Default fakeip ipv6 range breaks Chromium PNA

Operating system

Windows

System version

Windows 11 23H2

Installation type

sing-box for Windows Graphical Client

If you are using a graphical client, please provide the version of the client.

1.14.0

Version

Description

The documented fakeip ipv6 range (fc00::/18) is classified as kLocal by Chromium PNA, while the ipv4 range (198.18.0.0/15) falls back to kPublic.

When a dual-stack site resolves HTML via v4 fakeip and subresources via v6 fakeip, Chromium blocks asset loading:
blocked by CORS policy: Permission was denied for this request to access the 'local' address space.

Using 2001:2::/48 (RFC 5180 Errata 1752) instead of fc00::/18 fixes this since it's the symmetric v6 benchmark prefix and is treated as kPublic (not present in NonPublicAddressSpaceMap).

Please consider updating the inet6_range examples in the documentation from fc00::/18 to 2001:2::/48.

Reproduction

1. Start sing-box using this configuration:

{
  "$schema": "https://sing-box.sagernet.org/schema.json",
  "log": {
    "level": "warn",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "type": "fakeip",
        "tag": "dns-fakeip",
        "inet4_range": "198.18.0.0/15",
        "inet6_range": "fc00::/18"
      },
      {
        "type": "local",
        "tag": "dns-local"
      }
    ],
    "rules": [
      {
        "query_type": "AAAA",
        "domain": "github.com",
        "action": "predefined"
      },
      {
        "query_type": "A",
        "domain": "github.githubassets.com",
        "action": "predefined"
      },
      {
        "server": "dns-fakeip"
      }
    ],
    "final": "dns-local"
  },
  "inbounds": [
    {
      "type": "tun",
      "tag": "tun-in",
      "address": [
        "10.255.255.1/30",
        "fd00::1/126"
      ],
      "auto_route": true,
      "stack": "mixed"
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct-out"
    }
  ],
  "route": {
    "final": "direct-out",
    "auto_detect_interface": true,
    "default_domain_resolver": "dns-local"
  }
}

2. Open https://github.com in any Chromium-based browser (Chrome, Edge, Brave, etc.).
3. Open DevTools Console: github.githubassets.com requests fail with:
   blocked by CORS policy: Permission was denied for this request to access the 'local' address space.
4. Change inet6_range in the config from fc00::/18 to 2001:2::/48, restart sing-box and reload https://github.com: the page and all subresources load cleanly without errors.

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Open the documented fakeip configuration page referenced in the issue and locate the inet6_range examples. Replace the fc00::/18 example with 2001:2::/48, then check that the surrounding fakeip configuration guidance remains consistent with the reproduced Chromium behavior.