windows服务中如果打开route and remote access服务后，direct流量必回环，请问改如何避免？
Open
Nobody has claimed this yet.
bug
- Dominant language
- Go
- Stars
- 38.1k
- Forks
- 4.6k
- Avg merge
- 19d 15h
- Merged PRs (30d)
- 1
Description
Operating system
Windows
System version
win10
Installation type
Original sing-box Command Line
If you are using a graphical client, please provide the version of the client.
No response
Version
ANY VERSION
Description
windows服务中如果打开route and remote access服务后，direct流量必回环，导致网络故障，必现。
这个问题和ISSUE中https://github.com/SagerNet/sing-box/issues/1862 这个问题应该是一个原因。
configure
{
"log": {
"level": "info",
"timestamp": true
},
"dns": {
"servers": [
{
"tag": "dns_proxy",
"address": "https://1.1.1.1/dns-query",
"address_resolver": "dns_resolver",
"strategy": "ipv4_only",
"detour": "proxy"
},
{
"tag": "dns_direct",
"address": "114.114.114.114",
"strategy": "ipv4_only",
"detour": "direct"
},
{
"tag": "dns_resolver",
"address": "223.5.5.5",
"detour": "direct"
}
],
"rules": [
{
"outbound": "any",
"server": "dns_resolver"
},
{
"rule_set": "geosite-geolocation-!cn",
"server": "dns_proxy"
}
],
"final": "dns_direct",
"independent_cache": true
},
"inbounds": [
{
"type": "tun",
"tag": "tun-in",
"inet4_address": "172.16.0.1/30",
"mtu": 1492,
"auto_route": true,
"strict_route": false,
"stack": "mixed",
"sniff": true,
"sniff_override_destination": false
}
],
"outbounds": [
{
"type": "shadowsocks",
"tag": "proxy",
"server": "xxxxx",
"server_port": xxxx,
"method": "xxxx",
"password": "xxxxxx"
},
{
"type": "direct",
"tag": "direct"
},
{
"type": "block",
"tag": "block"
},
{
"type": "dns",
"tag": "dns-out"
}
],
"route": {
"rule_set": [
{
"tag": "geosite-geolocation-!cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs",
"download_detour": "proxy"
},
{
"tag": "geoip-cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
"download_detour": "proxy"
}
],
"rules": [
{
"protocol": "dns",
"outbound": "dns-out"
},
{
"domain_suffix": [
"google.com",
"ip138.com",
"youtube.com"
],
"outbound": "proxy"
}
],
"final": "direct",
"auto_detect_interface": true
},
"experimental": {
"cache_file": {
"enabled": true,
"path": "cache.db"
}
}
}
Reproduction
windows services-->open routing and remote access
Logs
+0800 2024-08-19 16:59:29 INFO dns: exchanged ipv6.msftconnecttest.com CNAME ncsiv6-geo.trafficmanager.net. 629 IN CNAME ipv6.msftconnecttest.com.edgesuite.net.
+0800 2024-08-19 16:59:29 ERROR [3718642045 0ms] inbound/tun[tun-in]: reject loopback connection to 8.133.123.144:443
+0800 2024-08-19 16:59:29 ERROR [3078433648 0ms] inbound/tun[tun-in]: reject loopback connection to 180.97.248.248:443
+0800 2024-08-19 16:59:29 INFO dns: exchanged ipv6.msftconnecttest.com CNAME ipv6.msftconnecttest.com.edgesuite.net. 629 IN CNAME a1968.i6g1.akamai.net.
+0800 2024-08-19 16:59:29 INFO [127338946 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:54873
+0800 2024-08-19 16:59:29 INFO [127338946 0ms] inbound/tun[tun-in]: inbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 INFO [127338946 0ms] outbound/direct[direct]: outbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 INFO [3050243563 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:54874
+0800 2024-08-19 16:59:29 INFO [3050243563 0ms] inbound/tun[tun-in]: inbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 ERROR [3050243563 0ms] inbound/tun[tun-in]: reject loopback connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 ERROR [127338946 1ms] inbound/tun[tun-in]: download: raw-read tcp 10.128.0.54:54874->23.32.77.192:443: An existing connection was forcibly closed by the remote host.
+0800 2024-08-19 16:59:29 INFO [181301483 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:49433
+0800 2024-08-19 16:59:29 INFO [181301483 0ms] inbound/tun[tun-in]: inbound connection to 127.0.0.1:53
+0800 2024-08-19 16:59:29 INFO [1009160200 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:49434
+0800 2024-08-19 16:59:29 INFO [1009160200 0ms] inbound/tun[tun-in]: inbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 INFO [1009160200 0ms] outbound/direct[direct]: outbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 INFO [4084934090 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:49435
+0800 2024-08-19 16:59:29 INFO [4084934090 0ms] inbound/tun[tun-in]: inbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 ERROR [4084934090 0ms] inbound/tun[tun-in]: reject loopback connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 INFO [3222831514 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:49436
+0800 2024-08-19 16:59:29 INFO [3222831514 0ms] inbound/tun[tun-in]: inbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 INFO [3222831514 0ms] outbound/direct[direct]: outbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 INFO [814068155 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:49437
+0800 2024-08-19 16:59:29 INFO [814068155 0ms] inbound/tun[tun-in]: inbound connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 ERROR [814068155 0ms] inbound/tun[tun-in]: reject loopback connection to 23.32.77.192:443
+0800 2024-08-19 16:59:29 ERROR [3222831514 0ms] inbound/tun[tun-in]: download: raw-read tcp 10.128.0.54:49437->23.32.77.192:443: An existing connection was forcibly closed by the remote host.
+0800 2024-08-19 16:59:29 INFO [342429805 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:49438
+0800 2024-08-19 16:59:29 INFO [342429805 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [342429805 0ms] outbound/direct[direct]: outbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [4007022258 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:49439
+0800 2024-08-19 16:59:29 INFO [4007022258 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 ERROR [4007022258 0ms] inbound/tun[tun-in]: reject loopback connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [3555102357 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:49440
+0800 2024-08-19 16:59:29 INFO [3555102357 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [3555102357 0ms] outbound/direct[direct]: outbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [2182450629 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:49441
+0800 2024-08-19 16:59:29 INFO [2182450629 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 ERROR [2182450629 1ms] inbound/tun[tun-in]: reject loopback connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [3105615670 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:49442
+0800 2024-08-19 16:59:29 INFO [3105615670 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [3105615670 1ms] outbound/direct[direct]: outbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [3589490769 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:49443
+0800 2024-08-19 16:59:29 INFO [3589490769 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 ERROR [3589490769 0ms] inbound/tun[tun-in]: reject loopback connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [3781120808 0ms] inbound/tun[tun-in]: inbound connection from 172.16.0.1:49444
+0800 2024-08-19 16:59:29 INFO [3781120808 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [3781120808 0ms] outbound/direct[direct]: outbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [4081469977 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:49445
+0800 2024-08-19 16:59:29 INFO [4081469977 0ms] inbound/tun[tun-in]: inbound connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 ERROR [4081469977 0ms] inbound/tun[tun-in]: reject loopback connection to 222.186.18.237:443
+0800 2024-08-19 16:59:29 INFO [1940015788 0ms] inbound/tun[tun-in]: inbound packet connection from 10.128.0.54:50027
+0800 2024-08-19 16:59:29 INFO [1940015788 0ms] inbound/tun[tun-in]: inbound packet connection to 106.38.222.156:443
+0800 2024-08-19 16:59:29 INFO [1940015788 0ms] outbound/direct[direct]: outbound packet connection
+0800 2024-08-19 16:59:29 INFO [2131930697 0ms] inbound/tun[tun-in]: inbound packet connection from 10.128.0.54:53391
+0800 2024-08-19 16:59:29 INFO [2131930697 0ms] inbound/tun[tun-in]: inbound packet connection to 106.38.222.156:443
+0800 2024-08-19 16:59:29 INFO [2131930697 0ms] outbound/direct[direct]: outbound packet connection
+0800 2024-08-19 16:59:29 INFO [2686623243 0ms] inbound/tun[tun-in]: inbound packet connection from 10.128.0.54:52371
+0800 2024-08-19 16:59:29 INFO [2686623243 0ms] inbound/tun[tun-in]: inbound packet connection to 8.0.0.0:27036
+0800 2024-08-19 16:59:29 INFO [2686623243 0ms] outbound/direct[direct]: outbound packet connection
+0800 2024-08-19 16:59:29 INFO [3876022638 0ms] inbound/tun[tun-in]: inbound packet connection from 10.128.0.54:53392
+0800 2024-08-19 16:59:29 INFO [3876022638 0ms] inbound/tun[tun-in]: inbound packet connection to 106.38.222.156:443
+0800 2024-08-19 16:59:29 INFO [3876022638 0ms] outbound/direct[direct]: outbound packet connection
+0800 2024-08-19 16:59:29 INFO [1562022914 0ms] inbound/tun[tun-in]: inbound connection from 10.128.0.54:62904
+0800 2024-08-19 16:59:29 INFO [1562022914 0ms] inbound/tun[tun-in]: inbound connection to 127.0.0.1:53
+0800 2024-08-19 16:59:29 INFO [1562022914 74ms] outbound/direct[direct]: outbound connection to 127.0.0.1:53
Supporter
- I am a sponsor
Integrity requirements
- I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
- I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
- I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
- I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing this Windows 10 reproduction with issue 1862, then inspect the reported TUN configuration and logs while the Routing and Remote Access service is enabled. Reproduce the loopback rejection and determine the routing interaction that causes direct traffic to return to the TUN; done means the service can remain enabled without the reported network failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100