，有没有大佬能帮我看看配置哪里错了？

当前的iptables配置（iptables-save输出） #

mangle表

# Generated by iptables-save v1.8.7 on Tue Mar 28 08:17:46 2023

*mangle
:PREROUTING ACCEPT [815888:3446674394]
:INPUT ACCEPT [815869:3446672358]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [291767:5488397080]
:POSTROUTING ACCEPT [291835:5488406564]
-A OUTPUT -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
-A OUTPUT ! -d 192.168.50.13/32 -m owner --uid-owner 1050 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -d 192.168.50.13/32 -p udp -m udp --dport 53 -m owner --uid-owner 1050 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -d 192.168.50.13/32 -p tcp -m tcp --dport 53 -m owner --uid-owner 1050 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -s 192.168.50.13/32 -p tcp -m tcp -m multiport --sports 6800,58846 -m owner --uid-owner 1050 -j MARK --set-xmark 0x0/0xffffffff
-A OUTPUT ! -s 192.168.50.13/32 -j MARK --set-xmark 0x1/0xffffffff
-A OUTPUT -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
COMMIT

# Completed on Tue Mar 28 08:17:47 2023

filter表

# Generated by iptables-save v1.8.7 on Tue Mar 28 08:17:47 2023

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i tun0 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7878 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8989 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 111 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 2049 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 4045 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --sport 1110 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -m owner --uid-owner 1050 -j ACCEPT
-A OUTPUT -o tun0 -m owner --uid-owner 1050 -j ACCEPT
-A OUTPUT ! -s 192.168.50.13/32 -o ens3 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 58846 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 7878 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 8989 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 111 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 2049 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 4045 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 1110 -j ACCEPT
COMMIT

# Completed on Tue Mar 28 08:17:47 2023

nat表

# Generated by iptables-save v1.8.7 on Tue Mar 28 08:17:47 2023

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT

# Completed on Tue Mar 28 08:17:47 2023

备注：内容来源于stack exchange，提问作者Rusty Weber