From b291961d1874d24cab0fefb03a633f6d76664b79 Mon Sep 17 00:00:00 2001
From: Meo597 <197331664+Meo597@users.noreply.github.com>
Date: Sun, 25 Oct 2026 02:04:37 +0800
Subject: [PATCH] Config: Tighten IP checks for transport security exemptions

---
 infra/conf/xray.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/infra/conf/xray.go b/infra/conf/xray.go
index 6bf6ba444..2a477b897 100644
--- a/infra/conf/xray.go
+++ b/infra/conf/xray.go
@@ -237,10 +237,11 @@ type OutboundDetourConfig struct {
 
 func requiresTransportSecurity(address *Address) bool {
 	if address == nil || address.Address == nil {
-		return false
+		return true
 	}
 	if address.Family().IsIP() {
-		return !geodata.GetPrivateIPMatcher().Match(address.IP())
+		ip := address.IP()
+		return !ip.IsPrivate() && !ip.IsLoopback() && !ip.IsLinkLocalUnicast()
 	}
 	domain := strings.TrimSuffix(strings.ToLower(address.Domain()), ".")
 	return !geodata.GetPrivateDomainMatcher().MatchAny(domain)