No connection with two WireGuard in the chain.

Operating system

Linux

System version

Mint 22.1 (Ubuntu 24.04)

Installation type

Others

If you are using a graphical client, please provide the version of the client.

Nekoray 4.3.6 by Mahdi-zarei

Version

Description

Starting from Nekoray 4.3.5 (singbox 1.11.10), the proxy chain with two WireGuard profiles stopped working, and it still doesn't work even in Nekoray 4.3.6 (singbox 1.11.14). In the previous version, Nekoray 4.3.4 (singbox 1.11.8), everything was working fine. In my situation, I am using Shadowsocks -> WireGuard -> WireGuard.

Reproduction

1. Create two WireGuard profiles.
2. Create a proxy chain with these two profiles.
3. Try to connect.

{
    "dns": {
        "rules": [
            {
                "action": "route",
                "domain": [
                    "engage.cloudflareclient.com",
                    "********.*******.com",
                    "********.*******.net"
                ],
                "domain_keyword": [],
                "domain_regex": [],
                "domain_suffix": [],
                "rule_set": [],
                "server": "dns-direct"
            }
        ],
        "servers": [
            {
                "address": "tls://dot.libredns.gr",
                "address_resolver": "dns-local",
                "detour": "proxy",
                "strategy": "",
                "tag": "dns-remote"
            },
            {
                "address": "local",
                "address_resolver": "dns-local",
                "detour": "direct",
                "strategy": "",
                "tag": "dns-direct"
            },
            {
                "address": "rcode://success",
                "tag": "dns-block"
            },
            {
                "address": "local",
                "detour": "direct",
                "tag": "dns-local"
            }
        ]
    },
    "endpoints": [
        {
            "address": [
                "***.***.***.2/32",
                "****:4700:****:89e0:****:a98d:****:4fe1/128"
            ],
            "detour": "c-0-22-1",
            "domain_strategy": "",
            "mtu": 1280,
            "name": "nekoray-wg",
            "peers": [
                {
                    "address": "engage.cloudflareclient.com",
                    "allowed_ips": [
                        "0.0.0.0/0",
                        "::/0"
                    ],
                    "persistent_keepalive_interval": 0,
                    "port": 2408,
                    "pre_shared_key": "",
                    "public_key": "********************************************",
                    "reserved": []
                }
            ],
            "private_key": "********************************************",
            "system": false,
            "tag": "proxy",
            "type": "wireguard",
            "workers": 4
        },
        {
            "address": [
                "10.***.***.3/32",
                "****:****:****::dcb7/128"
            ],
            "detour": "c-0-20-2",
            "domain_strategy": "",
            "mtu": 1420,
            "name": "nekoray-wg",
            "peers": [
                {
                    "address": "*********.*******.com",
                    "allowed_ips": [
                        "0.0.0.0/0",
                        "::/0"
                    ],
                    "persistent_keepalive_interval": 0,
                    "port": 443,
                    "pre_shared_key": "",
                    "public_key": "********************************************",
                    "reserved": []
                }
            ],
            "private_key": "********************************************",
            "system": false,
            "tag": "c-0-22-1",
            "type": "wireguard",
            "workers": 4
        }
    ],
    "experimental": {
        "clash_api": {
            "default_mode": ""
        }
    },
    "inbounds": [
        {
            "domain_strategy": "",
            "listen": "127.0.0.1",
            "listen_port": 2080,
            "tag": "mixed-in",
            "type": "mixed"
        }
    ],
    "log": {
        "level": "trace"
    },
    "outbounds": [
        {
            "domain_strategy": "",
            "method": "chacha20-ietf-poly1305",
            "password": "******************************",
            "server": "********.*******.net",
            "server_port": 7000,
            "tag": "c-0-20-2",
            "type": "shadowsocks",
            "udp_over_tcp": false
        },
        {
            "tag": "direct",
            "type": "direct"
        }
    ],
    "route": {
        "final": "proxy",
        "find_process": true,
        "rule_set": [],
        "rules": [
            {
                "action": "sniff",
                "inbound": [
                    "mixed-in",
                    "tun-in"
                ]
            },
            {
                "action": "hijack-dns",
                "protocol": "dns"
            },
            {
                "action": "route",
                "outbound": "direct",
                "process_name": [
                    "wireproxy"
                ]
            }
        ]
    }
}

Logs

sing-box: v1.11.14
Core listening at 127.0.0.1:35513
>>>>>>>> Starting profile [Chain Proxy] Shadowsocks -> Wireguard -> Wireguard
INFO[0000] network: updated default interface wlp2s0, index 3
INFO[0000] inbound/mixed[mixed-in]: tcp server started at 127.0.0.1:2080
DEBUG[0000] dns: lookup domain engage.cloudflareclient.com
DEBUG[0000] router: match[0] domain=[engage.cloudflareclient.com ********.*******.com ********.*******.net] => route(dns-direct)
DEBUG[0000] router: match[0] => route(dns-direct)
INFO[0000] outbound/direct[direct]: outbound packet connection to 88.198.92.222:53
INFO[0000] outbound/direct[direct]: outbound packet connection to 88.198.92.222:53
INFO[0000] dns: lookup succeed for engage.cloudflareclient.com: 162.159.192.1 2606:4700:d0::a29f:c001

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start with the supplied minimal two-WireGuard chain configuration and compare its behavior on sing-box v1.11.8 and v1.11.14, using the trace logs to locate where connection setup stops. Done means the Shadowsocks → WireGuard → WireGuard chain connects successfully with the reproduced configuration.