Improve Sing-box 1.14+ configuration and TUN system-mode handling

Author: mh-firouzjahCreated Sep 11, 2026Updated Sep 17, 2026

Attention | توجه

I searched and no similar issues were found | جستجو کردم و هیچ گزارش مشابهی پیدا نشد
I read FAQ and no relevant issues were found | سوالات متداول را خواندم و هیچ مورد مربوطی پیدا نشد

What Happened? | چه اتفاقی افتاده؟

I have been rebuilding the Sing-box configuration generated by BPB around Sing-box 1.14.0 and testing it for the last few days.

The result has been working very well in daily use, and I would like to suggest a few improvements to the Sing-box configuration generated by BPB.

The main idea is to make the generated configuration better aligned with modern Sing-box versions, while keeping the core configuration simple and letting BPB focus mainly on generating reliable proxy outbounds.

One important difference is that Sing-box 1.14 provides newer configuration features that can be used directly, such as http_clients, default_http_client, {tag} substitution for remote rule-set URLs, and the native API/Dashboard.

Another useful design is keeping the TUN always enabled while using a selector as a system-wide mode switch:

System Mode ├── direct └── ✅ Selector ├── Best Ping ├── VLESS ... └── Trojan ...

This means the TUN and routing layer remain active all the time, while the user can switch the actual system traffic between Direct and Proxy.

The local mixed proxy can remain independently proxied:

127.0.0.1:2080 ↓ ✅ Selector ↓ VLESS / Trojan / Best Ping

This has worked well for me and avoids treating "VPN on/off" as enabling/disabling the TUN itself.

I think the generated configuration could benefit from following this kind of architecture, while avoiding unnecessary customization of Sing-box defaults. BPB can then focus more on generating good VLESS/Trojan outbounds and maintaining the proxy selector/URLTest groups.

Minimal Reproducible Example | چه فرایندی برای مشاهده این مشکل طی کرده‌اید؟

Sing-box 1.14.0 core configuration:

TUN ↓ route.final ↓ System Mode ├── direct └── ✅ Selector ├── VLESS ├── Trojan └── Best Ping

Local mixed proxy:

127.0.0.1:2080 ↓ ✅ Selector ↓ VLESS / Trojan

The configuration also uses modern Sing-box 1.14 features such as:

http_clients
default_http_client
remote rule-set {tag} substitution
native API/Dashboard
auto_redirect for TUN

A reference configuration is available below:

json

 cat /etc/sing-box/config.json                                                                                  3m 29s  
{
  "$schema": "https://sing-box.sagernet.org/schema.json",
  "log": {
    "level": "warn"
  },
  "dns": {
    "servers": [
      {
        "type": "udp",
        "tag": "dns-direct",
        "server": "94.140.14.14"
      },
      {
        "type": "https",
        "tag": "dns-remote",
        "server": "94.140.14.14",
        "tls": {
          "enabled": true,
          "server_name": "dns.adguard-dns.com"
        },
        "path": "/dns-query"
      }
    ],
    "rules": [
      {
        "rule_set": [
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geosite-category-ads-all"
        ],
        "action": "reject"
      },
      {
        "rule_set": "geosite-ir",
        "server": "dns-direct"
      }
    ],
    "final": "dns-remote",
    "reverse_mapping": true,
    "strategy": "ipv4_only",
    "timeout": "5s",
    "cache_capacity": 4096,
    "optimistic": true
  },
  "http_clients": [
    {
      "tag": "rules-direct",
      "version": 2,
      "stream_receive_window": 0,
      "connection_receive_window": 0
    }
  ],
  "inbounds": [
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
      "listen_port": 2080
    },
    {
      "type": "tun",
      "tag": "tun-in",
      "interface_name": "sb-tun",
      "mtu": 1420,
      "address": "172.19.0.1/30",
      "auto_route": true,
      "auto_redirect": true,
      "strict_route": true,
      "stack": "mixed"
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "selector",
      "tag": " System Mode",
      "outbounds": [
        "direct",
        "✅ Selector"
      ],
      "default": "direct",
      "interrupt_exist_connections": true
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff",
        "sniffer": [
          "http",
          "tls",
          "quic"
        ]
      },
      {
        "rule_set": [
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geosite-category-ads-all",
          "geoip-malware",
          "geoip-phishing"
        ],
        "action": "reject"
      },
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-ir",
          "geoip-ir"
        ],
        "outbound": "direct"
      },
      {
        "inbound": "mixed-in",
        "outbound": "✅ Selector"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": [
          "geosite-ir",
          "geoip-ir",
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geosite-category-ads-all",
          "geoip-malware",
          "geoip-phishing"
        ],
        "url": "https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@rule-set/{tag}.srs"
      }
    ],
    "final": " System Mode",
    "auto_detect_interface": true,
    "default_domain_resolver": "dns-remote",
    "default_http_client": "rules-direct"
  },
  "services": [
    {
      "type": "api",
      "tag": "api",
      "listen": "127.0.0.1",
      "listen_port": 9090,
      "dashboard": true
    }
  ],
  "experimental": {
    "cache_file": {
      "enabled": true,
      "store_dns": true
    }
  }
}

The VLESS/Trojan outbounds, ✅ Selector, and Best Ping members can remain generated dynamically by BPB.

Relevant log output | لاگ برنامه یا پنل

bash

No error or crash is being reported.

This is a configuration/design suggestion based on a working Sing-box 1.14.0 setup.

Panel version | نسخه‌ پنل

BPB Logo BPB Panel v4.2.3

Client | برنامه فیلترشکن

sing-box cli

Client version | نسخه برنامه فیلترشکن

1.14.0

Source: bia-pain-bache/BPB-Worker-Panel

View original on GitHub View discussion on GitHub