1.15.0-alpha.5 TUN 入站连接的 sourceIP 与 1.14.1 不一致 （其 sourceIP 变为了局域网本机 IP，未被正确绑定到 tun.address ？）
操作系统
Android
系统版本
ColorOS16 PKX110 16.0.2.400(CNO1) 已ROOT
安装类型
sing-box 原始命令行程序
如果您使用图形客户端程序，请提供该程序版本。
No response
版本
1.15.0-alpha.
# sing-box ./sing-box version
sing-box version 1.15.0-alpha.5
Environment: go1.26.8 android/arm64
Tags: with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0
Revision: 37611b410481dfca1265873284c9bfd3f04f8fd6
CGO: enabled描述
对于同一个域名，在 tun 入站下，由本机发出的连接的 sourceIP 在 1.15.0-alpha.5 中未遵循 tun.address 的配置，导致 sourceIP 从配置的虚拟地址（如 172.19.0.1）变成了物理网卡 IP（如 192.168.0.151）。
在 1.14.1， { "metadata": { "destinationIP": "172.67.75.172", "destinationPort": "443", "dnsMode": "normal", "host": "api.ip.sb", "network": "tcp", "processPath": "", "sourceIP": "172.19.0.1", "sourcePort": "50580", "type": "tun/tun-Root" } } 在 1.15.0-alpha.5 { "metadata": { "destinationIP": "104.26.12.31", "destinationPort": "443", "dnsMode": "normal", "host": "api.ip.sb", "network": "tcp", "processPath": "", "sourceIP": "192.168.0.151", "sourcePort": "45838", "type": "tun/tun-Root" } }
这会影响到局域网内本机与其他设备的分流、一加手机与平板间的通信共享（p2p0 网卡 在192.168.0.0/16 网段上，借此可区分手机中的流量是本机发出的还是平板通信共享发出的），但到 1.15.0 alpha5 中，此分流手段失效，详见重现方式。 不确定这是否是 1.15 重构 TUN 带来的有意行为。如果是新设计，请问目前推荐使用什么新机制来替代这种分流需求？
重现方式
可直接使用以下配置复现，对比 1.14.1 与1.15.0 alpha5 连接元数据异同，在连接网关为192.168.0.1（在网段192.168.0.0/16内）的Wi-Fi的情况下，无法根据sourceip进行 本机与局域网内其他设备 的分流
{
"log": {
"disabled": true,
"level": "debug",
"timestamp": true
},
"experimental": {
"cache_file": {
"enabled": true,
"store_fakeip": false,
"store_dns": false
},
"clash_api": {
"external_controller": "127.0.0.1:9090",
"external_ui": "dashboard",
"external_ui_download_url": "https://github.com/Zephyruso/zashboard/releases/latest/download/dist-no-fonts.zip",
"default_mode": "rule",
"access_control_allow_origin": "*",
"secret": ""
}
},
"http_clients": [
{
"tag": "resource-client",
"detour": "大陆网站"
}
],
"inbounds": [
{
"type": "tun",
"tag": "tun-Root",
"address": "172.19.0.1/30",
"auto_route": true,
"auto_redirect": true,
"strict_route": true
}
],
"outbounds": [
{
"tag": "代理",
"type": "selector",
"interrupt_exist_connections": true,
"outbounds": [
"直连"
]
},
{
"tag": "大陆网站",
"type": "selector",
"interrupt_exist_connections": true,
"outbounds": [
"直连"
]
},
{
"tag": "源自内网",
"type": "selector",
"interrupt_exist_connections": true,
"outbounds": [
"直连",
"代理"
]
},
{
"tag": "广告",
"type": "selector",
"interrupt_exist_connections": true,
"outbounds": [
"拒绝",
"直连",
"代理"
]
},
{
"tag": "GLOBAL",
"type": "selector",
"interrupt_exist_connections": true,
"outbounds": [
"拒绝",
"直连",
"代理"
]
},
{
"tag": "直连",
"type": "direct"
},
{
"tag": "拒绝",
"type": "block"
}
],
"route": {
"default_domain_resolver": "Local-DNS",
"final": "代理",
"auto_detect_interface": true,
"rules": [
{
"action": "sniff"
},
{
"type": "logical",
"mode": "or",
"rules": [
{
"protocol": "dns"
},
{
"port": 53
}
],
"action": "hijack-dns"
},
{
"ip_is_private": true,
"outbound": "直连"
},
{
"protocol": "stun",
"action": "reject"
},
{
"clash_mode": "direct",
"outbound": "直连"
},
{
"clash_mode": "global",
"outbound": "GLOBAL"
},
{
"rule_set": [
"my_source_ip_is_private"
],
"outbound": "源自内网"
},
{
"rule_set": [
"cn-geosite",
"cn-geoip"
],
"outbound": "大陆网站"
}
],
"rule_set": [
{
"type": "inline",
"tag": "my_source_ip_is_private",
"rules": [
{
"source_ip_cidr": [
"192.168.0.0/16"
]
}
]
},
{
"type": "remote",
"tag": "cn-geosite",
"url": "https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@sing/geo/geosite/cn.srs"
},
{
"type": "remote",
"tag": "cn-geoip",
"url": "https://testingcf.jsdelivr.net/gh/MetaCubeX/meta-rules-dat@sing/geo/geoip/cn.srs"
}
]
},
"dns": {
"servers": [
{
"type": "https",
"tag": "Local-DNS",
"server": "223.5.5.5"
},
{
"type": "https",
"tag": "Remote-DNS",
"server": "1.1.1.1",
"detour": "代理"
}
],
"rules": [
{
"clash_mode": "direct",
"server": "Local-DNS"
},
{
"clash_mode": "global",
"server": "Remote-DNS"
},
{
"rule_set": "cn-geosite",
"server": "Local-DNS"
}
],
"strategy": "ipv4_only",
"final": "Remote-DNS"
}
}日志
支持我们
- 我已经 赞助
完整性要求
- 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
- 我保证提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
- 我保证提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器、TUN、图形界面客户端或者其他闭源软件。
- 我保证提供了完整的配置文件与日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。
Source: SagerNet/sing-box