Linux TUN vless outbound loop: traffic routed into TUN is re-captured → total network loss (strict_route anti-loop not effective)

On Linux desktop (sing-box 1.13.16), a TUN inbound (auto_route: true, strict_route: true/false both tried) creates the device, installs ip rules and the table-2022 default route correctly — but all traffic including the vless outbound's own connections gets re-captured by the TUN (loop), causing total network loss. Running sing-box as root does NOT help. The strict_route anti-loop mechanism (SO_MARK / nftables) does not appear to take effect.

Environment

• OS: Linux desktop (GNOME + NetworkManager, WiFi) — also reproduced on root

• sing-box: v1.13.16 (linux-amd64 glibc)

• Config: mixed inbound (127.0.0.1:10808) + tun inbound:
  json
  {"type":"tun","tag":"tun-in","interface_name":"singtun0","mtu":9000,
  "address":["172.19.0.1/30"],"auto_route":true,"strict_route":true}

• Outbound: vless (tls + ws), final route = vless; direct for geoip-cn/private ranges

• dns: {"servers":[{"type":"udp","tag":"dns-direct","server":"119.29.29.29"}],"strategy":"ipv4_only"}

Reproduction

1. Start sing-box with the above config. Observed state while running:

   • singtun0 created (172.19.0.1/30, UP) ✓

   • ip rules installed:

     9000: from all to 172.19.0.0/30 lookup 2022
     9001: from all lookup 2022 suppress_prefixlength 0
     9002: not from all dport 53 lookup main suppress_prefixlength 0
     9002: from all iif singtun0 goto 9010
     9003: not from all iif lo lookup 2022
     9010: from all nop

   • table 2022 has default via 172.19.0.2 dev singtun0 ✓

2. Any traffic (curl/ping/DNS) → total loss (timeout). The vless outbound's connection to the remote server is itself captured by the TUN and loops back into the TUN → vless → TUN…
3. Same result with strict_route: false; same result running as root (sudo).
4. Workaround tried: mark singtun0 unmanaged in NetworkManager so routes stay stable (they do), but the loop persists — network is still dead.

Expected

Traffic entering the TUN should be routed per route rules (direct/vless). The vless outbound's own connections (to the remote server) must NOT be re-captured by the TUN — strict_route's SO_MARK/nftables exclusion should handle this, but it does not seem to be applied.

Related

• #4367 UDP traffic to the exact TUN self-address can loop through the direct outbound
• #4178 Possible IPv6 self-route loop
• #3878 Regression in 1.13.2 on Linux TUN + hijack-dns: systemd-resolved DNS loops

This looks like the same loop family on Linux TUN — here it's full-traffic (TCP) loop even with strict_route, not limited to UDP/IPv6/DNS. Happy to provide more logs/config or run debug builds.

Start by reproducing the supplied Linux TUN configuration and checking the observed ip rules, table 2022 route, and outbound connection behavior. Inspect the strict_route SO_MARK/nftables exclusion path and debug output; done means traffic follows the configured routes while the vless connection is not re-captured and curl, ping, and DNS work.