`prefer_ipv4` strategy never falls back to IPv6 on an IPv6-only network

Operating system

Linux

System version

Amazon Linux 2023 6.18.36-69.138.amzn2023.aarch64

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.0-alpha.48

Environment: go1.25.12 linux/arm64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0,with_purego
Revision: fa36eb769a200e9558c414a36eb16da9a2446ea9
CGO: disabled

Description

Set up a WireGuard endpoint with a domain in peers[].address that resolves to both IPv4 and IPv6 addresses. When used on an IPv6-only network (i.e. public IPv6 address but no public IPv4 address) and the prefer_ipv4 strategy, traffic to the endpoint times out.

My understanding is that the default strategy is prefer_ipv4, although I'm not sure about this because it's not explicitly documented. It would seem weird to not default to a dual-stack capable setting.

It appears that sing-box only tries to connect using IPv4 and never falls back to IPv6. If you change the strategy to prefer_ipv6 or ipv6_only, then the connection succeeds.

Reproduction

{
    "dns": {
        "servers": [
            { "type": "tls", "tag": "cloudflare-dns", "server": "2606:4700:4700::1111" }
        ]
    },
    "endpoints": [
        {
            "type": "wireguard",
            "tag": "warp-ep",
            "address": ["172.16.0.2/32", "2606:4700:110:8659:cca7:5958:be57:f64c/128"],
            "private_key": "6EAO9o/XW0/TtPPb/AUAWKCWHO2409+j9wxw1ltbmkg=",
            "peers": [
                {
                    "address": "engage.cloudflareclient.com",
                    "port": 2408,
                    "public_key": "bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=",
                    "allowed_ips": ["0.0.0.0/0", "::/0"]
                }
            ]
        }
    ],
    "inbounds": [{ "type": "socks", "tag": "socks-in", "listen": "127.0.0.1", "listen_port": 1080 }],
    "route": {
        "final": "warp-ep",
        "default_domain_resolver": { "server": "cloudflare-dns", "strategy": "prefer_ipv4" }
    }
}

Then test connectivity with:

ALL_PROXY=socks5h://localhost curl https://1.1.1.1/cdn-cgi/trace

Logs

TRACE[0000] close http-client
TRACE[0000] close http-client completed (0.00s)
INFO[0000] network: updated default interface ens5, index 2
INFO[0000] inbound/socks[socks-in]: tcp server started at 127.0.0.1:1080
DEBUG[0000] dns: lookup domain engage.cloudflareclient.com
DEBUG[0000] dns: exchanged engage.cloudflareclient.com NOERROR 2695
INFO[0000] dns: exchanged AAAA engage.cloudflareclient.com. 2695 IN AAAA 2606:4700:d0::a29f:c001
DEBUG[0000] dns: exchanged engage.cloudflareclient.com NOERROR 367
INFO[0000] dns: exchanged A engage.cloudflareclient.com. 367 IN A 162.159.192.1
INFO[0000] dns: lookup succeed for engage.cloudflareclient.com: 162.159.192.1 2606:4700:d0::a29f:c001
DEBUG[0000] endpoint/wireguard[warp-ep]: uapi: updating private key
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: decryption worker 2 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: decryption worker 1 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: handshake worker 1 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: encryption worker 2 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: tun reader - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: encryption worker 1 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: event worker - started
DEBUG[0000] endpoint/wireguard[warp-ep]: interface up requested
DEBUG[0000] endpoint/wireguard[warp-ep]: udp bind has been updated
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: receive incoming v6 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: receive incoming v4 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: routine: handshake worker 2 - started
DEBUG[0000] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - uapi: created
DEBUG[0000] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - uapi: updating endpoint
DEBUG[0000] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - uapi: Adding allowedip
DEBUG[0000] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - uapi: Adding allowedip
DEBUG[0000] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - starting
DEBUG[0000] endpoint/wireguard[warp-ep]: interface state was Down, requested Up, now Up
DEBUG[0000] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - routine: sequential sender - started
DEBUG[0000] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - routine: sequential receiver - started
INFO[0000] sing-box started (0.05s)
INFO[0003] [3514216108 0ms] inbound/socks[socks-in]: inbound connection from 127.0.0.1:57314
INFO[0003] [3514216108 0ms] inbound/socks[socks-in]: inbound connection to 1.1.1.1:443
INFO[0003] [3514216108 0ms] endpoint/wireguard[warp-ep]: outbound connection to 1.1.1.1:443
DEBUG[0003] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0008] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 2)
DEBUG[0008] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0013] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 2)
DEBUG[0013] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0018] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 2)
DEBUG[0018] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0024] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 3)
DEBUG[0024] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0029] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 4)
DEBUG[0029] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0034] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 2)
DEBUG[0034] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0039] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 3)
DEBUG[0039] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0045] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 4)
DEBUG[0045] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0050] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 5)
DEBUG[0050] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0055] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 6)
DEBUG[0055] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0060] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 7)
DEBUG[0060] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0065] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 8)
DEBUG[0065] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0070] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 2)
DEBUG[0070] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0075] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 3)
DEBUG[0075] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0081] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 4)
DEBUG[0081] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0086] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 5)
DEBUG[0086] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0091] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 6)
DEBUG[0091] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0096] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 7)
DEBUG[0096] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0101] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 8)
DEBUG[0101] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0106] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 9)
DEBUG[0106] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0111] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 10)
DEBUG[0111] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0117] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 11)
DEBUG[0117] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0122] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 12)
DEBUG[0122] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
DEBUG[0127] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - handshake did not complete after 5 seconds, retrying (try 13)
DEBUG[0127] endpoint/wireguard[warp-ep]: peer(bmXO…fgyo) - sending handshake initiation
ERROR[0130] [3514216108 2m7s] connection: open connection to 1.1.1.1:443 using outbound/wireguard[warp-ep]: connect tcp 1.1.1.1:443: operation timed out

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by tracing how route.default_domain_resolver with strategy prefer_ipv4 resolves the WireGuard peer address and how the endpoint uses the returned IPv4 and IPv6 addresses. Reproduce the issue with the supplied configuration and curl command; done means an IPv6-only network can fall back to the resolved IPv6 endpoint when IPv4 connectivity fails.