Tylerrrkd e1e6c5ddb0 Fix infinite TUN routing loop on traffic to the TUN's own addresses (#9897)
* Restore the silently dropped embedded TUN routing rules

tun_singbox_rules declares "network": "udp" as a bare string, but
Rule4Sbox.network is a List<string>. System.Text.Json therefore throws on
the very first rule, and JsonUtils.Deserialize swallows it and returns
default. GenRouting only checks for null before AddRange, so the whole
embedded rule set is dropped without a trace.

Both rules it carries have thus never reached a generated config: the
NetBIOS/mDNS reject and the multicast reject. The mismatch predates the
sing-box 1.12 migration - the template has used the string form since the
rules file was introduced.

- declare network as an array so the template matches Rule4Sbox

* Drop traffic addressed to the TUN's own addresses

With auto_route the TUN steals the default route, so a packet whose
destination is the TUN interface's own address is handed to sing-box instead
of being looped back by the kernel. Routing then matches ip_is_private and
sends it to `direct`, whose interface is auto-detected as the TUN again, so
the packet is written straight back into the TUN and re-enters routing. The
loop never terminates and pins a CPU core.

Seen in the wild on macOS: a WebRTC client offered the TUN's own
fc00::172:18:0:1 ULA as an ICE candidate and the resulting STUN
connectivity checks sustained ~8k packets/s out of the interface at 800%
CPU, 21 GB written to the TUN over five hours - against 3 GB read, the
asymmetry that gives the loop away.

Nothing legitimate is addressed to those addresses, so reject them before
any outbound rule can match. Use method "drop" rather than the default
ICMP unreachable, whose destination would be the looping address itself.

- reject the TUN inbound's own addresses, taken from the generated inbound
  so the two cannot drift apart
2026-08-05 10:35:37 +08:00
2026-06-26 17:30:28 +08:00
2025-05-28 20:04:12 +08:00
2026-07-09 16:25:39 +08:00
2026-07-17 09:13:19 +08:00
2026-07-02 09:20:46 +08:00

v2rayN

A GUI client for Windows, Linux and macOS. Support Xray and sing-box and others

CodeFactor Release Downloads Telegram

Windows Linux macOS GPG Signed


Download / 下载

Download the latest release here:

在这里下载最新版本:

https://github.com/2dust/v2rayN/releases

Tip

v2rayN is the desktop version. For the mobile version, please visit the v2rayNG
v2rayN 是电脑版,手机版请访问 v2rayNG

https://github.com/2dust/v2rayNG


Documentation / 使用文档

Read the Wiki for usage guides and configuration details.

请阅读 Wiki 获取使用说明和配置教程。

https://github.com/2dust/v2rayN/wiki


Supported Platforms / 支持平台

Platform / 平台 x64 x86 arm64 riscv64 loong64
Windows - -
Linux -
macOS - - -

GPG Verification / GPG 签名校验

Release files are signed with GPG to verify authenticity and integrity, helping prevent mirror, ISP, or CDN hijacking.

发布文件已使用 GPG 签名,可用于校验文件真实性与完整性,预防镜像站、运营商或 CDN 劫持。

Fingerprint / 公钥指纹

7694 5E9F 3E9A 168F 8070 F195 805D 661C
134D FAF6 8903 C199 463C 31E5 AE90 3AE0

Community / 社区

Telegram Group / Telegram 群组:

https://t.me/v2rayN

Telegram Channel / Telegram 频道:

https://t.me/github_2dust

Languages
C# 92%
Shell 8%