hesoyam/sing-box-extended-mirror
1
0
Fork 0
mirror of https://github.com/shtorm-7/sing-box-extended.git synced 2026-10-28 05:56:58 +00:00
Code Issues Packages Projects Releases 2 Wiki Activity

Merge tag 'v1.14.0'

Browse Source
This commit is contained in:
Shtorm
2026-09-04 01:08:30 +03:00
parent 99bbd49406 0b8995879f
commit c0bfc731ec
987 changed files with 141481 additions and 11302 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration/inbound/cloudflared.md
+89
View File
@@ -0,0 +1,89 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
`cloudflared` inbound runs an embedded Cloudflare Tunnel client and routes all
incoming tunnel traffic (TCP, UDP, ICMP) through sing-box's routing engine.
### Structure
```json
{
"type": "cloudflared",
"tag": "",
"token": "",
"ha_connections": 0,
"protocol": "",
"post_quantum": false,
"edge_ip_version": 0,
"datagram_version": "",
"grace_period": "",
"region": "",
"control_dialer": {
... // Dial Fields
},
"tunnel_dialer": {
... // Dial Fields
}
}
```
### Fields
#### token
==Required==
Base64-encoded tunnel token from the Cloudflare Zero Trust dashboard
(`Networks → Tunnels → Install connector`).
#### ha_connections
Number of high-availability connections to the Cloudflare edge.
Capped by the number of discovered edge addresses.
#### protocol
Transport protocol for edge connections.
One of `quic` `http2`.
#### post_quantum
Enable post-quantum key exchange on the control connection.
#### edge_ip_version
IP version used when connecting to the Cloudflare edge.
One of `0` (automatic) `4` `6`.
#### datagram_version
Datagram protocol version used for UDP proxying over QUIC.
One of `v2` `v3`. Only meaningful when `protocol` is `quic`.
#### grace_period
Graceful shutdown window for in-flight edge connections.
#### region
Cloudflare edge region selector.
Conflict with endpoints embedded in `token`.
#### control_dialer
[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
Cloudflare control plane.
#### tunnel_dialer
[Dial Fields](/configuration/shared/dial/) used when the tunnel client dials the
Cloudflare edge data plane.
docs/configuration/inbound/cloudflared.zh.md
+89
View File
@@ -0,0 +1,89 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
`cloudflared` 入站运行一个内嵌的 Cloudflare Tunnel 客户端，并将所有传入的隧道流量
（TCP、UDP、ICMP）通过 sing-box 的路由引擎转发。
### 结构
```json
{
"type": "cloudflared",
"tag": "",
"token": "",
"ha_connections": 0,
"protocol": "",
"post_quantum": false,
"edge_ip_version": 0,
"datagram_version": "",
"grace_period": "",
"region": "",
"control_dialer": {
... // 拨号字段
},
"tunnel_dialer": {
... // 拨号字段
}
}
```
### 字段
#### token
==必填==
来自 Cloudflare Zero Trust 仪表板的 Base64 编码隧道令牌
（`Networks → Tunnels → Install connector`）。
#### ha_connections
到 Cloudflare edge 的高可用连接数。
上限为已发现的 edge 地址数量。
#### protocol
edge 连接使用的传输协议。
`quic` `http2` 之一。
#### post_quantum
在控制连接上启用后量子密钥交换。
#### edge_ip_version
连接 Cloudflare edge 时使用的 IP 版本。
`0`（自动）`4` `6` 之一。
#### datagram_version
通过 QUIC 进行 UDP 代理时使用的数据报协议版本。
`v2` `v3` 之一。仅在 `protocol` 为 `quic` 时有效。
#### grace_period
正在处理的 edge 连接的优雅关闭窗口。
#### region
Cloudflare edge 区域选择器。
与 `token` 中嵌入的 endpoint 冲突。
#### control_dialer
隧道客户端拨向 Cloudflare 控制面时使用的
[拨号字段](/zh/configuration/shared/dial/)。
#### tunnel_dialer
隧道客户端拨向 Cloudflare edge 数据面时使用的
[拨号字段](/zh/configuration/shared/dial/)。
docs/configuration/inbound/hysteria.md
+38 -27
View File
@@ -21,11 +21,16 @@
}
],
"tls": {},
... // QUIC Fields
// Deprecated
"recv_window_conn": 0,
"recv_window_client": 0,
"max_conn_client": 0,
"disable_mtu_discovery": false,
"tls": {}
"disable_mtu_discovery": false
}
```
@@ -76,32 +81,38 @@ Authentication password, in base64.
Authentication password.
#### recv_window_conn
The QUIC stream-level flow control window for receiving data.
`15728640 (15 MB/s)` will be used if empty.
#### recv_window_client
The QUIC connection-level flow control window for receiving data.
`67108864 (64 MB/s)` will be used if empty.
#### max_conn_client
The maximum number of QUIC concurrent bidirectional streams that a peer is allowed to open.
`1024` will be used if empty.
#### disable_mtu_discovery
Disables Path MTU Discovery (RFC 8899). Packets will then be at most 1252 (IPv4) / 1232 (IPv6) bytes in size.
Force enabled on for systems other than Linux and Windows (according to upstream).
#### tls
==Required==
TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
### QUIC Fields
See [QUIC Fields](/configuration/shared/quic/) for details.
### Deprecated Fields
#### recv_window_conn
!!! failure "Deprecated in sing-box 1.14.0"
Use QUIC fields `stream_receive_window` instead.
#### recv_window_client
!!! failure "Deprecated in sing-box 1.14.0"
Use QUIC fields `connection_receive_window` instead.
#### max_conn_client
!!! failure "Deprecated in sing-box 1.14.0"
Use QUIC fields `max_concurrent_streams` instead.
#### disable_mtu_discovery
!!! failure "Deprecated in sing-box 1.14.0"
Use QUIC fields `disable_path_mtu_discovery` instead.
docs/configuration/inbound/hysteria.zh.md
+38 -27
View File
@@ -21,11 +21,16 @@
}
],
"tls": {},
... // QUIC 字段
// 废弃的
"recv_window_conn": 0,
"recv_window_client": 0,
"max_conn_client": 0,
"disable_mtu_discovery": false,
"tls": {}
"disable_mtu_discovery": false
}
```
@@ -76,32 +81,38 @@ base64 编码的认证密码。
认证密码。
#### recv_window_conn
用于接收数据的 QUIC 流级流控制窗口。
默认 `15728640 (15 MB/s)`。
#### recv_window_client
用于接收数据的 QUIC 连接级流控制窗口。
默认 `67108864 (64 MB/s)`。
#### max_conn_client
允许对等点打开的 QUIC 并发双向流的最大数量。
默认 `1024`。
#### disable_mtu_discovery
禁用路径 MTU 发现 (RFC 8899)。 数据包的大小最多为 1252 (IPv4) / 1232 (IPv6) 字节。
强制为 Linux 和 Windows 以外的系统启用（根据上游）。
#### tls
==必填==
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#入站)。
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#入站)。
### QUIC 字段
参阅 [QUIC 字段](/zh/configuration/shared/quic/) 了解详情。
### 废弃字段
#### recv_window_conn
!!! failure "已在 sing-box 1.14.0 废弃"
请使用 QUIC 字段 `stream_receive_window` 代替。
#### recv_window_client
!!! failure "已在 sing-box 1.14.0 废弃"
请使用 QUIC 字段 `connection_receive_window` 代替。
#### max_conn_client
!!! failure "已在 sing-box 1.14.0 废弃"
请使用 QUIC 字段 `max_concurrent_streams` 代替。
#### disable_mtu_discovery
!!! failure "已在 sing-box 1.14.0 废弃"
请使用 QUIC 字段 `disable_path_mtu_discovery` 代替。
docs/configuration/inbound/hysteria2.md
+138 -2
View File
@@ -2,6 +2,12 @@
icon: material/alert-decagram
---
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [bbr_profile](#bbr_profile)
:material-plus: [realm](#realm)
:material-alert: [obfs](#obfstype)
!!! quote "Changes in sing-box 1.11.0"
:material-alert: [masquerade](#masquerade)
@@ -30,8 +36,26 @@ icon: material/alert-decagram
],
"ignore_client_bandwidth": false,
"tls": {},
... // QUIC Fields
"masquerade": "", // or {}
"brutal_debug": false
"bbr_profile": "",
"brutal_debug": false,
"realm": {
"server_url": "https://realm.example.com",
"token": "",
"realm_id": "",
"stun_servers": [],
"stun_domain_resolver": "", // or {}
"ip_version": 0,
"port_mapping": {
"enabled": false,
"timeout": "",
"lifetime": ""
},
"http_client": {}
}
}
```
@@ -58,7 +82,7 @@ Conflict with `ignore_client_bandwidth`.
#### obfs.type
QUIC traffic obfuscator type, only available with `salamander`.
QUIC traffic obfuscator type, one of `salamander` `gecko`.
Disabled if empty.
@@ -66,6 +90,22 @@ Disabled if empty.
QUIC traffic obfuscator password.
#### obfs.min_packet_size
!!! question "Since sing-box 1.14.0"
Minimum on-wire packet size in bytes. Gecko only.
`512` is used by default.
#### obfs.max_packet_size
!!! question "Since sing-box 1.14.0"
Maximum on-wire packet size in bytes. Gecko only.
`1200` is used by default.
#### users
Hysteria2 users
@@ -90,6 +130,10 @@ Deny clients to use the BBR CC.
TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
### QUIC Fields
See [QUIC Fields](/configuration/shared/quic/) for details.
#### masquerade
HTTP3 server behavior (URL string configuration) when authentication fails.
@@ -141,6 +185,98 @@ Fixed response headers.
Fixed response content.
#### bbr_profile
!!! question "Since sing-box 1.14.0"
BBR congestion control algorithm profile, one of `conservative` `standard` `aggressive`.
`standard` is used by default.
#### brutal_debug
Enable debug information logging for Hysteria Brutal CC.
#### realm
!!! question "Since sing-box 1.14.0"
Register this inbound to a Hysteria Realm rendezvous service to enable NAT traversal.
The inbound discovers its public addresses via STUN, registers them on the realm, and uses UDP hole-punching to accept incoming clients without a publicly reachable listen address.
See [Hysteria Realm](/configuration/service/hysteria-realm/) for the rendezvous service.
#### realm.server_url
==Required==
Realm rendezvous service URL.
#### realm.token
Bearer token for the realm. Must match one of `users[].token` configured on the realm.
#### realm.realm_id
==Required==
Slot identifier on the realm.
1–64 characters, must match `^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$`.
Outbounds must use the same `realm_id` to find this server.
#### realm.stun_servers
==Required==
List of STUN servers (`host` or `host:port`) used to discover public addresses.
#### realm.stun_domain_resolver
Set domain resolver to use for resolving STUN server domain names.
This option uses the same format as the [route DNS rule action](/configuration/dns/rule_action/#route) without the `action` field.
Setting this option directly to a string is equivalent to setting `server` of this options.
If empty, the default domain resolver is used.
#### realm.ip_version
Restrict realm connections (STUN, hole punching, and the resulting QUIC path) to a single IP version.
`4` or `6`. Both are used if empty.
The `listen` address must be compatible with the selected version.
#### realm.port_mapping
Maintain a UDP port mapping on the local gateway via UPnP or NAT-PMP.
The mapping is established before STUN discovery and improves hole-punching reliability behind gateways that support it; failures are non-fatal.
Requires IPv4: conflicts with `"ip_version": 6`.
#### realm.port_mapping.enabled
Enable port mapping.
#### realm.port_mapping.timeout
Timeout for gateway discovery and mapping operations.
`10s` is used by default.
#### realm.port_mapping.lifetime
Lease lifetime of the mapping; it is renewed at half the lifetime.
`10m` is used by default.
#### realm.http_client
HTTP client used to talk to the realm.
See [HTTP Client](/configuration/shared/http-client/) for details.
docs/configuration/inbound/hysteria2.zh.md
+139 -3
View File
@@ -2,6 +2,12 @@
icon: material/alert-decagram
---
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [bbr_profile](#bbr_profile)
:material-plus: [realm](#realm)
:material-alert: [obfs](#obfstype)
!!! quote "sing-box 1.11.0 中的更改"
:material-alert: [masquerade](#masquerade)
@@ -30,8 +36,26 @@ icon: material/alert-decagram
],
"ignore_client_bandwidth": false,
"tls": {},
... // QUIC 字段
"masquerade": "", // 或 {}
"brutal_debug": false
"bbr_profile": "",
"brutal_debug": false,
"realm": {
"server_url": "https://realm.example.com",
"token": "",
"realm_id": "",
"stun_servers": [],
"stun_domain_resolver": "", // 或 {}
"ip_version": 0,
"port_mapping": {
"enabled": false,
"timeout": "",
"lifetime": ""
},
"http_client": {}
}
}
```
@@ -55,13 +79,29 @@ icon: material/alert-decagram
#### obfs.type
QUIC 流量混淆器类型，仅可设为 `salamander`。
QUIC 流量混淆器类型，可选 `salamander` `gecko`。
如果为空则禁用。
#### obfs.password
QUIC 流量混淆器密码.
QUIC 流量混淆器密码。
#### obfs.min_packet_size
!!! question "自 sing-box 1.14.0 起"
最小线上数据包大小（字节）。仅限 Gecko。
默认使用 `512`。
#### obfs.max_packet_size
!!! question "自 sing-box 1.14.0 起"
最大线上数据包大小（字节）。仅限 Gecko。
默认使用 `1200`。
#### users
@@ -87,6 +127,10 @@ Hysteria 用户
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#入站)。
### QUIC 字段
参阅 [QUIC 字段](/zh/configuration/shared/quic/) 了解详情。
#### masquerade
HTTP3 服务器认证失败时的行为 （URL 字符串配置）。
@@ -138,6 +182,98 @@ HTTP3 服务器认证失败时的行为 （对象配置）。
固定响应内容。
#### bbr_profile
!!! question "自 sing-box 1.14.0 起"
BBR 拥塞控制算法配置，可选 `conservative` `standard` `aggressive`。
默认使用 `standard`。
#### brutal_debug
启用 Hysteria Brutal CC 的调试信息日志记录。
#### realm
!!! question "自 sing-box 1.14.0 起"
将此入站注册到 Hysteria Realm 会合服务，以启用 NAT 穿透。
入站通过 STUN 发现自己的公网地址并注册到 realm，借助 UDP 打洞接受客户端连接，无需可公网直达的监听地址。
会合服务参阅 [Hysteria Realm](/zh/configuration/service/hysteria-realm/)。
#### realm.server_url
==必填==
Realm 会合服务 URL。
#### realm.token
Realm 的 Bearer 令牌，需与 realm 上配置的 `users[].token` 之一匹配。
#### realm.realm_id
==必填==
Realm 上的槽位标识符。
1–64 字符，需匹配 `^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$`。
出站需使用相同的 `realm_id` 才能找到本服务器。
#### realm.stun_servers
==必填==
用于发现公网地址的 STUN 服务器列表（`host` 或 `host:port`）。
#### realm.stun_domain_resolver
用于解析 STUN 服务器域名的域名解析器。
此选项的格式与 [路由 DNS 规则动作](/zh/configuration/dns/rule_action/#route) 相同，但不包含 `action` 字段。
若直接将此选项设置为字符串，则等同于设置该选项的 `server` 字段。
如果为空，则使用默认域名解析器。
#### realm.ip_version
将 realm 连接（STUN、打洞与最终的 QUIC 路径）限制为单一 IP 版本。
`4` 或 `6`。默认使用两者。
`listen` 地址必须与所选版本兼容。
#### realm.port_mapping
通过 UPnP 或 NAT-PMP 在本地网关上维护 UDP 端口映射。
映射在 STUN 发现之前建立，可在支持的网关后提升打洞成功率；失败不影响正常流程。
需要 IPv4：与 `"ip_version": 6` 冲突。
#### realm.port_mapping.enabled
启用端口映射。
#### realm.port_mapping.timeout
网关发现与映射操作的超时。
默认使用 `10s`。
#### realm.port_mapping.lifetime
映射的租约时长；每过一半时长续期一次。
默认使用 `10m`。
#### realm.http_client
与 realm 通信使用的 HTTP 客户端。
参阅 [HTTP 客户端](/zh/configuration/shared/http-client/) 了解详情。
docs/configuration/inbound/index.md
+2 -1
View File
@@ -31,10 +31,11 @@
| `hysteria2` | [Hysteria2](./hysteria2/) | :material-close: |
| `vless` | [VLESS](./vless/) | TCP |
| `anytls` | [AnyTLS](./anytls/) | TCP |
| `mieru` | [Mieru](./mieru/) | :material-close: |
| `snell` | [Snell](./snell/) | TCP |
| `tun` | [Tun](./tun/) | :material-close: |
| `redirect` | [Redirect](./redirect/) | :material-close: |
| `tproxy` | [TProxy](./tproxy/) | :material-close: |
| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
#### tag
docs/configuration/inbound/index.zh.md
+2 -1
View File
@@ -31,10 +31,11 @@
| `hysteria2` | [Hysteria2](./hysteria2/) | :material-close: |
| `vless` | [VLESS](./vless/) | TCP |
| `anytls` | [AnyTLS](./anytls/) | TCP |
| `mieru` | [Mieru](./mieru/) | :material-close: |
| `snell` | [Snell](./snell/) | TCP |
| `tun` | [Tun](./tun/) | :material-close: |
| `redirect` | [Redirect](./redirect/) | :material-close: |
| `tproxy` | [TProxy](./tproxy/) | :material-close: |
| `cloudflared` | [Cloudflared](./cloudflared/) | :material-close: |
#### tag
docs/configuration/inbound/naive.md
+1 -4
View File
@@ -50,13 +50,10 @@ QUIC congestion control algorithm.
| Algorithm | Description |
|----------------|---------------------------------|
| `bbr` | BBR |
| `bbr_standard` | BBR (Standard version) |
| `bbr2` | BBRv2 |
| `bbr2_variant` | BBRv2 (An experimental variant) |
| `cubic` | CUBIC |
| `reno` | New Reno |
`bbr` is used by default (the default of QUICHE, used by Chromium which NaiveProxy is based on).
`bbr` is used by default.
#### tls
docs/configuration/inbound/naive.zh.md
+1 -4
View File
@@ -50,13 +50,10 @@ QUIC 拥塞控制算法。
| 算法 | 描述 |
|----------------|--------------------|
| `bbr` | BBR |
| `bbr_standard` | BBR (标准版) |
| `bbr2` | BBRv2 |
| `bbr2_variant` | BBRv2 (一种试验变体) |
| `cubic` | CUBIC |
| `reno` | New Reno |
默认使用 `bbr`（NaiveProxy 基于的 Chromium 使用的 QUICHE 的默认值）。
默认使用 `bbr`。
#### tls
docs/configuration/inbound/snell.md
+96
View File
@@ -0,0 +1,96 @@
---
icon: material/new-box
---
!!! question "Since sing-box 1.14.0"
### Structure
```json
{
"type": "snell",
"tag": "snell-in",
... // Listen Fields
"version": 5,
"psk": "password",
"users": [
{
"name": "sekai",
"userkey": "user-password"
}
],
"obfs_mode": ""
}
```
### Version 6 Structure
```json
{
"type": "snell",
"tag": "snell-in",
... // Listen Fields
"version": 6,
"psk": "password",
"users": [
{
"name": "sekai",
"userkey": "user-password"
}
],
"mode": ""
}
```
### Listen Fields
See [Listen Fields](/configuration/shared/listen/) for details.
### Fields
#### version
==Required==
The Snell protocol version, one of `5` `6`.
Version `5` supports HTTP obfuscation (`obfs_mode`); version `6` replaces it
with traffic shaping (`mode`) and requires a `psk` of 12 to 255 bytes.
!!! note
Since we intentionally do not support the QUIC proxy mode of Snell v5, the v5 wire protocol
is effectively identical to v4, so no separate v4 server or v5 client is provided.
#### psk
==Required==
The pre-shared key.
#### users
Snell users.
When set, the server runs in multi-user mode: each entry has a `name` (optional, used in
logs) and a `userkey` (the user's key). The top-level `psk` remains the server key.
#### obfs_mode
==Version 5 only==
HTTP obfuscation mode, one of `none` `http`.
`none` is used by default.
#### mode
==Version 6 only==
Traffic shaping mode, one of `default` `unshaped` `unsafe-raw`.
`default` is used by default.
docs/configuration/inbound/snell.zh.md
+96
View File
@@ -0,0 +1,96 @@
---
icon: material/new-box
---
!!! question "自 sing-box 1.14.0 起"
### 结构
```json
{
"type": "snell",
"tag": "snell-in",
... // 监听字段
"version": 5,
"psk": "password",
"users": [
{
"name": "sekai",
"userkey": "user-password"
}
],
"obfs_mode": ""
}
```
### 版本 6 结构
```json
{
"type": "snell",
"tag": "snell-in",
... // 监听字段
"version": 6,
"psk": "password",
"users": [
{
"name": "sekai",
"userkey": "user-password"
}
],
"mode": ""
}
```
### 监听字段
参阅 [监听字段](/zh/configuration/shared/listen/)。
### 字段
#### version
==必填==
Snell 协议版本，`5` `6` 之一。
版本 `5` 支持 HTTP 混淆（`obfs_mode`）；版本 `6` 以流量整形（`mode`）取而代之，并要求
`psk` 长度为 12 到 255 字节。
!!! note
由于我们有意不支持 Snell v5 的 QUIC 代理模式，v5 的线路协议实际上与 v4 没有区别，
因此不提供独立的 v4 服务器和 v5 客户端。
#### psk
==必填==
预共享密钥。
#### users
Snell 用户。
设置后，服务器运行于多用户模式：每一项包含 `name`（可选，用于日志）和 `userkey`
（用户密钥）。顶层的 `psk` 仍作为服务器密钥。
#### obfs_mode
==仅版本 5==
HTTP 混淆模式，`none` `http` 之一。
默认为 `none`。
#### mode
==仅版本 6==
流量整形模式，`default` `unshaped` `unsafe-raw` 之一。
默认为 `default`。
docs/configuration/inbound/tproxy.md
+13 -1
View File
@@ -1,3 +1,9 @@
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [udp_mapping](/configuration/shared/udp-nat/#udp_mapping)
:material-plus: [udp_filtering](/configuration/shared/udp-nat/#udp_filtering)
:material-plus: [udp_nat_max](/configuration/shared/udp-nat/#udp_nat_max)
!!! quote ""
Only supported on Linux.
@@ -11,7 +17,9 @@
... // Listen Fields
"network": "udp"
"network": "udp",
... // UDP NAT Fields
}
```
@@ -26,3 +34,7 @@ See [Listen Fields](/configuration/shared/listen/) for details.
Listen network, one of `tcp` `udp`.
Both if empty.
### UDP NAT Fields
See [UDP NAT Fields](/configuration/shared/udp-nat/) for details.
docs/configuration/inbound/tproxy.zh.md
+13 -1
View File
@@ -1,3 +1,9 @@
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [udp_mapping](/zh/configuration/shared/udp-nat/#udp_mapping)
:material-plus: [udp_filtering](/zh/configuration/shared/udp-nat/#udp_filtering)
:material-plus: [udp_nat_max](/zh/configuration/shared/udp-nat/#udp_nat_max)
!!! quote ""
仅支持 Linux。
@@ -11,7 +17,9 @@
... // 监听字段
"network": "udp"
"network": "udp",
... // UDP NAT 字段
}
```
@@ -26,3 +34,7 @@
监听的网络协议，`tcp` `udp` 之一。
默认所有。
### UDP NAT 字段
参阅 [UDP NAT 字段](/zh/configuration/shared/udp-nat/)。
docs/configuration/inbound/tuic.md
+8 -2
View File
@@ -18,7 +18,9 @@
"auth_timeout": "3s",
"zero_rtt_handshake": false,
"heartbeat": "10s",
"tls": {}
"tls": {},
... // QUIC Fields
}
```
@@ -75,4 +77,8 @@ Interval for sending heartbeat packets for keeping the connection alive
==Required==
TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
### QUIC Fields
See [QUIC Fields](/configuration/shared/quic/) for details.
docs/configuration/inbound/tuic.zh.md
+8 -2
View File
@@ -18,7 +18,9 @@
"auth_timeout": "3s",
"zero_rtt_handshake": false,
"heartbeat": "10s",
"tls": {}
"tls": {},
... // QUIC 字段
}
```
@@ -75,4 +77,8 @@ QUIC 拥塞控制算法
==必填==
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#入站)。
TLS 配置, 参阅 [TLS](/zh/configuration/shared/tls/#入站)。
### QUIC 字段
参阅 [QUIC 字段](/zh/configuration/shared/quic/) 了解详情。
docs/configuration/inbound/tun.md
+112 -9
View File
@@ -4,8 +4,14 @@ icon: material/new-box
!!! quote "Changes in sing-box 1.14.0"
:material-plus: [include_mac_address](#include_mac_address)
:material-plus: [exclude_mac_address](#exclude_mac_address)
:material-plus: [include_mac_address](#include_mac_address)
:material-plus: [exclude_mac_address](#exclude_mac_address)
:material-plus: [dns_mode](#dns_mode)
:material-plus: [dns_address](#dns_address)
:material-plus: [netns](#netns)
:material-plus: [udp_mapping](/configuration/shared/udp-nat/#udp_mapping)
:material-plus: [udp_filtering](/configuration/shared/udp-nat/#udp_filtering)
:material-plus: [udp_nat_max](/configuration/shared/udp-nat/#udp_nat_max)
!!! quote "Changes in sing-box 1.13.3"
@@ -73,6 +79,11 @@ icon: material/new-box
"fdfe:dcba:9876::1/126"
],
"mtu": 9000,
"dns_mode": "hijack",
"dns_address": [
"172.18.0.2",
"fdfe:dcba:9876::2"
],
"auto_route": true,
"iproute2_table_index": 2022,
"iproute2_rule_index": 9000,
@@ -104,7 +115,9 @@ icon: material/new-box
"geoip-cn"
],
"endpoint_independent_nat": false,
"udp_timeout": "5m",
... // UDP NAT Fields
"stack": "system",
"include_interface": [
"lan0"
@@ -134,6 +147,12 @@ icon: material/new-box
"exclude_package": [
"com.android.captiveportallogin"
],
"include_mac_address": [
"00:11:22:33:44:55"
],
"exclude_mac_address": [
"66:77:88:99:aa:bb"
],
"platform": {
"http_proxy": {
"enabled": false,
@@ -184,6 +203,22 @@ icon: material/new-box
Virtual device name, automatically selected if empty.
#### netns
!!! question "Since sing-box 1.14.0"
!!! quote ""
Only supported on Linux.
Create the tun interface in the specified network namespace, name, path, or the tag of a
[network namespace](/configuration/network-namespace/).
When set, `auto_route` and `auto_redirect` operate inside the namespace, and no root privilege is
required if the namespace is owned by the current user.
Conflict with `platform`.
#### address
!!! question "Since sing-box 1.10.0"
@@ -210,6 +245,52 @@ IPv6 prefix for the tun interface.
The maximum transmission unit.
#### dns_mode
!!! question "Since sing-box 1.14.0"
How DNS is handled on the TUN interface.
| Mode | Description |
|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `disabled` | Do not configure native DNS and do not hijack DNS traffic. |
| `native` | Set the platform's native interface DNS where possible: per-interface DNS on Windows and Apple platforms, and `systemd-resolved` interface DNS on Linux. |
| `hijack` | Same as `native`, with additional port 53 hijacking described below. Used by default. |
`hijack` adds the following on top of `native`:
*On Linux*: only DNS sent to non-local destinations can be intercepted.
Traffic destined to addresses on the host's own interfaces (such as
`127.0.0.53` or the host's LAN-side IP) is delivered through the kernel
`local` routing table before any user rule applies, and `OUTPUT` NAT cannot
redirect packets going through `lo`.
- Without `auto_redirect`, an `iproute2` rule makes port 53 skip the `main`
table's specific-route lookup, forcing DNS that would otherwise be
delivered through a directly-attached subnet through the TUN. Destination
addresses are not rewritten.
- With `auto_redirect`, an nftables rule DNATs port 53 traffic directly to
[`dns_address`](#dns_address).
*On Windows with [`strict_route`](#strict_route)*: a WFP filter blocks port
53 traffic going through interfaces other than the TUN.
#### dns_address
!!! question "Since sing-box 1.14.0"
List of DNS server addresses used by [`dns_mode`](#dns_mode).
When unset, sing-box derives one address per family by taking the next IP after
the first IPv4/IPv6 entry in [`address`](#address). Connections toward those
derived addresses are additionally hijacked into the sing-box DNS module,
equivalent to a [`hijack-dns`](/configuration/route/rule_action/#hijack-dns)
route action; this preserves the behaviour from before this option was added.
When set, this auto-hijack is not applied; configure an explicit
[`hijack-dns`](/configuration/route/rule_action/#hijack-dns) route rule if the
behaviour is still required.
#### gso
!!! failure "Deprecated in sing-box 1.11.0"
@@ -477,12 +558,6 @@ Enable endpoint-independent NAT.
Performance may degrade slightly, so it is not recommended to enable on when it is not needed.
#### udp_timeout
UDP NAT expiration time.
`5m` will be used by default.
#### stack
!!! quote "Changes in sing-box 1.8.0"
@@ -560,6 +635,30 @@ Limit android packages in route.
Exclude android packages in route.
#### include_mac_address
!!! question "Since sing-box 1.14.0"
!!! quote ""
Only supported on Linux with `auto_route` and `auto_redirect` enabled.
Limit MAC addresses in route. Not limited by default.
Conflict with `exclude_mac_address`.
#### exclude_mac_address
!!! question "Since sing-box 1.14.0"
!!! quote ""
Only supported on Linux with `auto_route` and `auto_redirect` enabled.
Exclude MAC addresses in route.
Conflict with `include_mac_address`.
#### platform
Platform-specific settings, provided by client applications.
@@ -600,6 +699,10 @@ Hostnames that bypass the HTTP proxy.
Hostnames that use the HTTP proxy.
### UDP NAT Fields
See [UDP NAT Fields](/configuration/shared/udp-nat/) for details.
### Listen Fields
See [Listen Fields](/configuration/shared/listen/) for details.
docs/configuration/inbound/tun.zh.md
+107 -7
View File
@@ -2,6 +2,17 @@
icon: material/new-box
---
!!! quote "sing-box 1.14.0 中的更改"
:material-plus: [include_mac_address](#include_mac_address)
:material-plus: [exclude_mac_address](#exclude_mac_address)
:material-plus: [dns_mode](#dns_mode)
:material-plus: [dns_address](#dns_address)
:material-plus: [netns](#netns)
:material-plus: [udp_mapping](/zh/configuration/shared/udp-nat/#udp_mapping)
:material-plus: [udp_filtering](/zh/configuration/shared/udp-nat/#udp_filtering)
:material-plus: [udp_nat_max](/zh/configuration/shared/udp-nat/#udp_nat_max)
!!! quote "sing-box 1.13.3 中的更改"
:material-alert: [strict_route](#strict_route)
@@ -68,6 +79,11 @@ icon: material/new-box
"fdfe:dcba:9876::1/126"
],
"mtu": 9000,
"dns_mode": "hijack",
"dns_address": [
"172.18.0.2",
"fdfe:dcba:9876::2"
],
"auto_route": true,
"iproute2_table_index": 2022,
"iproute2_rule_index": 9000,
@@ -100,7 +116,9 @@ icon: material/new-box
"geoip-cn"
],
"endpoint_independent_nat": false,
"udp_timeout": "5m",
... // UDP NAT 字段
"stack": "system",
"include_interface": [
"lan0"
@@ -130,6 +148,12 @@ icon: material/new-box
"exclude_package": [
"com.android.captiveportallogin"
],
"include_mac_address": [
"00:11:22:33:44:55"
],
"exclude_mac_address": [
"66:77:88:99:aa:bb"
],
"platform": {
"http_proxy": {
"enabled": false,
@@ -181,6 +205,20 @@ icon: material/new-box
虚拟设备名称，默认自动选择。
#### netns
!!! question "自 sing-box 1.14.0 起"
!!! quote ""
仅支持 Linux。
在指定的网络命名空间中创建 tun 接口，可以是名称、路径，或[网络命名空间](/zh/configuration/network-namespace/)的标签。
设置后，`auto_route` 和 `auto_redirect` 在该命名空间内生效；若命名空间归当前用户所有，则无需 root 权限。
与 `platform` 冲突。
#### address
!!! question "自 sing-box 1.10.0 起"
@@ -211,6 +249,46 @@ tun 接口的 IPv6 前缀。
最大传输单元。
#### dns_mode
!!! question "自 sing-box 1.14.0 起"
TUN 接口上 DNS 的处理方式。
| 模式 | 描述 |
|------------|-------------------------------------------------------------------------------------------------------|
| `disabled` | 不设置原生 DNS，也不劫持 DNS 流量。 |
| `native` | 尽可能设置平台的原生接口 DNS：Windows 与 Apple 上的接口 DNS，Linux 上的 `systemd-resolved` 接口 DNS。 |
| `hijack` | 与 `native` 相同，并额外执行下文所述的 53 端口劫持。默认使用。 |
`hijack` 在 `native` 之上额外执行：
*Linux*：只能劫持发往非本机地址的 DNS。发往本机接口地址（如 `127.0.0.53`
或本机 LAN 接口 IP）的流量由内核 `local` 路由表在所有用户规则之前直接交付，
`OUTPUT` 链 NAT 也无法对走 `lo` 的包生效。
- 未启用 `auto_redirect` 时：通过 `iproute2` 规则让 53 端口跳过 `main` 表的
具体路由查找，把本来会经直连子网直接送达的 DNS 改走 TUN —— 不重写目的地址。
- 启用 `auto_redirect` 时：通过 nftables 规则将 53 端口流量直接 DNAT 至
[`dns_address`](#dns_address)。
*Windows 启用 [`strict_route`](#strict_route) 时*：通过 WFP 过滤器阻止经由非
TUN 接口的 53 端口流量。
#### dns_address
!!! question "自 sing-box 1.14.0 起"
[`dns_mode`](#dns_mode) 使用的 DNS 服务器地址列表。
未设置时，sing-box 会按地址族在 [`address`](#address) 的第一个 IPv4/IPv6
条目后面取下一个 IP 作为 DNS 服务器地址，并将流向这些推导地址的连接额外劫持到
sing-box DNS 模块，等价于一条
[`hijack-dns`](/zh/configuration/route/rule_action/#hijack-dns) 路由动作；这与此选项加入之前的行为一致。
设置后，将不再自动劫持；如仍需此行为，请显式配置
[`hijack-dns`](/zh/configuration/route/rule_action/#hijack-dns) 路由规则。
#### gso
!!! failure "已在 sing-box 1.11.0 废弃"
@@ -460,12 +538,6 @@ tun 接口的 IPv6 前缀。
性能可能会略有下降，所以不建议在不需要的时候开启。
#### udp_timeout
UDP NAT 过期时间。
默认使用 `5m`。
#### stack
!!! quote "sing-box 1.8.0 中的更改"
@@ -543,6 +615,30 @@ TCP/IP 栈。
排除路由的 Android 应用包名。
#### include_mac_address
!!! question "自 sing-box 1.14.0 起"
!!! quote ""
仅支持 Linux，且需要 `auto_route` 和 `auto_redirect` 已启用。
限制被路由的 MAC 地址。默认不限制。
与 `exclude_mac_address` 冲突。
#### exclude_mac_address
!!! question "自 sing-box 1.14.0 起"
!!! quote ""
仅支持 Linux，且需要 `auto_route` 和 `auto_redirect` 已启用。
排除路由的 MAC 地址。
与 `include_mac_address` 冲突。
#### platform
平台特定的设置，由客户端应用提供。
@@ -583,6 +679,10 @@ TCP/IP 栈。
代理的主机名列表。
### UDP NAT 字段
参阅 [UDP NAT 字段](/zh/configuration/shared/udp-nat/)。
### 监听字段
参阅 [监听字段](/zh/configuration/shared/listen/)。