hesoyam/Xray-core
1
0
Fork 0
mirror of https://github.com/XTLS/Xray-core.git synced 2026-11-04 01:17:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

TUN inbound: README.md says "ipv4:allexceptlan" includes "ipv4:dns" only

Browse Source 
Add "dns" to block DNS over IPv6 as well.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
patterniha
2026-11-02 18:10:11 +03:30
co-authored by Claude Opus 5.5
parent 6b45eadf45
commit f5cc086d6c
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/tun/README.md
+1 -1
View File
@@ -236,7 +236,7 @@ Setting `autoSystemWfpBlockLeak` to at least `["dns"]` is recommended, to block
- `"all"`: everything, in both directions. Access to the local network then breaks unless it is routed into the TUN as well, and so do incoming connections to other programs, other VPNs, and virtual machines whose NAT runs on the host.
- `"allexceptlan"`: like `"all"`, but traffic to and from the local network stays allowed, e.g. for printers or casting to a TV: private, link-local, multicast and broadcast addresses (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `224.0.0.0/4`, `255.255.255.255`, `fc00::/7`, `fe80::/10`, `ff00::/8`), not global IPv6 ones. It includes `"dns"`, and the other values apply there as well. `"all"` overrides it.
Any value can be limited to one IP version with `"ipv4:"` or `"ipv6:"` in front, e.g. `"ipv4:udp/53"` or `"ipv6:all"`.
Any value can be limited to one IP version with `"ipv4:"` or `"ipv6:"` in front, e.g. `"ipv4:udp/53"` or `"ipv6:all"`. `"ipv4:allexceptlan"`, for instance, includes `"ipv4:dns"` only; add `"dns"` to block DNS over IPv6 as well.
Loopback, DHCP, DHCPv6 and IPv6 neighbor discovery always stay allowed. Xray's own connections out also get past Windows Firewall's block rules, while connections to its inbounds stay subject to them. If the filters cannot be added, Xray does not start; they are removed when it exits. Name resolution on the local network (LLMNR, mDNS, NetBIOS) is not covered, except over an IP version that is blocked entirely.