Possible IPv6 self-route loop

Operating system

Windows

System version

Windows 10 22H2

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.0-alpha.26

Environment: go1.25.10 windows/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_purego,badlinkname,tfogo_checklinkname0
Revision: b6c416b0482a2d2391470d70ce518abff3ba51f8
CGO: disabled

Description

I’m seeing broken IPv6 connectivity when traffic goes through tun inbound and then exits via direct outbound on Windows (for more details see reproduction sect)

{
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "mtu": 1280,
      "dns_mode": "disabled",
      "address": ["172.19.0.1/30", "fdfe:dcba:9876::1/126"],
      "auto_route": true,
      "strict_route": true,
      "stack": "gvisor",
      "route_address": [/*HERE SHOULD BE TESTING ADDRESSES*/],
      "route_exclude_address": ["0.0.0.0/0", "fc00::/7", "fe80::/10", "ff00::/8"]
    }
  ],
  "outbounds": [{"type": "direct", "tag": "direct"}],
  "route": {"final": "direct", "auto_detect_interface": true}
}

The same direct outbound works correctly when using mixed inbound instead of tun:

{
  "type": "mixed",
  "tag": "mixed-in",
  "listen": "127.0.0.1",
  "listen_port": 2080
}

Judging by the log.txt file (in the error reproduction section),
I suspect that sing-box can't break the tun-in<->outbound/direct loop with auto-routing and auto-interface detection. Although I haven't ever noticed this problem on IPv4.

Reproduction

config_win_direct_only.json
test.txt

First, test the connection without sing-box. All curl requests should be successful.

ren test.txt test_ipv6.bat
test_ipv6

Run sing-box with

sing-box.exe run -c config_win_direct_only.json

Try test again:

test_ipv6

The first five curl requests succeed, but the remaining six fail, although all 11 requests are expected to succeed.

Alternatively, you can test any IPv6 address included in the tun-in route list, for example 2a00:1450:4010:c01::8b (google.com):

curl -6 [2a00:1450:4010:c01::8b]:80

Logs

log.txt

The config routes only 6 specific IPv6 addresses through tun-in, and I sent only 6 test requests.
Despite that, the generated log file is larger than 10 MB.

The log shows that the default interface is detected correctly:

• line 1: network: updated default interface Ethernet 3, index 17

The first IPv6 request enters through tun-in from the TUN address and is sent through outbound/direct:

• lines 4-6: [fdfe:dcba:9876::1]:54189 -> [2a00:1450:4010:c01::8b]:80, then outbound/direct[direct]

However, immediately after that, sing-box starts receiving many new inbound/tun connections to the same destination, but now from the host's real/global IPv6 address:

• lines 7-9: [2a00:1370:818a:387:3425:24b9:e523:b16e]:54190 -> [2a00:1450:4010:c01::8b]:80, then outbound/direct[direct]
• lines 10-18 show the same pattern repeating with new source ports.

This looks like the IPv6 direct outbound traffic is being routed back into the TUN inbound instead of leaving through the physical interface.

After 5 seconds, these direct outbound connection attempts start timing out:

• lines 3076-3095: open connection to [2a00:1450:4010:c01::8b]:80 using outbound/direct[direct]: dial tcp ... i/o timeout

So the log suggests that interface detection itself works, but IPv6 traffic from direct outbound still re-enters tun-in, eventually resulting in repeated connection attempts and timeouts.

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by running config_win_direct_only.json with sing-box.exe on Windows, then use test.txt renamed to test_ipv6.bat and compare the results with and without sing-box. Read log.txt alongside the tun inbound, direct outbound, auto_route, strict_route, and auto_detect_interface settings to trace the repeated IPv6 connections. Done means all 11 IPv6 requests succeed without direct traffic re-entering tun-in, repeated connection attempts, or timeouts.