search

SagerNet / sing-box

The universal proxy platform
https://sing-box.sagernet.org/
Other
16.6k stars 2.02k forks source link

【求助】我在使用singbox做透明代理，局域网机器指向后无法上网 #1413

Closed phonezhou closed 5 months ago

phonezhou commented 5 months ago

Operating system

Linux

System version

ubuntu22.04

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

sing-box 1.84

Version

{
  "dns": {
    "servers": [
      {
        "tag": "dns_proxy",
        "address": "https://1.1.1.1/dns-query",
        "address_resolver": "dns_resolver",
        "strategy": "ipv4_only",
        "detour": "select"
      },
      {
        "tag": "dns_direct",
        "address": "h3://dns.alidns.com/dns-query",
        "address_resolver": "dns_resolver",
        "strategy": "ipv4_only",
        "detour": "direct"
      },
      {
        "tag": "dns_block",
        "address": "rcode://refused"
      },
      {
        "tag": "dns_resolver",
        "address": "223.5.5.5",
        "strategy": "ipv4_only",
        "detour": "direct"
      }
    ],
    "rules": [
      {
        "outbound": "any",
        "server": "dns_resolver"
      },
      {
        "clash_mode": "direct",
        "server": "dns_direct"
      },
      {
        "clash_mode": "global",
        "server": "dns_proxy"
      },
      {
        "process_name": [
          "TencentMeeting",
          "NemoDesktop",
          "ToDesk",
          "ToDesk_Service",
          "WeChat",
          "Tailscale",
          "wireguard-go",
          "Tunnelblick",
          "softwareupdated",
          "kubectl"
        ],
        "server": "dns_direct"
      },
      {
        "domain_suffix": [
          "icloudnative.io",
          "fuckcloudnative.io",
          "sealos.io",
          "cdn.jsdelivr.us"
        ],
        "server": "dns_direct"
      },
      {
        "process_name": [
          "DropboxMacUpdate",
          "Dropbox"
        ],
        "server": "dns_proxy"
      },
      {
        "package_name": [
          "com.google.android.youtube",
          "com.android.vending",
          "org.telegram.messenger",
          "org.telegram.plus"
        ],
        "server": "dns_proxy"
      },
      {
        "rule_set": "geosite-geolocation-!cn",
        "server": "dns_proxy"
      },
      {
        "rule_set": "Global",
        "server": "dns_proxy"
      },
      {
        "rule_set": [
          "YouTube",
          "Telegram",
          "Netflix",
          "geoip-google",
          "geoip-telegram",
          "geoip-twitter",
          "geoip-netflix"
        ],
        "server": "dns_proxy"
      }
    ],
    "final": "dns_direct"
  },
  "ntp": {
    "enabled": true,
    "server": "time.apple.com",
    "server_port": 123,
    "interval": "30m0s",
    "detour": "direct"
  },
  "inbounds": [
    {
      "type": "tun",
      "inet4_address": "198.18.0.1/16",
      "auto_route": true,
      "exclude_package": [
        "cmb.pb",
        "cn.gov.pbc.dcep",
        "com.MobileTicket",
        "com.adguard.android",
        "com.ainemo.dragoon",
        "com.alibaba.android.rimet",
        "com.alicloud.databox",
        "com.amazing.cloudisk.tv",
        "com.autonavi.minimap",
        "com.bilibili.app.in",
        "com.bishua666.luxxx1",
        "com.cainiao.wireless",
        "com.chebada",
        "com.chinamworld.main",
        "com.cmbchina.ccd.pluto.cmbActivity",
        "com.coolapk.market",
        "com.ctrip.ct",
        "com.dianping.v1",
        "com.douban.frodo",
        "com.eg.android.AlipayGphone",
        "com.farplace.qingzhuo",
        "com.hanweb.android.zhejiang.activity",
        "com.leoao.fitness",
        "com.lucinhu.bili_you",
        "com.mikrotik.android.tikapp",
        "com.moji.mjweather",
        "com.motorola.cn.calendar",
        "com.motorola.cn.lrhealth",
        "com.netease.cloudmusic",
        "com.sankuai.meituan",
        "com.sina.weibo",
        "com.smartisan.notes",
        "com.sohu.inputmethod.sogou.moto",
        "com.sonelli.juicessh",
        "com.ss.android.article.news",
        "com.ss.android.lark",
        "com.ss.android.ugc.aweme",
        "com.tailscale.ipn",
        "com.taobao.idlefish",
        "com.taobao.taobao",
        "com.tencent.mm",
        "com.tencent.mp",
        "com.tencent.soter.soterserver",
        "com.tencent.wemeet.app",
        "com.tencent.weread",
        "com.tencent.wework",
        "com.ttxapps.wifiadb",
        "com.unionpay",
        "com.unnoo.quan",
        "com.wireguard.android",
        "com.xingin.xhs",
        "com.xunmeng.pinduoduo",
        "com.zui.zhealthy",
        "ctrip.android.view",
        "io.kubenav.kubenav",
        "org.geekbang.geekTime",
        "tv.danmaku.bili"
      ],
      "stack": "mixed",
      "sniff": true
    },
    {
      "type": "socks",
      "tag": "socks-in",
      "listen": "::",
      "listen_port": 5353
    }
  ],
  "outbounds": [
    {
      "type": "selector",
      "tag": "select",
      "outbounds": [
        "ali_vmess"
      ],
      "default": "ali_vmess"
    },
    {
      "type": "selector",
      "tag": "openai",
      "outbounds": [
        "v2link-ss-jp"
      ],
      "default": "v2link-ss-jp"
    },
    {
      "type": "selector",
      "tag": "twitter",
      "outbounds": [
        "aws_hy2"
      ],
      "default": "aws_hy2"
    },
    {
      "type": "selector",
      "tag": "tiktok",
      "outbounds": [
        "ali_vmess"
      ],
      "default": "ali_vmess"
    },

    {
      "type": "hysteria2",
      "tag": "aws_hy2",
      "server": "xxx",
      "server_port": 8443,
      "up_mbps": 100,
      "down_mbps": 100,
      "password": "XWubxEMuwikQGuKS7mVeEQ==",
      "network": "tcp",
      //"ignore_client_bandwidth": false,
      "tls": {
          "enabled": true,
          "insecure": true
          //"certificate_path": "/etc/sing-box/cert.pem"
      },
      //"masquerade": "https://bing.com",
      "brutal_debug": false
    },
    {
      "type": "shadowsocks",
      "tag": "v2link-ss-jp",

      "server": "xxxx",
      "server_port": 30601,
      "method": "chacha20-ietf-poly1305",
      "password": "b35a9175-f4dc-4bb2-8c7d-05983e8f8952",

      "network": "udp",
      "multiplex": {}

    },

    {
      "type": "vmess",
      "tag": "ali_vmess",

      "server": "xxx",
      "server_port": 18888,
      "uuid": "7eb15b73-22b4-49c2-a2bf-35473e99baff",
      "security": "none",
      "alter_id": 0,
      "global_padding": false,
      "authenticated_length": true,
      "network": "tcp",
      "tls": {},
      "packet_encoding": "",
      "multiplex": {},
      "transport": {
          "type": "ws",
          "path": "/ray",
          "headers": {},
          "max_early_data": 0,
          "early_data_header_name": ""
      }
    },

    {
      "type": "direct",
      "tag": "direct"
    },
    {
      "type": "block",
      "tag": "block"
    },
    {
      "type": "dns",
      "tag": "dns-out"
    }
  ],
  "route": {
    "rules": [
      {
        "protocol": "dns",
        "outbound": "dns-out"
      },
      {
        "clash_mode": "direct",
        "outbound": "direct"
      },
      {
        "clash_mode": "global",
        "outbound": "select"
      },
      {
        "domain_suffix": [
          "icloudnative.io",
          "fuckcloudnative.io",
          "sealos.io",
          "cdn.jsdelivr.us"
        ],
        "outbound": "direct"
      },
      {
        "process_name": [
          "TencentMeeting",
          "NemoDesktop",
          "ToDesk",
          "ToDesk_Service",
          "WeChat",
          "OpenLens",
          "Tailscale",
          "wireguard-go",
          "Tunnelblick",
          "softwareupdated",
          "kubectl"
        ],
        "outbound": "direct"
      },
      {
        "protocol": "quic",
        "outbound": "block"
      },
      {
        "inbound": "socks-in",
        "outbound": "select"
      },
      {
        "rule_set": [
          "WeChat",
          "Bilibili"
        ],
        "outbound": "direct"
      },
      {
        "rule_set": "OpenAI",
        "outbound": "openai"
      },
      {
        "domain_suffix": [
          "openai.com",
          "oaistatic.com",
          "oaiusercontent.com"
        ],
        "outbound": "openai"
      },
      {
        "package_name": "com.openai.chatgpt",
        "outbound": "openai"
      },
      {
        "rule_set": "TikTok",
        "outbound": "tiktok"
      },
      {
        "package_name": "com.zhiliaoapp.musically",
        "outbound": "tiktok"
      },
      {
        "domain_suffix": [
          "depay.one",
          "orbstack.dev"
        ],
        "outbound": "select"
      },
      {
        "process_name": [
          "DropboxMacUpdate",
          "Dropbox"
        ],
        "outbound": "select"
      },
      {
        "package_name": [
          "com.google.android.youtube",
          "com.android.vending",
          "org.telegram.messenger",
          "org.telegram.plus",
          "com.google.android.googlequicksearchbox",
          "app.rvx.android.youtube",
          "com.mudvod.video",
          "com.fox2code.mmm",
          "com.twitter.android"
        ],
        "outbound": "select"
      },
      {
        "domain": "accounts.google.com",
        "domain_suffix": [
          "sourceforge.net",
          "fhjasokiwq.com"
        ],
        "outbound": "select"
      },
      {
        "domain_suffix": "cloud.sealos.io",
        "outbound": "direct"
      },
      {
        "type": "logical",
        "mode": "and",
        "rules": [
          {
            "rule_set": "geosite-geolocation-!cn"
          },
          {
            "rule_set": "geoip-cn",
            "invert": true
          }
        ],
        "outbound": "select"
      },
      {
        "rule_set": "Global",
        "outbound": "select"
      },
      {
        "rule_set": "geoip-cn",
        "outbound": "direct"
      },
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "YouTube",
          "Telegram",
          "Netflix",
          "geoip-google",
          "geoip-telegram",
          "geoip-twitter",
          "geoip-netflix"
        ],
        "outbound": "select"
      }
    ],
    "rule_set": [
      {
        "type": "remote",
        "tag": "geosite-geolocation-!cn",
        "format": "binary",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "geoip-cn",
        "format": "binary",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/CHIZI-0618/v2ray-rules-dat/release/singbox_ip_rule_set/geoip-cn.srs",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "geoip-google",
        "format": "binary",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/CHIZI-0618/v2ray-rules-dat/release/singbox_ip_rule_set/geoip-google.srs",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "geoip-telegram",
        "format": "binary",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/CHIZI-0618/v2ray-rules-dat/release/singbox_ip_rule_set/geoip-telegram.srs",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "geoip-twitter",
        "format": "binary",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/CHIZI-0618/v2ray-rules-dat/release/singbox_ip_rule_set/geoip-twitter.srs",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "geoip-netflix",
        "format": "binary",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/CHIZI-0618/v2ray-rules-dat/release/singbox_ip_rule_set/geoip-netflix.srs",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "Global",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/Global.json",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "YouTube",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/YouTube.json",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "OpenAI",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/OpenAI.json",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "TikTok",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/TikTok.json",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "Telegram",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/Telegram.json",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "Netflix",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/Netflix.json",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "WeChat",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/WeChat.json",
        "download_detour": "direct"
      },
      {
        "type": "remote",
        "tag": "Bilibili",
        "format": "source",
        "url": "https://mirror.ghproxy.com/https://raw.githubusercontent.com/yangchuansheng/sing-box-geosite/main/rule/Bilibili.json",
        "download_detour": "direct"
      }
    ],
    "final": "direct",
    "find_process": true,
    "auto_detect_interface": true
    //"default_interface": "ens18"
  },
  "experimental": {
    "cache_file": {
      "enabled": true
    },
    "clash_api": {
      "external_controller": "0.0.0.0:9090",
      "external_ui": "metacubexd",
      "external_ui_download_url": "https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip",
      "external_ui_download_detour": "select",
      "secret" : "2288127w",
      "default_mode": "rule"
    }
  }
}

Description

我在使用sing-box做透明代理，配置好后，运行没有报错，但局域网机器把网关和DNS指向sing-box机器后，无法上网，大神们提供个排查方向吧。

拓扑：PVE下面虚拟 光猫->ikuai主路由->ubuntu(singbox)->客户端

ubuntu22.04清况 1.IP转发已开 echo 1 > /proc/sys/net/ipv4/ip_forward 2.nftables清空 3.tun模式代理

客户机win10（192.168.1.4） 1.CN网无法上 2.Google外网无法上 3.nslookup 获取不了 IP 4.微信能收到信息,那应该是UDP没有问题 5.在metacubexd看，是有192.168.1.4的链接

请问这个情况我应该怎么排查，大神们提供个排查方向吧！感谢

Reproduction

拓扑：PVE下面虚拟 光猫->ikuai主路由->ubuntu(singbox)->客户端

ubuntu22.04清况 1.IP转发已开 echo 1 > /proc/sys/net/ipv4/ip_forward 2.nftables清空 3.tun模式代理

客户机win10（192.168.1.4） 1.CN网无法上 2.Google外网无法上 3.nslookup 获取不了 IP 4.微信能收到信息,那应该是UDP没有问题 5.在metacubexd看，是有192.168.1.4的链接

请问这个情况我应该怎么排查，大神们提供个排查方向吧！感谢

Logs

No response

Integrity requirements

debiansid commented 5 months ago

换tproxy

bumprat commented 4 months ago

以下解决方案在ubuntu测试有效： Linux下sing-box tun模式的DNS解析，在systemd-resolved服务之后。默认情况下systemd-resolved提供的DNS服务只监听127.0.0.53:53，而且即使你使用iptables把传入DNS请求转发到127.0.0.53也会被拒绝，因为默认设置下这个DNS服务要验证源IP地址是否为本地地址。这样就造成，客户端配置DNS地址为sing-box所在服务器地址，但是DNS解析失败的情况。有些客户端（如安卓手机）看似DNS解析成功，但其实是IPv6 DNS成功（因为无法配置，没有指向sing-box所在服务器），IPv4 DNS是失败的。

你可以试一试运行nslookup baidu.com 127.0.0.53应该有结果，但是nslookup baidu.com 127.0.0.1却没有结果。

如果想要让这个DNS服务监听其他主机的DNS请求，需要以管理员权限修改配置文件/etc/systemd/resolved.conf，在文件下面的配置部分增加两行：

DNSStubListenerExtra=0.0.0.0
DNSStubListenerExtra=::

意思是让DNS服务对任意IPv4和IPv6地址开放，然后重启systemd-resolved服务

sudo systemctl restart systemd-resolved

这样systemd-resolved就会接受并答复所有IPv4和IPv6的传入DNS请求，满足透明代理的DNS配置要求。在另一台主机（客户端）上验证：

$ nslookup baidu.com x.x.x.x #x.x.x.x为sing-box所在服务器地址。
Server:         x.x.x.x
Address:        x.x.x.x#53

Non-authoritative answer:
Name:   baidu.com
Address: ??.??.??.??

可以查看sing-box日志journalctl -xfu sing-box，确认接收到dns查询请求。

安全性和高效性矛盾：即使你按照上述做法成功了，依然存在安卓手机无法配置IPv6 DNS地址，造成IPv6 DNS查询泄露的问题。关闭IPv6又会造成很多优质低延迟IPv6 CDN转发节点无法使用。