Connection fails when the first IP addresses are unreachable

Operating system

Windows

System version

11 (10.0.26200.8655)

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.0-alpha.48

Environment: go1.26.5 windows/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,with_cloudflared,with_naive_outbound,with_purego,with_usbip,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0
Revision: fa36eb769a200e9558c414a36eb16da9a2446ea9
CGO: disabled

Description

I have a vmess outbound configured with multiple server IP addresses.

Example:

IP 1 - unreachable  
IP 2 - unreachable  
IP 3 - reachable  
IP 4 - reachable  
...  
IP 10 - reachable  

When the first two IP addresses are unavailable, sing-box cannot establish a connection.

It looks like sing-box keeps trying the first unreachable IP addresses and does not continue to the other available IP addresses.

Reproduction

{
  "log": {
    "disabled": false,
    "level": "debug",
    "output": "access.log",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "tag": "predefined",
        "type": "hosts",
        "predefined": {
          "one.one.one.one": [
            "1.1.1.1",
            "1.0.0.1",
            "2606:4700:4700::1111",
            "2606:4700:4700::1001"
          ],
          "cloudflare.ip": [
            "x.x.x.x", // unreachable
            "x.x.x.x", // unreachable
            "x.x.x.x", // reachable
            "x.x.x.x", // reachable
            "x.x.x.x", // reachable
            "x.x.x.x", // unreachable
            "x.x.x.x", // reachable
            "x.x.x.x", // reachable
            "x.x.x.x", // unreachable
            "x.x.x.x" // reachable
          ]
        }
      },
      {
        "tag": "CLOUDFLARE_DOH",
        "type": "https",
        "server": "one.one.one.one",
        "server_port": 443,
        "path": "/dns-query",
        "domain_resolver": "predefined",
        "detour": "proxy"
      },
      {
        "tag": "local",
        "type": "local"
      }
    ],
    "rules": [
      {
        "action": "evaluate",
        "server": "predefined"
      },
      {
        "action": "respond",
        "ip_accept_any": true,
        "match_response": true
      }
    ],
    "final": "CLOUDFLARE_DOH",
    "strategy": "prefer_ipv4",
    "disable_cache": true
  },
  "inbounds": [
    {
      "tag": "mixed",
      "type": "mixed",
      "listen": "::",
      "listen_port": 5050
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "type": "selector",
      "default": "direct",
      "outbounds": [
        "direct",
        "vmess",
        "reject"
      ],
      "interrupt_exist_connections": true
    },
    {
      "tag": "vmess",
      "type": "vmess",
      "server": "cloudflare.ip",
      "server_port": 443,
      "uuid": "f84bec48-5661-422b-834a-494ee1aa591d",
      "security": "auto",
      "tls": {
        "enabled": true,
        "server_name": "example.com",
        "insecure": false
      },
      "transport": {
        "type": "ws",
        "path": "/path",
        "headers": {
          "Host": "example.com"
        }
      },
      "domain_resolver": "predefined"
    },
    {
      "tag": "direct",
      "type": "direct"
    },
    {
      "tag": "reject",
      "type": "block"
    }
  ],
  "route": {
    "rules": [
      {
        "action": "sniff"
      },
      {
        "action": "hijack-dns",
        "protocol": "dns"
      },
      {
        "action": "resolve"
      }
    ],
    "final": "proxy",
    "auto_detect_interface": true,
    "default_domain_resolver": "CLOUDFLARE_DOH"
  },
  "experimental": {
    "cache_file": {
      "enabled": true,
      "store_dns": true,
      "path": "cache.db"
    }
  }
}

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reproducing the supplied Windows configuration with debug logging, focusing on the vmess outbound and its predefined DNS addresses. Trace what happens when initial addresses are unreachable and later addresses are reachable; done means the connection proceeds to an available address, with regression coverage for this ordering.