up 7.24.4

* Update build-linux.yml

* Update build-linux.yml

* Update build-linux.yml

.github/workflows/build-linux.yml

@@ -205,7 +205,7 @@ jobs:
   deb-loong64:
     name: build and release deb loong64
     if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-26.04-arm
     env:
       RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
       QCOW2_URL: https://github.com/xujiegb/debian-loong64-qcow2/releases/download/13.5/debian13-loong64.qcow2
@@ -234,10 +234,10 @@ jobs:
     - name: Download QEMU prebuild
       run: |
         set -euo pipefail
-        wget -O qemu-linux-x64-v3.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-x64-v3.tar.gz"
-        tar -xzf qemu-linux-x64-v3.tar.gz
+        wget -O qemu-linux-arm64-v8.2.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-arm64-v8.2.tar.gz"
+        tar -xzf qemu-linux-arm64-v8.2.tar.gz
         mkdir -p "$HOME/qemu-install"
-        rsync -a qemu-linux-x64-v3/ "$HOME/qemu-install/"
+        rsync -a qemu-linux-arm64-v8.2/ "$HOME/qemu-install/"
         "$HOME/qemu-install/bin/qemu-system-loongarch64" --version
     - name: Download loong64 qcow2 and EFI firmware
       shell: bash
@@ -355,7 +355,7 @@ jobs:
   rpm-loong64:
     name: build and release rpm loong64
     if: (github.event_name == 'workflow_dispatch' && inputs.release_tag != '') || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-26.04-arm
     env:
       RELEASE_TAG: ${{ case(inputs.release_tag != '', inputs.release_tag, github.ref_name) }}
       QCOW2_URL: https://github.com/xujiegb/fedora-loong64-qcow2/releases/download/43/fedora43-loong64.qcow2
@@ -384,10 +384,10 @@ jobs:
     - name: Download QEMU prebuild
       run: |
         set -euo pipefail
-        wget -O qemu-linux-x64-v3.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-x64-v3.tar.gz"
-        tar -xzf qemu-linux-x64-v3.tar.gz
+        wget -O qemu-linux-arm64-v8.2.tar.gz "https://github.com/xujiegb/qemu-linux-prebuild/releases/download/${QEMU_VERSION}/qemu-linux-arm64-v8.2.tar.gz"
+        tar -xzf qemu-linux-arm64-v8.2.tar.gz
         mkdir -p "$HOME/qemu-install"
-        rsync -a qemu-linux-x64-v3/ "$HOME/qemu-install/"
+        rsync -a qemu-linux-arm64-v8.2/ "$HOME/qemu-install/"
         "$HOME/qemu-install/bin/qemu-system-loongarch64" --version
     - name: Download loong64 qcow2 and EFI firmware
       shell: bash

.github/workflows/build-windows-x86.yml

@@ -146,7 +146,7 @@ jobs:
           $xrayTag = "v$xrayVer"
           $singTag = "v$singVer"
 
-          $xrayUrl = "https://github.com/autorepobot/Xray-core/releases/download/$xrayTag/Xray-windows-32.zip"
+          $xrayUrl = "https://github.com/XTLS/Xray-core/releases/download/$xrayTag/Xray-windows-32.zip"
           $singUrl = "https://github.com/SagerNet/sing-box/releases/download/$singTag/sing-box-$singVer-windows-386.zip"
 
           Write-Host "Bundled Xray version: $xrayVer"

v2rayN/Directory.Build.props

@@ -1,7 +1,7 @@
 <Project>
 
     <PropertyGroup>
-        <Version>7.24.1</Version>
+        <Version>7.24.4</Version>
     </PropertyGroup>
 
     <PropertyGroup>

v2rayN/Directory.Packages.props

@@ -9,12 +9,12 @@
     <PackageVersion Include="Avalonia.Controls.DataGrid" Version="12.1.0" />
     <PackageVersion Include="Avalonia.Desktop" Version="12.1.0" />
     <PackageVersion Include="AvaloniaUI.DiagnosticsSupport" Version="2.2.3" />
-    <PackageVersion Include="AwesomeAssertions" Version="9.4.0" />
+    <PackageVersion Include="AwesomeAssertions" Version="9.5.0" />
     <PackageVersion Include="DialogHost.Avalonia" Version="0.12.3" />
     <PackageVersion Include="IPNetwork2" Version="4.3.0" />
     <PackageVersion Include="ReactiveUI.Avalonia" Version="12.0.3" />
     <PackageVersion Include="CliWrap" Version="3.10.2" />
-    <PackageVersion Include="Downloader" Version="5.9.4" />
+    <PackageVersion Include="Downloader" Version="5.9.5" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageVersion Include="H.NotifyIcon.Wpf" Version="2.4.1" />
     <PackageVersion Include="MaterialDesignThemes" Version="5.3.2" />

v2rayN/ServiceLib.Tests/CoreConfig/Singbox/CoreConfigSingboxServiceTests.cs

@@ -592,4 +592,38 @@ public class CoreConfigSingboxServiceTests
         proxy.realm.stun_servers.Should().Contain("turn.cloudflare.com:3478");
         proxy.server.Should().BeNull();
     }
+
+    [Fact]
+    public void GenerateClientConfigContent_TunSystemStackWithIpv6_ShouldUsePrefixWithPeerAddress()
+    {
+        // Regression test for #9820: sing-box fails with "need one more IPv6 address in
+        // first prefix for system stack" when the TUN inbound uses a /128 IPv6 prefix.
+        var config = CoreConfigTestFactory.CreateConfig(ECoreType.sing_box);
+        config.TunModeItem.EnableTun = true;
+        config.TunModeItem.Stack = "system";
+        config.TunModeItem.EnableIPv6Address = true;
+        CoreConfigTestFactory.BindAppManagerConfig(config);
+
+        var node = CoreConfigTestFactory.CreateVmessNode(ECoreType.sing_box);
+        var context = CoreConfigTestFactory.CreateContext(config, node, ECoreType.sing_box) with
+        {
+            IsTunEnabled = true,
+        };
+
+        var result = new CoreConfigSingboxService(context).GenerateClientConfigContent();
+
+        result.Success.Should().BeTrue($"ret msg: {result.Msg}");
+        var cfg = JsonUtils.Deserialize<SingboxConfig>(result.Data!.ToString())!;
+        var tun = cfg.inbounds.First(i => i.type == "tun");
+
+        tun.address.Should().NotBeNullOrEmpty();
+        foreach (var address in tun.address!)
+        {
+            var prefixLength = int.Parse(address[(address.LastIndexOf('/') + 1)..]);
+            var isIpv6 = address.Contains(':');
+            prefixLength.Should().BeLessThanOrEqualTo(isIpv6 ? 126 : 30,
+                $"'{address}' must leave room for the peer address the system stack derives");
+        }
+    }
+
 }

v2rayN/ServiceLib.Tests/Manager/CoreManagerTests.cs

@@ -0,0 +1,44 @@
+using AwesomeAssertions;
+using ServiceLib.Enums;
+using ServiceLib.Manager;
+using Xunit;
+
+namespace ServiceLib.Tests.Manager;
+
+public class CoreManagerTests
+{
+    [Theory]
+    [InlineData(ECoreType.sing_box)]
+    [InlineData(ECoreType.mihomo)]
+    [InlineData(ECoreType.Xray)]
+    public void ShouldRunAsSudo_TunLaunchOnNonWindows_RequiresElevation(ECoreType coreType)
+    {
+        CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeTrue();
+    }
+
+    [Fact]
+    public void ShouldRunAsSudo_NonTunLaunch_ShouldNotElevate()
+    {
+        // Regression guard for the macOS TUN failure: the elevation decision must follow
+        // the context snapshot that generated the config. A launch whose snapshot has TUN
+        // disabled must never elevate, and a launch whose snapshot has TUN enabled must
+        // elevate regardless of later changes to the live config.
+        CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.sing_box, isNonWindows: true).Should().BeFalse();
+        CoreManager.ShouldRunAsSudo(isTunLaunch: false, ECoreType.Xray, isNonWindows: true).Should().BeFalse();
+    }
+
+    [Fact]
+    public void ShouldRunAsSudo_OnWindows_ShouldNotElevate()
+    {
+        CoreManager.ShouldRunAsSudo(isTunLaunch: true, ECoreType.sing_box, isNonWindows: false).Should().BeFalse();
+    }
+
+    [Theory]
+    [InlineData(ECoreType.v2fly)]
+    [InlineData(ECoreType.hysteria)]
+    [InlineData(null)]
+    public void ShouldRunAsSudo_UnsupportedCoreType_ShouldNotElevate(ECoreType? coreType)
+    {
+        CoreManager.ShouldRunAsSudo(isTunLaunch: true, coreType, isNonWindows: true).Should().BeFalse();
+    }
+}

v2rayN/ServiceLib/Global.cs

@@ -745,7 +745,7 @@ public class Global
         MozillaRootProvider,
     ];
 
-    public static readonly IReadOnlyList<string> TunIpv4Address =
+    public static readonly IReadOnlyList<string> TunIPv4Address =
     [
         "172.18.0.1/30",
         "172.31.0.1/30",
@@ -757,15 +757,17 @@ public class Global
         "10.0.0.1/30",
     ];
 
-    public static readonly IReadOnlyList<string> TunIpv6Address =
+    // Prefixes must leave room for a peer address (max /126); the sing-box system
+    // stack derives a gateway from the first prefix and rejects single-address prefixes.
+    public static readonly IReadOnlyList<string> TunIPv6Address =
     [
-        "fc00::172:18:0:1/128",
-        "fc00::172:31:0:1/128",
-        "fc00::172:20:0:1/128",
-        "fc00::172:16:0:1/128",
-        "fc00::192:168:100:1/128",
-        "fc00::10:10:14:1/128",
-        "fc00::10:1:0:1/128",
-        "fc00::10:0:0:1/128",
+        "fc00::172:18:0:1/126",
+        "fc00::172:31:0:1/126",
+        "fc00::172:20:0:1/126",
+        "fc00::172:16:0:1/126",
+        "fc00::192:168:100:1/126",
+        "fc00::10:10:14:1/126",
+        "fc00::10:1:0:1/126",
+        "fc00::10:0:0:1/126",
     ];
 }

v2rayN/ServiceLib/GlobalUsings.cs

@@ -30,8 +30,8 @@ global using ServiceLib.Handler.Fmt;
 global using ServiceLib.Handler.SysProxy;
 global using ServiceLib.Helper;
 global using ServiceLib.Manager;
-global using ServiceLib.Models.CoreConfigs;
 global using ServiceLib.Models.Configs;
+global using ServiceLib.Models.CoreConfigs;
 global using ServiceLib.Models.Dto;
 global using ServiceLib.Models.Entities;
 global using ServiceLib.Resx;

v2rayN/ServiceLib/Handler/Builder/CoreConfigContextBuilder.cs

@@ -49,6 +49,7 @@ public class CoreConfigContextBuilder
             RoutingItem = await ConfigHandler.GetDefaultRouting(config),
             IsWindows = Utils.IsWindows(),
             IsMacOS = Utils.IsMacOS(),
+            ProtectCoreTypeList = config.TunModeItem.EnableTun ? [ECoreType.Xray, ECoreType.sing_box] : []
         };
         var validatorResult = NodeValidatorResult.Empty();
         var (actNode, nodeValidatorResult) = await ResolveNodeAsync(context, node);

v2rayN/ServiceLib/Handler/ConfigHandler.cs

@@ -92,7 +92,7 @@ public static class ConfigHandler
             EnableTun = false,
             Mtu = 9000,
             IcmpRouting = Global.TunIcmpRoutingPolicies.First(),
-            EnableLegacyProtect = false,
+            EnableLegacyProtect = true,
         };
         config.GuiItem ??= new();
         if (!Global.RootCertProviders.Contains(config.GuiItem.RootCertProvider))

v2rayN/ServiceLib/Handler/CoreConfigHandler.cs

@@ -17,7 +17,7 @@ public static class CoreConfigHandler
         {
             result = node.CoreType switch
             {
-                ECoreType.mihomo => await new CoreConfigClashService(config).GenerateClientCustomConfig(node, fileName),
+                ECoreType.mihomo => await new CoreConfigClashService(config, context.IsTunEnabled).GenerateClientCustomConfig(node, fileName),
                 _ => await GenerateClientCustomConfig(node, fileName)
             };
         }

v2rayN/ServiceLib/Handler/SysProxy/SysProxyHandler.cs

@@ -16,7 +16,6 @@ public static class SysProxyHandler
         try
         {
             var port = AppManager.Instance.GetLocalPort(EInboundProtocol.socks);
-            var exceptions = config.SystemProxyItem.SystemProxyExceptions.Replace(" ", "");
             if (port <= 0)
             {
                 return false;
@@ -24,17 +23,18 @@ public static class SysProxyHandler
             switch (type)
             {
                 case ESysProxyType.ForcedChange when Utils.IsWindows():
-                    {
-                        GetWindowsProxyString(config, port, out var strProxy, out var strExceptions);
-                        ProxySettingWindows.SetProxy(strProxy, strExceptions, 2);
-                        break;
-                    }
+                    var (strProxy, strExceptions) = GetWindowsProxyString(config, port);
+                    ProxySettingWindows.SetProxy(strProxy, strExceptions, 2);
+                    break;
+
                 case ESysProxyType.ForcedChange when Utils.IsLinux():
+                    var exceptions = SanitizeExceptions(config);
                     await ProxySettingLinux.SetProxy(Global.Loopback, port, exceptions);
                     break;
 
                 case ESysProxyType.ForcedChange when Utils.IsMacOS():
-                    await ProxySettingOSX.SetProxy(Global.Loopback, port, exceptions);
+                    var exceptions2 = SanitizeExceptions(config);
+                    await ProxySettingOSX.SetProxy(Global.Loopback, port, exceptions2);
                     break;
 
                 case ESysProxyType.ForcedClear when Utils.IsWindows():
@@ -66,15 +66,31 @@ public static class SysProxyHandler
         return true;
     }
 
-    private static void GetWindowsProxyString(Config config, int port, out string strProxy, out string strExceptions)
+    private static string SanitizeExceptions(Config config)
     {
-        strExceptions = config.SystemProxyItem.SystemProxyExceptions.Replace(" ", "");
+        var exceptions = config.SystemProxyItem.SystemProxyExceptions;
+        if (exceptions.IsNullOrEmpty())
+        {
+            return string.Empty;
+        }
+
+        var items = exceptions
+            .Split(',', StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries)
+            .Select(item => item.Replace(" ", string.Empty))
+            .Where(item => item.Length > 0);
+
+        return string.Join(',', items);
+    }
+
+    private static (string strProxy, string strExceptions) GetWindowsProxyString(Config config, int port)
+    {
+        var strExceptions = config.SystemProxyItem.SystemProxyExceptions.Replace(" ", "");
         if (config.SystemProxyItem.NotProxyLocalAddress)
         {
             strExceptions = $"<local>;{strExceptions}";
         }
 
-        strProxy = string.Empty;
+        var strProxy = string.Empty;
         if (config.SystemProxyItem.SystemProxyAdvancedProtocol.IsNullOrEmpty())
         {
             strProxy = $"{Global.Loopback}:{port}";
@@ -86,6 +102,8 @@ public static class SysProxyHandler
                 .Replace("{http_port}", port.ToString())
                 .Replace("{socks_port}", port.ToString());
         }
+
+        return (strProxy, strExceptions);
     }
 
     [SupportedOSPlatform("windows")]

v2rayN/ServiceLib/Manager/CoreManager.cs

@@ -85,7 +85,7 @@ public class CoreManager
         await CoreStop();
         await Task.Delay(100);
 
-        if (Utils.IsWindows() && _config.TunModeItem.EnableTun)
+        if (Utils.IsWindows() && (mainContext?.IsTunEnabled == true || preContext?.IsTunEnabled == true))
         {
             await Task.Delay(100);
             await WindowsUtils.RemoveTunDevice();
@@ -183,7 +183,7 @@ public class CoreManager
         var coreInfo = CoreInfoManager.Instance.GetCoreInfo(coreType);
 
         var displayLog = node.ConfigType != EConfigType.Custom || node.DisplayLog;
-        var proc = await RunProcess(coreInfo, Global.CoreConfigFileName, displayLog, true);
+        var proc = await RunProcess(coreInfo, Global.CoreConfigFileName, displayLog, true, context.IsTunEnabled);
         if (proc is null)
         {
             return;
@@ -201,7 +201,7 @@ public class CoreManager
             if (result.Success)
             {
                 var coreInfo = CoreInfoManager.Instance.GetCoreInfo(preCoreType);
-                var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true);
+                var proc = await RunProcess(coreInfo, Global.CorePreConfigFileName, true, true, preContext.IsTunEnabled);
                 if (proc is null)
                 {
                     return;
@@ -222,7 +222,7 @@ public class CoreManager
         {
             return;
         }
-        if (!preContext.AppConfig.TunModeItem.EnableTun)
+        if (!preContext.IsTunEnabled)
         {
             return;
         }
@@ -289,7 +289,20 @@ public class CoreManager
 
     #region Process
 
-    private async Task<ProcessService?> RunProcess(CoreInfo? coreInfo, string configPath, bool displayLog, bool mayNeedSudo)
+    /// <summary>
+    ///     Decides whether a core launch must be elevated on non-Windows platforms.
+    ///     The TUN state comes from the immutable <see cref="CoreConfigContext" /> snapshot that
+    ///     generated the config, never from the live mutable config: the generated config and the
+    ///     launch mode must always agree, even if TUN is toggled while a reload is in flight.
+    /// </summary>
+    public static bool ShouldRunAsSudo(bool isTunLaunch, ECoreType? coreType, bool isNonWindows)
+    {
+        return isTunLaunch
+            && coreType is ECoreType.sing_box or ECoreType.mihomo or ECoreType.Xray
+            && isNonWindows;
+    }
+
+    private async Task<ProcessService?> RunProcess(CoreInfo? coreInfo, string configPath, bool displayLog, bool mayNeedSudo, bool isTunLaunch = false)
     {
         var fileName = CoreInfoManager.Instance.GetCoreExecFile(coreInfo, out var msg);
         if (fileName.IsNullOrEmpty())
@@ -301,9 +314,7 @@ public class CoreManager
         try
         {
             if (mayNeedSudo
-                && _config.TunModeItem.EnableTun
-                && (coreInfo.CoreType is ECoreType.sing_box or ECoreType.mihomo or ECoreType.Xray)
-                && Utils.IsNonWindows())
+                && ShouldRunAsSudo(isTunLaunch, coreInfo.CoreType, Utils.IsNonWindows()))
             {
                 _linuxSudo = true;
                 await CoreAdminManager.Instance.Init(_config, _updateFunc);

v2rayN/ServiceLib/Models/Configs/ConfigItems.cs

@@ -147,10 +147,10 @@ public class TunModeItem
     public int Mtu { get; set; }
     public bool EnableIPv6Address { get; set; }
     public string IcmpRouting { get; set; }
-    public bool EnableLegacyProtect { get; set; }
+    public bool EnableLegacyProtect { get; set; } = true;
     public List<string>? RouteExcludeAddress { get; set; }
-    public string Ipv4Address { get; set; }
-    public string Ipv6Address { get; set; }
+    public string IPv4Address { get; set; }
+    public string IPv6Address { get; set; }
 }
 
 [Serializable]

v2rayN/ServiceLib/Models/CoreConfigs/V2rayConfig.cs

@@ -560,6 +560,7 @@ public class Sockopt4Ray
 
     [JsonPropertyName("interface")]
     public string? Interface { get; set; }
+
     public HappyEyeballs4Ray? happyEyeballs { get; set; }
 }
 

v2rayN/ServiceLib/Resx/ResUI.resx

@@ -1780,7 +1780,7 @@ The "Get Certificate" action may fail if a self-signed certificate is used or if
     <value>New Update</value>
   </data>
   <data name="MsgAllowInsecureDeprecated" xml:space="preserve">
-    <value>Warning: Xray will disable allowInsecure (skip certificate verification) in August 2026. Please switch to pinnedPeerCertSha256 (fixed certificate fingerprint) as soon as possible. allowInsecure will not be usable after its expiration.</value>
+    <value>The current node uses an unencrypted connection, meaning your communications could be directly monitored by network intermediaries controlled by authoritarian governments. For security reasons, nodes of this type cannot connect via Xray-core versions 26.2.6 or higher. If this is a self-built node, please enable TLS or other secure encryption, or pin the certificate using pinSHA256. If this is an airport/provider node, please contact your service provider for a technical upgrade. If the provider refuses to cooperate, it is recommended to switch to a service provider that prioritizes user security. For more information, please visit https://github.com/2dust/v2rayN/discussions/9460.</value>
   </data>
   <data name="TbRouteExcludeAddress" xml:space="preserve">
     <value>Route Exclude Address</value>

v2rayN/ServiceLib/Resx/ResUI.zh-Hans.resx

@@ -1774,7 +1774,11 @@
     <value>有更新</value>
   </data>
   <data name="MsgAllowInsecureDeprecated" xml:space="preserve">
-    <value>警告：Xray 将在 2026.8.1 禁用跳过证书验证 allowInsecure ，请尽快改用证书固定指纹 pinnedPeerCertSha256。到期后无法使用 </value>
+    <value>当前节点使用未加密连接，您的通信可能会被威权政府掌控的网络中间设施直接查看
+为了安全，此类节点无法通过 26.2.6+ 版本的Xray核心连接
+如果是自建节点请启用 TLS 等安全加密，或固定证书 pinSHA256
+如果机场节点请联系服务商完成技术升级，如服务商拒绝配合，建议更换更重视用户安全的服务商
+更多的信息，请访问 https://github.com/2dust/v2rayN/discussions/9460</value>
   </data>
   <data name="TbVerifyPeerCertByName" xml:space="preserve">
     <value>Verify Peer Cert By Name</value>

v2rayN/ServiceLib/Resx/ResUI.zh-Hant.resx

@@ -1774,7 +1774,11 @@
     <value>有更新</value>
   </data>
   <data name="MsgAllowInsecureDeprecated" xml:space="preserve">
-    <value>警告：Xray 將在 2026.8.1 停用跳過憑證驗證 allowInsecure ，請盡快改用憑證固定指紋 pinnedPeerCertSha256。到期後無法使用 allowInsecure。</value>
+    <value>目前節點使用未加密連接，您的通訊可能會被威權政府掌控的網路中間設施直接查看
+為了安全，此類節點無法透過 26.2.6+ 版本的Xray核心連接
+如果是自建節點請啟用 TLS 等安全加密，或固定憑證 pinSHA256
+若機場節點請聯絡服務商完成技術升級，如服務商拒絕配合，建議更換更重視用戶安全的服務商
+更多的信息，請訪問 https://github.com/2dust/v2rayN/discussions/9460</value>
   </data>
   <data name="TbVerifyPeerCertByName" xml:space="preserve">
     <value>Verify Peer Cert By Name</value>

v2rayN/ServiceLib/Sample/SampleTunInbound

@@ -1,27 +1,28 @@
 {
-  "tag": "tun",
-  "protocol": "tun",
-  "settings": {
-    "name": "xray_tun",
-    "MTU": 9000,
-    "gateway": [
-      "172.18.0.1/30",
-      "fdfe:dcba:9876::1/126"
-    ],
-    "dns": [
-      "172.18.0.1"
-    ],
-    "autoSystemRoutingTable": [
-      "0.0.0.0/0",
-      "::/0"
-    ],
-    "autoOutboundsInterface": "auto"
-  },
-  "sniffing": {
-    "enabled": true,
-    "destOverride": [
-      "http",
-      "tls"
-    ]
-  }
-}
+    "tag": "tun",
+    "protocol": "tun",
+    "settings": {
+        "name": "xray_tun",
+        "MTU": 9000,
+        "gateway": [
+            "172.18.0.1/30",
+            "fdfe:dcba:9876::1/126"
+        ],
+        "dns": [
+            "1.1.1.1",
+            "8.8.8.8"
+        ],
+        "autoSystemRoutingTable": [
+            "0.0.0.0/0",
+            "::/0"
+        ],
+        "autoOutboundsInterface": "auto"
+    },
+    "sniffing": {
+        "enabled": true,
+        "destOverride": [
+            "http",
+            "tls"
+        ]
+    }
+}

v2rayN/ServiceLib/Services/CoreConfig/CoreConfigClashService.cs

@@ -1,9 +1,11 @@
 namespace ServiceLib.Services.CoreConfig;
 
 /// <summary>
-/// Core configuration file processing class
+/// Core configuration file processing class.
+/// The TUN state is taken as a snapshot so the generated config always agrees
+/// with the launch elevation decision (see CoreManager.ShouldRunAsSudo).
 /// </summary>
-public class CoreConfigClashService(Config config)
+public class CoreConfigClashService(Config config, bool isTunEnabled)
 {
     private static readonly string _tag = "CoreConfigClashService";
 
@@ -102,7 +104,7 @@ public class CoreConfigClashService(Config config)
             }
 
             //enable tun mode
-            if (config.TunModeItem.EnableTun)
+            if (isTunEnabled)
             {
                 var tun = EmbedUtils.GetEmbedText(Global.ClashTunYaml);
                 if (tun.IsNotEmpty())
@@ -171,7 +173,7 @@ public class CoreConfigClashService(Config config)
         }
         foreach (var item in mixinContent)
         {
-            if (!config.TunModeItem.EnableTun && item.Key == "tun")
+            if (!isTunEnabled && item.Key == "tun")
             {
                 continue;
             }

v2rayN/ServiceLib/Services/CoreConfig/Singbox/SingboxInboundService.cs

@@ -68,11 +68,11 @@ public partial class CoreConfigSingboxService
                 tunInbound.strict_route = _config.TunModeItem.StrictRoute;
                 tunInbound.stack = _config.TunModeItem.Stack;
 
-                var address = _config.TunModeItem.Ipv4Address.NullIfEmpty() ?? Global.TunIpv4Address.First();
+                var address = _config.TunModeItem.IPv4Address.NullIfEmpty() ?? Global.TunIPv4Address.First();
                 tunInbound.address = [address];
                 if (_config.TunModeItem.EnableIPv6Address == true)
                 {
-                    var address6 = _config.TunModeItem.Ipv6Address.NullIfEmpty() ?? Global.TunIpv6Address.First();
+                    var address6 = _config.TunModeItem.IPv6Address.NullIfEmpty() ?? Global.TunIPv6Address.First();
                     tunInbound.address.Add(address6);
                 }
                 tunInbound.route_exclude_address = _config.TunModeItem.RouteExcludeAddress;

v2rayN/ServiceLib/Services/CoreConfig/V2ray/V2rayInboundService.cs

@@ -64,15 +64,16 @@ public partial class CoreConfigV2rayService
                 tunInbound.settings.name = context.IsMacOS ? $"utun{new Random().Next(99)}" : "xray_tun";
                 tunInbound.settings.MTU = _config.TunModeItem.Mtu;
 
-                var address = _config.TunModeItem.Ipv4Address.NullIfEmpty() ?? Global.TunIpv4Address.First();
+                var address = _config.TunModeItem.IPv4Address.NullIfEmpty() ?? Global.TunIPv4Address.First();
                 tunInbound.settings.gateway = [address];
+                tunInbound.settings.autoSystemRoutingTable = ["0.0.0.0/0"];
                 if (_config.TunModeItem.EnableIPv6Address == true)
                 {
-                    var address6 = _config.TunModeItem.Ipv6Address.NullIfEmpty() ?? Global.TunIpv6Address.First();
+                    var address6 = _config.TunModeItem.IPv6Address.NullIfEmpty() ?? Global.TunIPv6Address.First();
                     tunInbound.settings.gateway.Add(address6);
+                    tunInbound.settings.autoSystemRoutingTable.Add("::/0");
                 }
-                tunInbound.settings.dns = [address.Split('/').First()];
-                tunInbound.settings.autoSystemRoutingTable = ["0.0.0.0/0"];             
+           
                 var bindInterface = _config.CoreBasicItem.BindInterface?.TrimEx();
                 if (!bindInterface.IsNullOrEmpty())
                 {

v2rayN/ServiceLib/ViewModels/AddServer2ViewModel.cs

@@ -3,6 +3,7 @@ namespace ServiceLib.ViewModels;
 public class AddServer2ViewModel : MyReactiveObject, ICloseable
 {
     public event EventHandler? RequestClose;
+
     public Interaction<Unit, string?> BrowseConfigFileInteraction { get; } = new();
 
     [Reactive]

v2rayN/ServiceLib/ViewModels/OptionSettingViewModel.cs

@@ -95,8 +95,8 @@ public class OptionSettingViewModel : MyReactiveObject, ICloseable
     [Reactive] public string TunIcmpRouting { get; set; }
     [Reactive] public bool TunEnableLegacyProtect { get; set; }
     [Reactive] public string TunRouteExcludeAddress { get; set; }
-    [Reactive] public string TunIpv4Address { get; set; }
-    [Reactive] public string TunIpv6Address { get; set; }
+    [Reactive] public string TunIPv4Address { get; set; }
+    [Reactive] public string TunIPv6Address { get; set; }
 
     #endregion Tun mode
 
@@ -216,8 +216,8 @@ public class OptionSettingViewModel : MyReactiveObject, ICloseable
         TunIcmpRouting = _config.TunModeItem.IcmpRouting;
         TunEnableLegacyProtect = _config.TunModeItem.EnableLegacyProtect;
         TunRouteExcludeAddress = Utils.List2String(_config.TunModeItem.RouteExcludeAddress, true);
-        TunIpv4Address = _config.TunModeItem.Ipv4Address;
-        TunIpv6Address = _config.TunModeItem.Ipv6Address;
+        TunIPv4Address = _config.TunModeItem.IPv4Address;
+        TunIPv6Address = _config.TunModeItem.IPv6Address;
 
         #endregion Tun mode
 
@@ -382,8 +382,8 @@ public class OptionSettingViewModel : MyReactiveObject, ICloseable
         _config.TunModeItem.IcmpRouting = TunIcmpRouting;
         _config.TunModeItem.EnableLegacyProtect = TunEnableLegacyProtect;
         _config.TunModeItem.RouteExcludeAddress = Utils.String2List(TunRouteExcludeAddress);
-        _config.TunModeItem.Ipv4Address = TunIpv4Address;
-        _config.TunModeItem.Ipv6Address = TunIpv6Address;
+        _config.TunModeItem.IPv4Address = TunIPv4Address;
+        _config.TunModeItem.IPv6Address = TunIPv6Address;
 
         //coreType
         await SaveCoreType();

v2rayN/ServiceLib/ViewModels/ProfilesSelectViewModel.cs

@@ -3,6 +3,7 @@ namespace ServiceLib.ViewModels;
 public class ProfilesSelectViewModel : MyReactiveObject, ICloseable
 {
     public event EventHandler? RequestClose;
+
     public Interaction<Unit, Unit> ProfilesFocusInteraction { get; } = new();
 
     #region private prop

v2rayN/ServiceLib/ViewModels/RoutingRuleSettingViewModel.cs

@@ -3,6 +3,7 @@ namespace ServiceLib.ViewModels;
 public class RoutingRuleSettingViewModel : MyReactiveObject, ICloseable
 {
     public event EventHandler? RequestClose;
+
     public Interaction<string, bool> ShowYesNoInteraction { get; } = new();
     public Interaction<string, Unit> SetClipboardDataInteraction { get; } = new();
     public Interaction<Unit, string?> ReadTextFromClipboardInteraction { get; } = new();

v2rayN/v2rayN.Desktop/Views/OptionSettingWindow.axaml.cs

@@ -33,8 +33,8 @@ public partial class OptionSettingWindow : WindowBase<OptionSettingViewModel>
         cmbMtu.ItemsSource = Global.TunMtus;
         cmbStack.ItemsSource = Global.TunStacks;
         cmbIcmpRoutingPolicy.ItemsSource = Global.TunIcmpRoutingPolicies;
-        cmbIpv4Address.ItemsSource = Global.TunIpv4Address;
-        cmbIpv6Address.ItemsSource = Global.TunIpv6Address;
+        cmbIpv4Address.ItemsSource = Global.TunIPv4Address;
+        cmbIpv6Address.ItemsSource = Global.TunIPv6Address;
         cmbFragmentPackets.ItemsSource = Global.FragmentPacketsOptions;
 
         cmbCoreType1.ItemsSource = Global.CoreTypes;
@@ -131,8 +131,8 @@ public partial class OptionSettingWindow : WindowBase<OptionSettingViewModel>
             this.Bind(ViewModel, vm => vm.TunIcmpRouting, v => v.cmbIcmpRoutingPolicy.SelectedValue).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunEnableLegacyProtect, v => v.togEnableLegacyProtect.IsChecked).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunRouteExcludeAddress, v => v.txtRouteExcludeAddress.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv4Address, v => v.cmbIpv4Address.SelectedValue).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv6Address, v => v.cmbIpv6Address.SelectedValue).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv4Address, v => v.cmbIpv4Address.SelectedValue).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv6Address, v => v.cmbIpv6Address.SelectedValue).DisposeWith(disposables);
 
             this.Bind(ViewModel, vm => vm.CoreType1, v => v.cmbCoreType1.SelectedValue).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CoreType2, v => v.cmbCoreType2.SelectedValue).DisposeWith(disposables);

v2rayN/v2rayN/Views/OptionSettingWindow.xaml.cs

@@ -29,8 +29,8 @@ public partial class OptionSettingWindow
         cmbMtu.ItemsSource = Global.TunMtus;
         cmbStack.ItemsSource = Global.TunStacks;
         cmbIcmpRoutingPolicy.ItemsSource = Global.TunIcmpRoutingPolicies;
-        cmbIpv4Address.ItemsSource = Global.TunIpv4Address;
-        cmbIpv6Address.ItemsSource = Global.TunIpv6Address;
+        cmbIpv4Address.ItemsSource = Global.TunIPv4Address;
+        cmbIpv6Address.ItemsSource = Global.TunIPv6Address;
         cmbFragmentPackets.ItemsSource = Global.FragmentPacketsOptions;
 
         cmbCoreType1.ItemsSource = Global.CoreTypes;
@@ -126,8 +126,8 @@ public partial class OptionSettingWindow
             this.Bind(ViewModel, vm => vm.TunIcmpRouting, v => v.cmbIcmpRoutingPolicy.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunEnableLegacyProtect, v => v.togEnableLegacyProtect.IsChecked).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.TunRouteExcludeAddress, v => v.txtRouteExcludeAddress.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv4Address, v => v.cmbIpv4Address.Text).DisposeWith(disposables);
-            this.Bind(ViewModel, vm => vm.TunIpv6Address, v => v.cmbIpv6Address.Text).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv4Address, v => v.cmbIpv4Address.Text).DisposeWith(disposables);
+            this.Bind(ViewModel, vm => vm.TunIPv6Address, v => v.cmbIpv6Address.Text).DisposeWith(disposables);
 
             this.Bind(ViewModel, vm => vm.CoreType1, v => v.cmbCoreType1.Text).DisposeWith(disposables);
             this.Bind(ViewModel, vm => vm.CoreType2, v => v.cmbCoreType2.Text).DisposeWith(disposables);