TUN入站如何让特定程序走Socks5出站，其余程序照常？ #5900

Kc2353 · 2026-04-10T05:03:10Z

Kc2353
Apr 10, 2026

需求：
要求VboxNetNat.exe所有流量直接走tun进入socks5代理，不考虑分流，考虑部分特殊情况，将对应DNS请求也走代理发出
笔误: 进程名实际为“VboxNetNAT”

遇到的问题：
疑似回环，出现大量类似下面的信息：
2026/04/10 12:31:18.062687 [Info] [2202177587] proxy/tun: processing from udp:169.254.57.70:61747 to udp:169.254.255.255:137
2026/04/10 12:31:18.118735 [Info] [2202177587] app/dispatcher: taking detour [direct] for [udp:169.254.255.255:137]
2026/04/10 12:31:18.118735 from udp:169.254.57.70:61747 accepted udp:169.254.255.255:137 [tun-in -> direct]
2026/04/10 12:31:18.118735 [Info] [2202177587] proxy/freedom: connection opened to udp:169.254.255.255:137, local endpoint [::]:61750, remote endpoint 169.254.255.255:137
目前配置：

{
  "log": {
    "loglevel": "debug" // 调试模式：查看 process 匹配日志，确认规则是否命中 [[27]]
  },

  "inbounds": [
    {
      "tag": "tun-in", // 入站标签，路由规则引用
      "protocol": "tun", // TUN 入站协议 [[7]]
      "settings": {
        "name": "xray0", // TUN 接口名称，需与系统路由配置一致 [[7]]
        "MTU": 1450, // 接口 MTU，默认值 [[7]]
        "userLevel": 0 // 用户等级，对应 policy 配置
      },
      "sniffing": {
        "enabled": true, // 启用流量嗅探，识别域名用于路由 [[27]]
        "destOverride": ["http", "tls", "quic"] // 嗅探协议类型
      }
    }
  ],

  "outbounds": [
    {
      "tag": "socks-out", // 代理出站标签
      "protocol": "socks", // Socks 出站协议（仅支持 Socks 5）[[3]]
      "settings": {
        "servers": [
          {
            "address": "127.0.0.1", // 【请替换】您的 Socks5 服务器地址
            "port": 1080, // 【请替换】您的 Socks5 服务器端口
            "user": "", // 可选：如需认证请填写用户名 [[3]]
            "pass": "" // 可选：如需认证请填写密码 [[3]]
          }
        ]
      }
    },
    {
      "tag": "direct", // 直连出站标签
      "protocol": "freedom", // Freedom 协议表示直连
      "settings": {}
    }
  ],

  "routing": {
    "domainStrategy": "IPIfNonMatch", // 域名匹配失败后解析为 IP 二次匹配，提高规则命中率 [[27]]
    "rules": [
      {
        "type": "field",
        "inboundTag": ["tun-in"], // 仅处理 TUN 入站流量
        "process": [
          "VboxNetNat", // 【关键】匹配进程名：核心自动删除 .exe 后缀，大小写敏感 [[27]]
          "C:/Program Files/Oracle/VirtualBox/VboxNetNat", // 【备选】完整路径匹配（必须用正斜杠 /）[[27]]
          "C:/Program Files/Oracle/VirtualBox/" // 【备选】文件夹匹配：匹配该目录下所有进程（以 / 结尾）[[27]]
        ],
        "outboundTag": "socks-out" // ✅ VboxNetNat.exe 所有流量（含 DNS/UDP/TCP）走 Socks5 代理
      },
      {
        "type": "field",
        "inboundTag": ["tun-in"],
        "process": ["self/"], // 【防回环】匹配 Xray 自身进程，避免代理请求循环 [[27]]
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "inboundTag": ["tun-in"],
        "outboundTag": "direct" // 【默认规则】TUN 入站的其他所有进程流量直连（放在最后）
      }
    ]
  },

  "dns": {
    "servers": [
      "8.8.8.8", // 公共 DNS
      "1.1.1.1"
    ],
    "queryStrategy": "UseIP" // 优先使用 A/AAAA 记录，避免 DNS 查询泄露 [[26]]
    // 注意：应用发出的 DNS 请求（如 VboxNetNat 查询域名）会作为普通流量被 routing 规则处理，
    // 只要 process 匹配成功，DNS 请求也会走 socks-out，无需额外配置
  },

  "policy": {
    "levels": {
      "0": {
        "handshake": 4,
        "connIdle": 300,
        "uplinkOnly": 2,
        "downlinkOnly": 5
      }
    }
  }
}

mclovin-2k · 2026-04-14T10:19:47Z

mclovin-2k
Apr 14, 2026

我这边同样的问题，大量的类似的日志：

2026/04/14 15:38:20.252711 [Info] [2173646369] proxy/tun: processing from udp:10.0.0.1:137 to udp:10.0.255.255:137
2026/04/14 15:38:20.256372 [Info] [2173646369] app/dispatcher: default route for udp:10.0.255.255:137
2026/04/14 15:38:20.256891 [Debug] [2173646369] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.257949 [Info] [2173646369] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63923, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.258474 [Info] [2865993596] proxy/tun: processing from udp:10.0.0.1:63923 to udp:10.0.255.255:137
2026/04/14 15:38:20.258474 [Debug] [2865993596] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.258474 [Info] [2865993596] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63924, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.258997 [Info] [2777827758] proxy/tun: processing from udp:10.0.0.1:63924 to udp:10.0.255.255:137
2026/04/14 15:38:20.258997 [Debug] [2777827758] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.259525 [Info] [2777827758] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63925, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.259525 [Info] [1288444847] proxy/tun: processing from udp:10.0.0.1:63925 to udp:10.0.255.255:137
2026/04/14 15:38:20.260050 [Debug] [1288444847] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.260050 [Info] [1288444847] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63926, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.260050 [Info] [2016267407] proxy/tun: processing from udp:10.0.0.1:63926 to udp:10.0.255.255:137
2026/04/14 15:38:20.260050 [Debug] [2016267407] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.260568 [Info] [2016267407] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63927, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.260568 [Info] [2261387357] proxy/tun: processing from udp:10.0.0.1:63927 to udp:10.0.255.255:137
2026/04/14 15:38:20.260568 [Debug] [2261387357] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.260568 [Info] [2261387357] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63928, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.261082 [Info] [1637444382] proxy/tun: processing from udp:10.0.0.1:63928 to udp:10.0.255.255:137
2026/04/14 15:38:20.261082 [Debug] [1637444382] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.261082 [Info] [1637444382] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63929, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.261082 [Info] [3921827229] proxy/tun: processing from udp:10.0.0.1:63929 to udp:10.0.255.255:137
2026/04/14 15:38:20.261599 [Debug] [3921827229] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.261599 [Info] [3921827229] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63930, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.262114 [Info] [3358125994] proxy/tun: processing from udp:10.0.0.1:63930 to udp:10.0.255.255:137
2026/04/14 15:38:20.262114 [Debug] [3358125994] transport/internet: dialing to udp:10.0.255.255:137
2026/04/14 15:38:20.262114 [Info] [3358125994] proxy/freedom: connection opened to udp:10.0.255.255:137, local endpoint [::]:63931, remote endpoint 10.0.255.255:137
2026/04/14 15:38:20.262630 [Info] [2305260458] proxy/tun: processing from udp:10.0.0.1:63931 to udp:10.0.255.255:137
2026/04/14 15:38:20.263144 [Debug] [2305260458] transport/internet: dialing to udp:10.0.255.255:137

TUN Inbound

{
    "inbounds": [
        {
            "tag": "InboundTun",
            "protocol": "tun",
            "settings": {
                "name": "XRayTun",
                "gateway": [
                    "10.0.0.1/16",
                    "fc00::1/64"
                ],
                "autoOutboundsInterface": "auto",
                "autoSystemRoutingTable": [
                    "0.0.0.0/0",
                    "::/0"
                ]
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "http",
                    "tls",
                    "quic",
                    "fakedns"
                ]
            }
        }
    ]
}

目前只能用隔壁SB的TUN顶一下，没有这种问题。

1 reply

LjhAUMEM Apr 15, 2026
Maintainer

10.0.0.1/16 应该是太多了，改成 10.0.0.1/32 吧

LjhAUMEM · 2026-04-15T04:06:03Z

LjhAUMEM
Apr 15, 2026
Maintainer

如果特定程序支持 socks out，开个 127 的 socks in 即可，loopback 网卡不会进入 autoSystemRoutingTable 路由

3 replies

mclovin-2k Apr 15, 2026

如果特定程序支持 socks out，开个 127 的 socks in 即可，loopback 网卡不会进入 autoSystemRoutingTable 路由

大佬，我现在想启动2个XRAY进程，一个只开TUN IN，按照 process 分流，把需要走代理的进程导入SOCKS OUT，其它进程走Direct；第二个开SOCKS IN，就是一般意义上的代理服务，按照 Domain 和 IP 分流。

TUN的配置：

{
    "inbounds": [
        {
            "tag": "InboundTun",
            "protocol": "tun",
            "settings": {
                "name": "XRayTun",
                "gateway": [
                    "10.0.0.1/32",
                    "fc00::1/128"
                ],
                "autoOutboundsInterface": "auto",
                "autoSystemRoutingTable": [
                    "0.0.0.0/0",
                    "::/0"
                ]
            },
            "sniffing": {
                "enabled": true,
                "metadataOnly": true,
                "destOverride": [
                    "fakedns"
                ]
            }
        }
    ],
    "outbounds": [
        {
            "tag": "OutboundDirect",
            "protocol": "direct",
            "settings": {
                "domainStrategy": "AsIs"
            }
        },
        {
            "tag": "OutboundDNS",
            "protocol": "dns"
        },
        {
            "tag": "OutboundSocksAutoRouting",
            "protocol": "socks",
            "settings": {
                "address": "127.0.0.1",
                "port": 9527
            }
        }
    ],
    "dns": {
        "servers": [
            "fakedns",
            "localhost"
        ]
    },
    "fakedns": [
        {
            "ipPool": "198.18.0.0/15",
            "poolSize": 65535
        },
        {
            "ipPool": "2001:0002::/48",
            "poolSize": 65535
        }
    ]
    "routing": {
        "rules": [
            {
                "ruleTag": "防止 Domain Loopback",
                "domain": [
                    "internal",
                    "local",
                    "localhost",
                    "localdomain"
                ],
                "outboundTag": "OutboundDirect"
            },
            {
                "ruleTag": "防止 IP Loopback",
                "ip": [
                    "127.0.0.0/8",
                    "::/127"
                ],
                "outboundTag": "OutboundDirect"
            },
            {
                "ruleTag": "防止 Self Loopback",
                "process": [
                    "self/",
                    "xray/"
                ],
                "outboundTag": "OutboundDirect"
            },
            {
                "ruleTag": "劫持 DNS",
                "port": "53",
                "outboundTag": "OutboundDNS"
            },
            {
                "ruleTag": "代理进程",
                "process": [
                    "chrome",
                    "telegram",
                    "chrome_updater",
                    "NatTypeTester"
                ],
                "outboundTag": "OutboundSocksAutoRouting"
            }
        ]
    }
}

我这个配置刚启动的时候还正常，过几分钟，日志里就会出现一大堆：

2026/04/15 14:55:28.410916 [Info] [3360647931] proxy/tun: processing from udp:10.0.0.1:51371 to udp:216.239.32.223:443
2026/04/15 14:55:28.411422 [Info] [3360647931] app/dispatcher: default route for udp:216.239.32.223:443
2026/04/15 14:55:28.411422 [Debug] [3360647931] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.411422 [Info] [1424116187] proxy/tun: processing from tcp:[fc00::1]:58190 to tcp:[2001:4860:4802:36::223]:443
2026/04/15 14:55:28.411972 [Info] [1424116187] app/dispatcher: default route for tcp:[2001:4860:4802:36::223]:443
2026/04/15 14:55:28.411972 [Info] [1424116187] transport/internet/tcp: dialing TCP to tcp:[2001:4860:4802:36::223]:443
2026/04/15 14:55:28.411972 [Debug] [1424116187] transport/internet: dialing to tcp:[2001:4860:4802:36::223]:443
2026/04/15 14:55:28.411972 [Info] [3360647931] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51372, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.411972 [Info] [1424116187] transport/internet/tcp: dialing TCP to tcp:[2001:4860:4802:36::223]:443
2026/04/15 14:55:28.411972 [Debug] [1424116187] transport/internet: dialing to tcp:[2001:4860:4802:36::223]:443
2026/04/15 14:55:28.412534 [Info] [984517656] proxy/tun: processing from udp:10.0.0.1:51372 to udp:216.239.32.223:443
2026/04/15 14:55:28.412534 [Info] [984517656] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.413092 [Debug] [984517656] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.413092 [Info] [984517656] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51373, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.413092 [Info] [3997600586] proxy/tun: processing from udp:10.0.0.1:51373 to udp:216.239.32.223:443
2026/04/15 14:55:28.413660 [Info] [3997600586] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.413660 [Debug] [3997600586] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.413660 [Info] [3997600586] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51374, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.414194 [Info] [1298305818] proxy/tun: processing from udp:10.0.0.1:51374 to udp:216.239.32.223:443
2026/04/15 14:55:28.414194 [Info] [1298305818] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.414194 [Debug] [1298305818] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.414714 [Info] [1298305818] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51375, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.414714 [Info] [3479298426] proxy/tun: processing from udp:10.0.0.1:51375 to udp:216.239.32.223:443
2026/04/15 14:55:28.415281 [Info] [3479298426] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.415281 [Debug] [3479298426] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.415281 [Info] [3479298426] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51376, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.415854 [Info] [226412645] proxy/tun: processing from udp:10.0.0.1:51376 to udp:216.239.32.223:443
2026/04/15 14:55:28.415854 [Info] [226412645] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.415854 [Debug] [226412645] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.416383 [Info] [226412645] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51377, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.416383 [Info] [4115988531] proxy/tun: processing from udp:10.0.0.1:51377 to udp:216.239.32.223:443
2026/04/15 14:55:28.416900 [Info] [4115988531] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.416900 [Debug] [4115988531] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.416900 [Info] [4115988531] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51378, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.416900 [Info] [1867568486] proxy/tun: processing from udp:10.0.0.1:51378 to udp:216.239.32.223:443
2026/04/15 14:55:28.417973 [Info] [1867568486] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.417973 [Debug] [1867568486] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.417973 [Info] [1867568486] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51379, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.417973 [Info] [3444194628] proxy/tun: processing from udp:10.0.0.1:51379 to udp:216.239.32.223:443
2026/04/15 14:55:28.417973 [Info] [3444194628] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.417973 [Debug] [3444194628] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.418598 [Info] [3444194628] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51380, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.418598 [Info] [3687984974] proxy/tun: processing from udp:10.0.0.1:51380 to udp:216.239.32.223:443
2026/04/15 14:55:28.419177 [Info] [3687984974] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.419177 [Debug] [3687984974] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.419177 [Info] [3687984974] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51381, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.419694 [Info] [641395584] proxy/tun: processing from udp:10.0.0.1:51381 to udp:216.239.32.223:443
2026/04/15 14:55:28.419694 [Info] [641395584] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.419694 [Debug] [641395584] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.419694 [Info] [641395584] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51382, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.420232 [Info] [3305551761] proxy/tun: processing from udp:10.0.0.1:51382 to udp:216.239.32.223:443
2026/04/15 14:55:28.420232 [Info] [3305551761] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.420232 [Debug] [3305551761] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.420232 [Info] [3305551761] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51383, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.420831 [Info] [1369078413] proxy/tun: processing from udp:10.0.0.1:51383 to udp:216.239.32.223:443
2026/04/15 14:55:28.421493 [Info] [1369078413] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.421493 [Debug] [1369078413] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.421493 [Info] [1369078413] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51384, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.421493 [Info] [3151285900] proxy/tun: processing from udp:10.0.0.1:51384 to udp:216.239.32.223:443
2026/04/15 14:55:28.422022 [Info] [3151285900] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.422022 [Debug] [3151285900] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.422571 [Info] [3151285900] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51385, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.422571 [Info] [1944784167] proxy/tun: processing from udp:10.0.0.1:51385 to udp:216.239.32.223:443
2026/04/15 14:55:28.422571 [Info] [1944784167] app/dispatcher: Hit route rule: [防止 Self Loopback] so taking detour [OutboundDirect] for [udp:216.239.32.223:443]
2026/04/15 14:55:28.422571 [Debug] [1944784167] transport/internet: dialing to udp:216.239.32.223:443
2026/04/15 14:55:28.422571 [Info] [1944784167] proxy/freedom: connection opened to udp:216.239.32.223:443, local endpoint [::]:51386, remote endpoint 216.239.32.223:443
2026/04/15 14:55:28.422571 [Info] [1316331428] proxy/tun: processing from udp:10.0.0.1:51386 to udp:216.239.32.223:443

感觉又是哪里死循环了，可是我都不知道这个“216.239.32.223”IP是从哪儿来的，我的配置是不是哪里不对啊？

LjhAUMEM Apr 15, 2026
Maintainer

试下手动指定 interface，如果恢复的话那就是双栈漏设置 udp4 了

{
	"tag": "OutboundDirect",
	"protocol": "direct",
	"settings": {
		"domainStrategy": "AsIs"
	},
	"streamSettings": {
		"sockopt": {
			"interface": ""
		}
	}
}

mclovin-2k Apr 16, 2026

试下手动指定 interface，如果恢复的话那就是双栈漏设置 udp4 了
{
	"tag": "OutboundDirect",
	"protocol": "direct",
	"settings": {
		"domainStrategy": "AsIs"
	},
	"streamSettings": {
		"sockopt": {
			"interface": ""
		}
	}
}

我更新了26.4.15，似乎好了，没有再出现了。

但是我怎么把 TUN 和 FAKEDNS 一起使用呢？
我在ROUTE里写了劫持53端口（见上面）然后路由到DNS出口了，但是日志里没有 FAKEDNS 相关的日志，应该是没成功。
另外，我看#5887 里面，TUN的Settings模板中有DNS相关的

"dns": [
          "1.1.1.1",
          "8.8.8.8"
          // "2606:4700:4700::1111",
          // "2001:4860:4860::8888"
        ],

是在这里启用FAKEDNS吗？

debugzxcv · 2026-04-15T16:09:01Z

debugzxcv
Apr 15, 2026

我也有相似需求，如果有人有可工作的设置，请粘贴到此，提前谢过。

0 replies

jjlizz · 2026-04-16T02:40:11Z

jjlizz
Apr 16, 2026

{
	"vsersion": {},
	"log": {
		"loglevel": "warning"
	},
	"api": {
		"tag": "api",
		"listen": "127.0.0.1:10086",
		"services": ["StatsService"]
	},
	"dns": {
		"servers": [
			{
				"address": "https://223.5.5.5/dns-query",
				"domains": [
					"geosite:cn",
					"domain:example.com",
					"domain:example.org"
				],
				"skipFallback": true,
				"tag": "DirectDNS"
			},
			{
				"address": "https://101.199.254.118/dns-query",
				"domains": [
					"geosite:cn",
					"domain:example.com",
					"domain:example.org"
				],
				"skipFallback": true,
				"tag": "DirectDNS"
			},
			"https://1.1.1.1/dns-query",
			"https://8.8.8.8/dns-query",
			"https://94.140.14.140/dns-query",
			"https://208.67.222.2/dns-query",
			{
				"address": "10.0.0.1", //内网穿透的dns,用于解析内网域名
				"domains": ["domain:example.com"], //对应的内网域名匹配
				"port": 60199, //tun模式该项似乎并不总是起作用
				"tag": "VPNDNS"
			}
		],
		"queryStrategy": "UseIP",
		"tag": "RemoteDNS"
	},
	"routing": {
		"rules": [
			{
				"inboundTag": ["api"],
				"outboundTag": "api"
			},
			{
				"process": ["self/"],
				"inboundTag": ["tun"],
				"outboundTag": "direct"
			},
			{
				"process": ["C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"],
				"inboundTag": ["tun"],
				"outboundTag": "HomeVPNWireGuard"
			},
			{
				"inboundTag": ["DirectDNS"],
				"outboundTag": "direct"
			},
			{
				"inboundTag": ["VPNDNS"],
				"outboundTag": "HomeVPNWireGuard"
			},
			{
				"inboundTag": ["RemoteDNS"],
				"outboundTag": "JP1"
			},
			{
				"ip": ["geoip:private"],
				"outboundTag": "HomeVPNWireGuard"
			},
			{
				"domain": ["geosite:private"],
				"outboundTag": "HomeVPNWireGuard"
			},
			{
				"ip": ["geoip:cn"],
				"outboundTag": "direct"
			},
			{
				"domain": ["geosite:cn"],
				"outboundTag": "direct"
			}
		],
		"domainStrategy": "IPIfNonMatch"
	},
	"policy": {
		"system": {
			"statsInboundUplink": true,
			"statsInboundDownlink": true,
			"statsOutboundUplink": true,
			"statsOutboundDownlink": true
		}
	},
	"inbounds": [
		{
			"protocol": "tun",
			"sniffing": {
				"enabled": true,
				"destOverride": [
					"http",
					"tls",
					"quic"
				]
			},
			"settings": {
				"name": "xray",
				"MTU": 1500,
				"gateway": [
					"192.168.255.1/24",
					"fddd:192:168:255::1/64"
				],
				"autoSystemRoutingTable": [
					"0.0.0.0/0",
					"::/0"
				],
				"autoOutboundsInterface": "WLAN" //auto并不可靠，最好指定出口
			},
			"tag": "tun"
		}
	],
	"outbounds": [
		{
			"protocol": "vless",
			"streamSettings": {
				"sockopt": {
					"domainStrategy": "UseIP"
				}
			},
			"settings": {
				"address": "example.com",
				"port": 1111,
				"id": "example",
				"encryption": "example",
				"flow": "xtls-rprx-vision"
			},
			"tag": "JP1"
		},
		{
			"protocol": "wireguard",
			"streamSettings": {
				"sockopt": {
					"domainStrategy": "UseIP"
				},
				"finalmask": {
					"udp": [
						{
							"type": "header-srtp",
							"settings": {}
						}
					]
				}
			},
			"settings": {
				"secretKey": "example",
				"address": [
					"192.168.0.11/32",
					"fddd:192:168:0::11/128"
				],
				"peers": [
					{
						"endpoint": "example.com:1111",
						"preSharedKey": "example",
						"publicKey": "example"
					}
				],
				"mtu": 1420
			},
			"tag": "HomeVPNWireGuard"
		},
		{
			"protocol": "freedom",
			"settings": {},
			"tag": "direct"
		},
		{
			"protocol": "blackhole",
			"settings": {},
			"tag": "blocked"
		}
	],
	"transport": {},
	"stats": {}
}

这是基于4.15版本的一个可用配置，没有回环问题，对dns和流量都进行了分流，但是根据我自己的测试不同设备似乎对于dns查询的行为不太一致，仅供参考。
基本思路是，内网流量使用wg回家，相应的内网域名也使用内网dns服务器查询，国内流量直连并使用国内dns服务器进行查询，国际流量使用代理并使用可信dns服务器进行查询，虽然并没有特意根据程序分流，只是尝试使用edge来进行分流，分流结果是成功的，应该可以给你们作为参考，根据需要调整即可。

0 replies

debugzxcv · 2026-04-17T12:13:26Z

debugzxcv
Apr 17, 2026

楼主有试过最新版（26.4.15）Xray-core吗？

0 replies

TUN入站如何让特定程序走Socks5出站，其余程序照常？ #5900

Uh oh!

Uh oh!

Kc2353 Apr 10, 2026

Replies: 5 comments · 4 replies

Uh oh!

Uh oh!

mclovin-2k Apr 14, 2026

Uh oh!

LjhAUMEM Apr 15, 2026 Maintainer

Uh oh!

LjhAUMEM Apr 15, 2026 Maintainer

Uh oh!

mclovin-2k Apr 15, 2026

Uh oh!

LjhAUMEM Apr 15, 2026 Maintainer

Uh oh!

Uh oh!

mclovin-2k Apr 16, 2026

Uh oh!

debugzxcv Apr 15, 2026

Uh oh!

Uh oh!

jjlizz Apr 16, 2026

Uh oh!

debugzxcv Apr 17, 2026

Kc2353
Apr 10, 2026

Replies: 5 comments 4 replies

mclovin-2k
Apr 14, 2026

LjhAUMEM Apr 15, 2026
Maintainer

LjhAUMEM
Apr 15, 2026
Maintainer

LjhAUMEM Apr 15, 2026
Maintainer

debugzxcv
Apr 15, 2026

jjlizz
Apr 16, 2026

debugzxcv
Apr 17, 2026