[不连接] TUN 入站，sniff+routeOnly+AsIs，直连 IPv6 流量无法连接

完整性要求

• 我读完了 issue 模板中的所有注释，确保填写符合要求。
• 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
• 我提供了完整的配置文件和日志，而不是出于自己的判断只给出截取的部分。
• 我搜索了 issues, 没有发现已提出的类似问题。
• 问题在 Release 最新的版本上可以成功复现

描述

Xray 26.9.9 (Xray, Penetrates Everything.) 52a412d (go1.27.1 windows/amd64)

TUN入站，并配置 sniffing+routeOnly，出站 freedom+domainStrategy: AsIs
Xray 程序启动后，前几秒直连 IPv6 可以正常连接。过了几秒后，直连 IPv6 流量无法连接。

测试命令：
curl -v -I https://www.baidu.com --resolve 'www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc]' --max-time 3

附上的 log 里面有两次测试连接，第一次 [17:13:46] 是前几秒能够连接的，第二次 [17:13:56] 是后面开始不能连接的。
可以看到第二次连接缺少了后面的proxy/freedom: connection opened to tcp:[2408:871a:2100:186c:0:ff:b07e:3fbc]:443, local endpoint [my00:home:ipv6:addr::]:10658, remote endpoint [2408:871a:2100:186c:0:ff:b07e:3fbc]:443

与 https://github.com/XTLS/Xray-core/issues/6281 问题相同，但前面的 issue 最终无反馈，因此新开一个 issue

重现方式

见描述和配置

客户端配置

{
  "log": {
    "access": "access.log",
    "error": "error.log",
    "dnsLog": true,
    "loglevel": "debug"
  },
  "inbounds": [
    {
      "tag": "in-tun",
      "protocol": "tun",
      "settings": {
        "name": "tun0",
        "mtu": 1400,
        "gateway": ["10.0.0.1/16", "fdfe::1/64"],
        "userLevel": 0,
        "autoSystemRoutingTable": ["0.0.0.0/0", "::/0"],
        "autoOutboundsInterface": "auto"
      },
      "sniffing": {
        "enabled": true,
        "routeOnly": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    }
  ],
  "outbounds": [
    {
      "tag": "out-direct",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs"
      }
    }
  ]
}

服务端配置

NONE

客户端日志

Xray access.log:
access.log
Xray error.log:
error.log

curl log:

PS C:\Users\homepc> curl -v -I https://www.baidu.com --resolve 'www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc]' --max-time 3
* Added www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc] to DNS cache
* Hostname www.baidu.com was found in DNS cache
* Host www.baidu.com:443 was resolved.
* IPv6: 2408:871a:2100:186c:0:ff:b07e:3fbc
* IPv4: (none)
*   Trying [2408:871a:2100:186c:0:ff:b07e:3fbc]:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Established connection to www.baidu.com (2408:871a:2100:186c:0:ff:b07e:3fbc port 443) from fdfe::1 port 10657
* using HTTP/1.x
> HEAD / HTTP/1.1
> Host: www.baidu.com
> User-Agent: curl/8.21.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform
< Content-Length: 0
Content-Length: 0
< Content-Type: text/html
Content-Type: text/html
< Pragma: no-cache
Pragma: no-cache
< Server: bfe
Server: bfe
< Set-Cookie: BAIDUID=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000
Set-Cookie: BAIDUID=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000
< Set-Cookie: BAIDUID_BFESS=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000; Secure; SameSite=None
Set-Cookie: BAIDUID_BFESS=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000; Secure; SameSite=None
< Date: Thu, 17 Sep 2026 09:13:45 GMT
Date: Thu, 17 Sep 2026 09:13:45 GMT
<

* Connection #0 to host www.baidu.com:443 left intact
PS C:\Users\homepc> curl -v -I https://www.baidu.com --resolve 'www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc]' --max-time 3
* Added www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc] to DNS cache
* Hostname www.baidu.com was found in DNS cache
* Host www.baidu.com:443 was resolved.
* IPv6: 2408:871a:2100:186c:0:ff:b07e:3fbc
* IPv4: (none)
*   Trying [2408:871a:2100:186c:0:ff:b07e:3fbc]:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* Connection timed out after 3013 milliseconds
* closing connection #0
curl: (28) Connection timed out after 3013 milliseconds

服务端日志

NONE

Start with the TUN inbound configuration, especially sniffing with routeOnly and the freedom outbound using domainStrategy AsIs. Reproduce with the provided curl command and compare the first successful request with the later timeout using the attached access and error logs. Done means identifying and correcting the regression so direct IPv6 connections continue to open after startup.