patterniha and Claude Opus 5.5
2db099b34b
TUN inbound: Block DNS and IPv6 leaks outside the TUN on Windows; Add strictRoute
...
Windows sends name queries to the DNS servers of all interfaces, and a
resolver on the local network (e.g. 192.168.1.1 from DHCP) is reached
through its more specific LAN route instead of the TUN, so DNS leaks
past it. IPv6 bypasses a TUN that cannot carry it.
With autoSystemRoutingTable set, the Windows TUN now adds Windows
Filtering Platform filters, all in one transaction and in a dynamic
session, so that they are removed when Xray exits, even if it crashes:
- DNS (port 53) only goes through the TUN, in both directions: its local
address, and the interface it leaves or arrives by, must be the TUN's.
- IPv6 is blocked in both directions when the TUN has no IPv6 address or
no IPv6 route, except loopback, neighbor and multicast listener
discovery, and DHCPv6.
- Xray's own traffic is exempt: its connections out with a hard permit,
which Windows Firewall rules do not override (like sing-box's
strict_route), connections to its inbounds with an ordinary one.
If the filters cannot be added, the TUN does not start on Windows 10 and
later (only a warning on 7/8). The new `strictRoute` option (true by
default) turns them off.
Also on Windows:
- A warning for `dns` servers outside gateway and autoSystemRoutingTable,
as queries to them cannot go through the TUN and are blocked.
- While DNS is restricted and autoOutboundsInterface is in use, Xray
resolves the names it would ask Windows for itself (Go's resolver on
its own sockets). Those lookups and the `localhost` DNS server skip the
TUN's DNS servers, unless another interface uses them too, instead of
looping back into the TUN.
- The DNS cache is flushed when the TUN starts and stops, and DNS
registration is turned off on the TUN (through netsh before Windows 10
1809).
- Close no longer panics when registering the route or interface change
callbacks failed.
The README's Windows section describes all of it.
Tested on Windows 11, elevated, amd64 and 386: the filters, DNS arriving
through a real Wintun adapter and blocked outside it, the IPv6 block,
Windows Firewall rules, and a real Xray run. Windows 7/8 and Windows 10
before 1809 are untested.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-09-28 08:15:40 +03:30
7b8ade3ec5
TUN inbound: Only close the UDP connection that actually finished ( #6814 )
...
https://github.com/XTLS/Xray-core/pull/6814#pullrequestreview-5324536423
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-27 21:06:19 +00:00
Artem Lytkin and GitHub
5dda894e29
TUN inbound: Reuse existing Wintun adapter by name on Windows again ( #6811 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6780
2026-09-27 20:39:17 +00:00
youugiuhiuh and GitHub
47a2c2ffdc
TUN inbound: Add autoSystemDNS on Linux (to TUN's gateway) ( #6773 )
...
https://github.com/XTLS/Xray-core/issues/6454#issuecomment-4931311976
https://github.com/XTLS/Xray-core/pull/6773#issuecomment-5755516423
https://github.com/XTLS/Xray-core/pull/6807#issuecomment-5807844210
2026-09-27 20:07:53 +00:00
Cluvex and GitHub
7a018833ec
Proxy: Add MASQUE inbound (IETF CONNECT-IP server, RFC 9484) ( #6844 )
...
Completes https://github.com/XTLS/Xray-core/pull/6807 and https://github.com/XTLS/Xray-core/pull/6810
2026-09-27 19:16:54 +00:00
风扇滑翔翼 and GitHub
65e853ed84
SS2022 proxy: Refactor to remove sing* dependencies ( #6831 )
...
https://github.com/XTLS/Xray-core/pull/4356#issuecomment-2639571931
2026-09-27 18:42:53 +00:00
风扇滑翔翼 and RPRX
61cad5ec8b
Xray-core: Reduce error log usage for performance ( #6796 )
...
https://github.com/XTLS/Xray-core/pull/6796#issuecomment-5807809588
2026-09-25 17:59:49 +00:00
Hossin Asaadi and GitHub
60e2a0c502
WireGuard proxy: Release packet views after use ( #6801 )
...
https://github.com/XTLS/Xray-core/pull/6801#issuecomment-5807228464
2026-09-24 05:46:26 +00:00
Esko Mobius and GitHub
7d3e44fee2
Proxy: Add MASQUE outbound & transport (IETF CONNECT-IP, RFC 9484) ( #6807 )
...
Closes https://github.com/XTLS/Xray-core/issues/5495#issuecomment-3710683679
2026-09-24 02:13:37 +00:00
LjhAUMEM and GitHub
a308ded2e6
WireGuard outbound: Fix endpoint IP address ( #6804 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6803
2026-09-24 01:59:28 +00:00
d562d8947d
Hysteria outbound: Fix UDP DATAGRAM truncation with ChromeParrot ( #6788 )
...
https://github.com/XTLS/Xray-core/pull/6788#issuecomment-5751428127
---------
Co-authored-by: LjhAUMEM <llnu14702@gmail.com >
2026-09-20 22:51:03 +00:00
Hossin Asaadi and GitHub
dbb1ea30ba
WireGuard proxy: Prevent panic when closing netTun with a write in flight ( #6778 )
...
https://github.com/XTLS/Xray-core/pull/6778#pullrequestreview-5251957308
2026-09-20 20:07:54 +00:00
LjhAUMEM and RPRX
efc9e6da62
WireGuard outbound: Remove remoteDNS' "local" mode and domainStrategy ( #6771 )
...
https://github.com/XTLS/Xray-core/issues/6567#issuecomment-5660953757
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751826982
https://github.com/XTLS/Xray-core/pull/6771#issuecomment-5751831637
2026-09-20 19:07:51 +00:00
LjhAUMEM and GitHub
8267cf953a
Transport: Refactor to be based on Finalmask's dialer & listener ( #6754 )
...
https://github.com/XTLS/Xray-core/pull/6327#issuecomment-5645958010
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5720818254
https://github.com/XTLS/Xray-core/pull/6754#issuecomment-5751585906
2026-09-20 18:12:50 +00:00
c412e77a9b
TUN inbound: Preserve UDP packet destinations with traffic stats ( #6747 )
...
https://github.com/XTLS/Xray-core/pull/6747#issuecomment-5647964551
---------
Co-authored-by: 风扇滑翔翼 <Fangliding.fshxy@outlook.com >
2026-09-12 20:09:35 +00:00
patterniha and GitHub
c26d2eda24
Direct/Freedom outbound: Skip domain resolution and finalRules when using sockopt.dialerProxy ( #6742 )
...
https://github.com/XTLS/Xray-core/pull/6058#issuecomment-5578800461
2026-09-08 18:45:38 +00:00
Meow and GitHub
3e2f040cd8
Direct/Freedom outbound: Better Compatibility ( #6058 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6393
2026-09-08 03:31:25 +00:00
LjhAUMEM and GitHub
c7245c0336
TUN inbound: Refine Windows support ( #6478 )
...
https://github.com/XTLS/Xray-core/pull/6478#issuecomment-5489052152
2026-09-08 02:51:35 +00:00
01a034be53
Blackhole outbound: Add customizable response data support ( #6713 )
...
https://github.com/XTLS/Xray-core/pull/6711#issuecomment-5508683394
---------
Co-authored-by: Raaad1on <djilyawhite@gmail.com >
2026-09-07 21:09:58 +00:00
Younes and RPRX
8ee131cbbb
HTTP inbound: Fix a potential panic in readResponseAndHandle100Continue() ( #6545 )
2026-09-01 02:59:56 +03:00
Jorik_Smith and GitHub
2776ea6d74
SS2022 outbound: Close connection to server on early returns ( #6698 )
...
https://github.com/XTLS/Xray-core/pull/6698#issuecomment-5468662565
2026-08-31 23:59:04 +00:00
brookwko and GitHub
c1958dba04
TUN inbound: Support autoSystemRoutingTable and autoOutboundsInterface on FreeBSD as well ( #6691 )
...
https://github.com/XTLS/Xray-core/pull/6691#issuecomment-5445818753
Closes https://github.com/XTLS/Xray-core/issues/5594#issuecomment-4789101025
2026-08-27 22:32:45 +00:00
风扇滑翔翼
65458e919f
Config: Fix some issues ( #6640 )
...
https://github.com/XTLS/Xray-core/pull/6640#issuecomment-5420106315
Fixes https://github.com/XTLS/Xray-core/issues/6636
Fixes https://github.com/XTLS/Xray-core/issues/6600
...
2026-08-27 20:03:59 +08:00
Jidos and GitHub
aa3d6589da
TUN inbound: Wait() blocks via kqueue instead of busy-spinning on Darwin ( #6580 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6579
2026-08-26 21:29:58 +00:00
Maksim Varentsov and GitHub
25c11e2d2b
Tunnel inbound: SO_REUSEPORT fix and IPv6 support for the OpenBSD transparent proxy ( #6624 )
...
Completes https://github.com/XTLS/Xray-core/pull/6546
2026-08-26 21:05:05 +00:00
c7e569b037
WireGuard outbound: Add remoteDNS & honor TTL ( #6620 )
...
Closes https://github.com/XTLS/Xray-core/pull/6569#issuecomment-5263789755
Fixes https://github.com/XTLS/Xray-core/issues/6567#issuecomment-5150957597
---------
Co-authored-by: LagPixelLOL <2282688304@qq.com >
2026-08-25 14:28:36 +00:00
风扇滑翔翼 and GitHub
7d214f8b09
WireGuard outbound: Fix sendThrough support ( #6570 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6559
2026-08-12 08:38:01 +00:00
Maksim Varentsov and GitHub
a000371b2a
Tunnel inbound: Support TPROXY on OpenBSD as well ( #6546 )
...
https://github.com/XTLS/Xray-core/pull/6546#issuecomment-5100711574
2026-08-12 04:51:38 +00:00
Jasper344612 and GitHub
1d8eb81d70
TUN inbound: Add desc config for Windows ("Wintun" by default) ( #6486 )
...
https://github.com/XTLS/Xray-docs-next/pull/872#issuecomment-4936055488
2026-07-17 22:21:33 +00:00
0bafca9486
Stats: Fix GetOrRegister*() races ( #6468 )
...
Fixes https://github.com/XTLS/Xray-core/pull/6467#issue-4856851059
---------
Co-authored-by: Joshua Su <i@joshua.su >
2026-07-10 20:34:27 +00:00
yiguodev and GitHub
d5bc58dc6b
Root config: Add env config ( #6400 )
...
https://github.com/XTLS/Xray-core/pull/6400#issuecomment-4880198100
https://github.com/XTLS/Xray-core/pull/6400#issuecomment-4916892425
https://github.com/XTLS/Xray-core/pull/6400#issuecomment-4929136670
2026-07-10 02:56:49 +00:00
LjhAUMEM and GitHub
412898fed7
WireGuard outbound: Fix a race condition ( #6461 )
...
Fixes https://github.com/XTLS/Xray-core/pull/6321#issuecomment-4881463309
2026-07-09 20:40:02 +00:00
d7fa2076c3
Xray-core: Forbid unencrypted outbounds on public Internet for VLESS and Trojan; Remove "none/zero/plain" for VMess and Shadowsocks ( #6303 )
...
https://github.com/XTLS/Xray-core/pull/5640#issuecomment-4611416512
https://github.com/XTLS/Xray-core/pull/6303#issuecomment-4668055274
---------
Co-authored-by: Meow <197331664+Meo597@users.noreply.github.com >
2026-07-07 02:01:53 +00:00
yiguodev and GitHub
0495b17650
TUN inbound: Refine gateway and autoSystemRoutingTable on macOS ( #6434 )
...
https://github.com/XTLS/Xray-core/pull/6434#issuecomment-4885521586
2026-07-07 00:28:50 +00:00
yiguodev and GitHub
65f6f0a43b
TUN inbound: Refine gateway and autoSystemRoutingTable on Linux ( #6398 )
...
https://github.com/XTLS/Xray-core/pull/6398#issuecomment-4880261591
2026-07-04 02:25:15 +00:00
Jasper344612 and GitHub
3263ae9255
TUN inbound: Fix autoOutboundsInterface on Linux ( #6413 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6412
2026-07-04 01:38:25 +00:00
LjhAUMEM and GitHub
3dc8bf3d8b
Hysteria inbound: Fix dynamic UUID not accepted ( #6395 )
...
Fixes https://github.com/XTLS/Xray-core/pull/6375#issuecomment-4825923934
2026-07-04 01:28:21 +00:00
452b719504
Hysteria inbound: Support routing's vlessRoute as well ( #6375 )
...
https://github.com/XTLS/Xray-core/pull/6375#issuecomment-4795522284
---------
Co-authored-by: LjhAUMEM <llnu14702@gmail.com >
2026-06-27 12:04:58 +00:00
345c76f9a8
WireGuard inbound: Support dynamic peer management ( #6360 )
...
https://github.com/XTLS/Xray-core/pull/6360#issuecomment-4780311547
Closes https://github.com/XTLS/Xray-core/issues/6314
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: LjhAUMEM <llnu14702@gmail.com >
2026-06-27 11:41:22 +00:00
yiguodev and GitHub
dda2b10c9d
TUN inbound: Add traffic counters; Metrics: Rely on instance ( #6349 )
...
https://github.com/XTLS/Xray-core/pull/6349#issuecomment-4775121300
2026-06-24 12:00:22 +00:00
Jasper344612 and GitHub
241aa38ac0
TUN inbound: Support autoSystemRoutingTable and autoOutboundsInterface on macOS and Linux as well ( #6366 )
...
https://github.com/XTLS/Xray-core/pull/6366#issuecomment-4788510365
2026-06-24 11:06:00 +00:00
e7e9254630
TUN inbound: Avoid panic on nil RemoteAddr due to quickly closed connection ( #6365 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6364#issuecomment-4778262075
---------
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com >
2026-06-23 11:37:21 +00:00
Жора Змейкин and RPRX
9cd9382e3d
TUN inbound: Support env XRAY_TUN_FD on Linux as well ( #6338 )
...
https://github.com/XTLS/Xray-core/pull/6338#issuecomment-4770945163
2026-06-22 17:38:36 +00:00
j2rong4cn and GitHub
c815c2f2df
Loopback outbound: Add sniffing ( #6326 )
...
Example: https://github.com/XTLS/Xray-core/pull/6326#issue-4659701786
2026-06-18 23:17:01 +00:00
风扇滑翔翼 and RPRX
6412738486
Socks5 inbound: Fix issues in new UDP ASSOCIATE ( #6325 )
...
https://github.com/XTLS/Xray-core/pull/6325#issuecomment-4724008713
Fixes https://github.com/XTLS/Xray-core/issues/6323
---------
Co-authored-by: RPRX <63339210+RPRX@users.noreply.github.com >
2026-06-17 14:44:40 +00:00
LjhAUMEM and RPRX
862631172d
WireGuard proxy: Refactor ( #6287 )
...
And https://github.com/XTLS/Xray-core/pull/6303#issuecomment-4669158076
Fixes https://github.com/XTLS/Xray-core/issues/6257
2026-06-17 12:02:10 +00:00
LjhAUMEM and GitHub
da21a8f77f
TUN & WireGuard inbounds: Ignore b.UDP's domain when receiving it from outbound ( #6285 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6279
2026-06-09 20:53:55 +00:00
𐲓𐳛𐳪𐳂𐳐 𐲀𐳢𐳦𐳫𐳢 𐲥𐳔𐳛𐳪𐳌𐳑𐳖𐳇 and GitHub
95e9816223
Chore: Limit sing* dependencies to shadowsocks_2022 only ( #6286 )
...
https://github.com/XTLS/Xray-core/pull/6286#issuecomment-4658968225
2026-06-09 10:55:42 +00:00
风扇滑翔翼 and GitHub
3239d21168
TUN inbound: autoOutboundsInterface bypasses loopback addresses ( #6276 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6269
2026-06-09 09:40:55 +00:00
风扇滑翔翼 and GitHub
06b4931743
TUN inbound: Start TUN by AlwaysOnInboundHandler ( #6275 )
...
Fixes https://github.com/XTLS/Xray-core/issues/6274
2026-06-09 09:22:33 +00:00
