search

SagerNet / sing-box

The universal proxy platform
https://sing-box.sagernet.org/
Other
19.43k stars 2.32k forks source link

Protocol sniff not work with quic. #146

Closed Gzxhwq closed 2 years ago

Gzxhwq commented 2 years ago

Welcome

Description of the problem

As document say sing-box can sniff out quic protocol in the stream, so I want to block quic protocol with the protocol sniff & route rule that go through to proxy. But it seems not work as expect.

Version of sing-box

```console $ sing-box version sing-box version v1.1-beta9-9-gb8009d6 Environment: go1.19.2 linux/amd64 Tags: with_quic,with_wireguard,with_utls,with_acme,with_clash_api Revision: b8009d61b2f43f1a774520248d47aa3b667ab36f CGO: disabled ```

Server and client configuration file

```json { "log": { "disabled": false, "level": "debug", "output": "/etc/sing-box/sing-box.log", "timestamp": true }, "dns": { "servers": [ { "tag": "google", "address": "tls://8.8.8.8" }, { "tag": "local", "address": "tls://1.12.12.12", "detour": "direct" } ], "rules": [ { "domain": "mydomain.com", "geosite": "cn", "server": "local" } ], "strategy": "ipv4_only" }, "inbounds": [ { "type": "tun", "inet4_address": "172.19.0.1/30", "auto_route": true, "endpoint_independent_nat": true, "stack": "system", "sniff": true } ], "outbounds": [ { "type": "hysteria", "server": "****************", "server_port": *****, "up_mbps": 35, "down_mbps": 250, "obfs": "***************", "auth": "***************", "tls": { "enabled": true, "disable_sni": true, "server_name": "**************", "alpn": [ "h3" ] } }, { "type": "direct", "tag": "direct" }, { "type": "block", "tag": "block" }, { "type": "dns", "tag": "dns-out" } ], "route": { "rules": [ { "protocol": "dns", "outbound": "dns-out" }, { "geosite": "category-ads-all", "outbound": "block" }, { "geosite": "cn", "geoip": [ "cn", "private" ], "outbound": "direct" }, { "protocol": "quic", "outbound": "block" } ], "auto_detect_interface": true } } ```

Server and client log file

```console +0000 2022-10-10 23:17:36 INFO router: loaded geoip database: 250 codes +0000 2022-10-10 23:17:36 INFO router: loaded geosite database: 1252 codes +0000 2022-10-10 23:17:36 INFO router: updated default interface eth0, index 2 +0000 2022-10-10 23:17:36 INFO inbound/tun[0]: started at tun0 +0000 2022-10-10 23:17:36 INFO clash-api: restful api listening at [::]:9090 +0000 2022-10-10 23:17:36 INFO sing-box started (0.55s) +0000 2022-10-10 23:17:36 INFO [857735995] inbound/tun[0]: inbound connection from 10.10.10.193:10161 +0000 2022-10-10 23:17:36 INFO [857735995] inbound/tun[0]: inbound connection to 8.8.8.8:443 +0000 2022-10-10 23:17:36 DEBUG [857735995] router: sniffed protocol: tls, domain: dns.google.com +0000 2022-10-10 23:17:36 INFO [857735995] outbound/hysteria[HY-out]: outbound connection to 8.8.8.8:443 +0000 2022-10-10 23:17:36 INFO [3801453688] inbound/tun[0]: inbound connection from 10.10.10.193:10172 +0000 2022-10-10 23:17:36 INFO [3801453688] inbound/tun[0]: inbound connection to 142.250.217.99:443 +0000 2022-10-10 23:17:36 DEBUG [3801453688] router: sniffed protocol: tls, domain: www.google.ru +0000 2022-10-10 23:17:36 INFO [3801453688] outbound/hysteria[HY-out]: outbound connection to 142.250.217.99:443 +0000 2022-10-10 23:17:37 INFO [4238048833] inbound/tun[0]: inbound connection from 10.10.10.193:10175 +0000 2022-10-10 23:17:37 INFO [4238048833] inbound/tun[0]: inbound connection to 183.60.220.130:443 +0000 2022-10-10 23:17:37 DEBUG [4238048833] router: sniffed protocol: tls, domain: api.vc.bilibili.com +0000 2022-10-10 23:17:37 DEBUG [4238048833] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:17:37 INFO [4238048833] outbound/direct[direct]: outbound connection to 183.60.220.130:443 +0000 2022-10-10 23:17:37 INFO [1630927881] inbound/tun[0]: inbound connection from 10.10.10.193:10180 +0000 2022-10-10 23:17:37 INFO [1630927881] inbound/tun[0]: inbound connection to 142.250.217.99:443 +0000 2022-10-10 23:17:37 INFO [382415078] inbound/tun[0]: inbound connection from 10.10.10.193:10181 +0000 2022-10-10 23:17:37 INFO [1679636077] inbound/tun[0]: inbound connection from 10.10.10.193:10182 +0000 2022-10-10 23:17:37 INFO [1679636077] inbound/tun[0]: inbound connection to 149.154.175.55:443 +0000 2022-10-10 23:17:37 INFO [382415078] inbound/tun[0]: inbound connection to 149.154.175.51:443 +0000 2022-10-10 23:17:37 INFO [382415078] outbound/hysteria[HY-out]: outbound connection to 149.154.175.51:443 +0000 2022-10-10 23:17:37 INFO [1679636077] outbound/hysteria[HY-out]: outbound connection to 149.154.175.55:443 +0000 2022-10-10 23:17:37 INFO [1576983674] inbound/tun[0]: inbound connection from 10.10.10.193:10184 +0000 2022-10-10 23:17:37 INFO [1576983674] inbound/tun[0]: inbound connection to 149.154.175.55:80 +0000 2022-10-10 23:17:37 INFO [4177006624] inbound/tun[0]: inbound connection from 10.10.10.193:10183 +0000 2022-10-10 23:17:37 INFO [4177006624] inbound/tun[0]: inbound connection to 149.154.175.51:80 +0000 2022-10-10 23:17:37 DEBUG [1630927881] router: sniffed protocol: tls, domain: www.google.ru +0000 2022-10-10 23:17:37 INFO [1630927881] outbound/hysteria[HY-out]: outbound connection to 142.250.217.99:443 +0000 2022-10-10 23:17:37 INFO [3866792066] inbound/tun[0]: inbound connection from 10.10.10.193:10185 +0000 2022-10-10 23:17:37 INFO [3866792066] inbound/tun[0]: inbound connection to 91.108.56.134:443 +0000 2022-10-10 23:17:37 DEBUG [1576983674] router: sniffed protocol: http, domain: 149.154.175.55:80 +0000 2022-10-10 23:17:37 INFO [1576983674] outbound/hysteria[HY-out]: outbound connection to 149.154.175.55:80 +0000 2022-10-10 23:17:37 INFO [3866792066] outbound/hysteria[HY-out]: outbound connection to 91.108.56.134:443 +0000 2022-10-10 23:17:37 DEBUG [4177006624] router: sniffed protocol: http, domain: 149.154.175.51:80 +0000 2022-10-10 23:17:37 INFO [4177006624] outbound/hysteria[HY-out]: outbound connection to 149.154.175.51:80 +0000 2022-10-10 23:17:37 INFO [3908888835] inbound/tun[0]: inbound connection from 10.10.10.193:10186 +0000 2022-10-10 23:17:37 INFO [3908888835] inbound/tun[0]: inbound connection to 91.108.56.134:80 +0000 2022-10-10 23:17:37 DEBUG [3908888835] router: sniffed protocol: http, domain: 91.108.56.134:80 +0000 2022-10-10 23:17:37 INFO [3908888835] outbound/hysteria[HY-out]: outbound connection to 91.108.56.134:80 +0000 2022-10-10 23:17:37 DEBUG [857735995] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10000: use of closed network connection +0000 2022-10-10 23:17:37 DEBUG [3801453688] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10001: use of closed network connection +0000 2022-10-10 23:17:37 DEBUG [3908888835] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10010: use of closed network connection +0000 2022-10-10 23:17:37 DEBUG [382415078] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10005: use of closed network connection +0000 2022-10-10 23:17:37 DEBUG [4177006624] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10008: use of closed network connection +0000 2022-10-10 23:17:37 DEBUG [1576983674] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10007: use of closed network connection +0000 2022-10-10 23:17:37 DEBUG [1679636077] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10006: use of closed network connection +0000 2022-10-10 23:17:37 DEBUG [1630927881] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10004: use of closed network connection +0000 2022-10-10 23:17:37 INFO [4233825981] inbound/tun[0]: inbound connection from 10.10.10.193:10179 +0000 2022-10-10 23:17:37 INFO [4233825981] inbound/tun[0]: inbound connection to 183.60.220.132:443 +0000 2022-10-10 23:17:37 DEBUG [4233825981] router: sniffed protocol: tls, domain: api.vc.bilibili.com +0000 2022-10-10 23:17:37 DEBUG [4233825981] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:17:37 INFO [4233825981] outbound/direct[direct]: outbound connection to 183.60.220.132:443 +0000 2022-10-10 23:17:38 INFO [2244337517] inbound/tun[0]: inbound connection from 10.10.10.193:10136 +0000 2022-10-10 23:17:38 INFO [2244337517] inbound/tun[0]: inbound connection to 142.250.196.138:443 +0000 2022-10-10 23:17:38 DEBUG [2244337517] router: sniffed protocol: tls, domain: instantmessaging-pa.googleapis.com +0000 2022-10-10 23:17:38 INFO [2244337517] outbound/hysteria[HY-out]: outbound connection to 142.250.196.138:443 +0000 2022-10-10 23:17:38 INFO [4011330395] inbound/tun[0]: inbound connection from 10.10.10.193:10166 +0000 2022-10-10 23:17:38 INFO [4011330395] inbound/tun[0]: inbound connection to 172.217.160.78:443 +0000 2022-10-10 23:17:38 DEBUG [4011330395] router: sniffed protocol: tls, domain: www.youtube.com +0000 2022-10-10 23:17:38 INFO [4011330395] outbound/hysteria[HY-out]: outbound connection to 172.217.160.78:443 +0000 2022-10-10 23:17:38 INFO [3426989148] inbound/tun[0]: inbound connection from 10.10.10.193:10187 +0000 2022-10-10 23:17:38 INFO [3426989148] inbound/tun[0]: inbound connection to 91.108.56.134:443 +0000 2022-10-10 23:17:38 INFO [3426989148] outbound/hysteria[HY-out]: outbound connection to 91.108.56.134:443 +0000 2022-10-10 23:17:38 INFO [2402868406] inbound/tun[0]: inbound connection from 10.10.10.193:10188 +0000 2022-10-10 23:17:38 INFO [2402868406] inbound/tun[0]: inbound connection to 91.108.56.134:80 +0000 2022-10-10 23:17:38 DEBUG [2402868406] router: sniffed protocol: http, domain: 91.108.56.134:80 +0000 2022-10-10 23:17:38 INFO [2402868406] outbound/hysteria[HY-out]: outbound connection to 91.108.56.134:80 +0000 2022-10-10 23:17:38 DEBUG [2402868406] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10017: use of closed network connection +0000 2022-10-10 23:17:38 INFO [2663881473] inbound/tun[0]: inbound connection from 10.10.10.193:10167 +0000 2022-10-10 23:17:38 INFO [2663881473] inbound/tun[0]: inbound connection to 172.217.160.78:443 +0000 2022-10-10 23:17:38 DEBUG [2663881473] router: sniffed protocol: tls, domain: www.youtube.com +0000 2022-10-10 23:17:38 INFO [2663881473] outbound/hysteria[HY-out]: outbound connection to 172.217.160.78:443 +0000 2022-10-10 23:17:38 INFO [721464286] inbound/tun[0]: inbound connection from 10.10.10.193:10189 +0000 2022-10-10 23:17:38 INFO [721464286] inbound/tun[0]: inbound connection to 172.217.175.234:443 +0000 2022-10-10 23:17:38 DEBUG [721464286] router: sniffed protocol: tls, domain: instantmessaging-pa.googleapis.com +0000 2022-10-10 23:17:38 INFO [721464286] outbound/hysteria[HY-out]: outbound connection to 172.217.175.234:443 +0000 2022-10-10 23:17:39 INFO [345056001] inbound/tun[0]: inbound connection from 10.10.10.193:1024 +0000 2022-10-10 23:17:39 INFO [345056001] inbound/tun[0]: inbound connection to 20.198.162.78:443 +0000 2022-10-10 23:17:39 DEBUG [345056001] router: sniffed protocol: tls, domain: client.wns.windows.com +0000 2022-10-10 23:17:39 INFO [345056001] outbound/hysteria[HY-out]: outbound connection to 20.198.162.78:443 +0000 2022-10-10 23:17:39 INFO [817011471] inbound/tun[0]: inbound packet connection from 10.10.10.193:55906 +0000 2022-10-10 23:17:39 INFO [817011471] inbound/tun[0]: inbound packet connection to 172.217.163.54:443 +0000 2022-10-10 23:17:39 INFO [817011471] outbound/hysteria[HY-out]: outbound packet connection to 172.217.163.54:443 +0000 2022-10-10 23:17:40 INFO [3654428069] inbound/tun[0]: inbound connection from 10.10.10.193:10145 +0000 2022-10-10 23:17:40 INFO [3654428069] inbound/tun[0]: inbound connection to 183.60.220.140:443 +0000 2022-10-10 23:17:40 DEBUG [3654428069] router: sniffed protocol: tls, domain: api.vc.bilibili.com +0000 2022-10-10 23:17:40 DEBUG [3654428069] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:17:40 INFO [3654428069] outbound/direct[direct]: outbound connection to 183.60.220.140:443 +0000 2022-10-10 23:17:41 INFO [2129729387] inbound/tun[0]: inbound connection from 10.10.10.193:10190 +0000 2022-10-10 23:17:41 INFO [2129729387] inbound/tun[0]: inbound connection to 162.125.1.17:443 +0000 2022-10-10 23:17:41 DEBUG [2129729387] router: sniffed protocol: tls, domain: dl-debug.dropbox.com +0000 2022-10-10 23:17:41 INFO [2129729387] outbound/hysteria[HY-out]: outbound connection to 162.125.1.17:443 +0000 2022-10-10 23:17:41 INFO [2577661531] inbound/tun[0]: inbound connection from 10.10.10.193:10191 +0000 2022-10-10 23:17:41 INFO [2577661531] inbound/tun[0]: inbound connection to 59.36.226.252:443 +0000 2022-10-10 23:17:41 DEBUG [2577661531] router: sniffed protocol: tls, domain: mssdk.bytedance.com +0000 2022-10-10 23:17:41 DEBUG [2577661531] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:17:41 INFO [2577661531] outbound/direct[direct]: outbound connection to 59.36.226.252:443 +0000 2022-10-10 23:17:42 INFO [660682760] inbound/tun[0]: inbound connection from 10.10.10.193:10147 +0000 2022-10-10 23:17:42 INFO [660682760] inbound/tun[0]: inbound connection to 23.67.33.109:80 +0000 2022-10-10 23:17:42 DEBUG [660682760] router: sniffed protocol: http, domain: www.msftconnecttest.com +0000 2022-10-10 23:17:42 INFO [660682760] outbound/hysteria[HY-out]: outbound connection to 23.67.33.109:80 +0000 2022-10-10 23:17:42 INFO [2480127335] inbound/tun[0]: inbound connection from 10.10.10.193:10148 +0000 2022-10-10 23:17:42 INFO [2480127335] inbound/tun[0]: inbound connection to 23.67.33.109:80 +0000 2022-10-10 23:17:42 DEBUG [2480127335] router: sniffed protocol: http, domain: www.msftconnecttest.com +0000 2022-10-10 23:17:42 INFO [2480127335] outbound/hysteria[HY-out]: outbound connection to 23.67.33.109:80 +0000 2022-10-10 23:17:42 DEBUG [660682760] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10033: use of closed network connection | download: EOF +0000 2022-10-10 23:17:42 DEBUG [2480127335] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10034: use of closed network connection | download: EOF +0000 2022-10-10 23:17:42 INFO [3122258567] inbound/tun[0]: inbound connection from 10.10.10.193:10150 +0000 2022-10-10 23:17:42 INFO [3122258567] inbound/tun[0]: inbound connection to 185.199.108.153:443 +0000 2022-10-10 23:17:42 DEBUG [3122258567] router: sniffed protocol: tls, domain: ublockorigin.github.io +0000 2022-10-10 23:17:42 INFO [3122258567] outbound/hysteria[HY-out]: outbound connection to 185.199.108.153:443 +0000 2022-10-10 23:17:43 INFO [1227481241] inbound/tun[0]: inbound packet connection from 10.10.10.193:51144 +0000 2022-10-10 23:17:43 INFO [1227481241] inbound/tun[0]: inbound packet connection to 142.251.43.4:443 +0000 2022-10-10 23:17:43 INFO [1227481241] outbound/hysteria[HY-out]: outbound packet connection to 142.251.43.4:443 +0000 2022-10-10 23:17:44 INFO [789794300] inbound/tun[0]: inbound connection from 10.10.10.193:10160 +0000 2022-10-10 23:17:44 INFO [789794300] inbound/tun[0]: inbound connection to 216.58.220.138:443 +0000 2022-10-10 23:17:44 DEBUG [789794300] router: sniffed protocol: tls, domain: instantmessaging-pa.googleapis.com +0000 2022-10-10 23:17:44 INFO [789794300] outbound/hysteria[HY-out]: outbound connection to 216.58.220.138:443 +0000 2022-10-10 23:17:44 INFO [1265020833] inbound/tun[0]: inbound packet connection from 10.10.10.193:49344 +0000 2022-10-10 23:17:44 INFO [1265020833] inbound/tun[0]: inbound packet connection to 142.251.42.234:443 +0000 2022-10-10 23:17:44 INFO [1265020833] outbound/hysteria[HY-out]: outbound packet connection to 142.251.42.234:443 +0000 2022-10-10 23:17:45 INFO [2700174859] inbound/tun[0]: inbound packet connection from 10.10.10.193:57230 +0000 2022-10-10 23:17:45 INFO [2700174859] inbound/tun[0]: inbound packet connection to 104.16.123.96:443 +0000 2022-10-10 23:17:45 INFO [2700174859] outbound/hysteria[HY-out]: outbound packet connection to 104.16.123.96:443 +0000 2022-10-10 23:17:45 INFO [2287864816] inbound/tun[0]: inbound packet connection from 10.10.10.193:51443 +0000 2022-10-10 23:17:45 INFO [2287864816] inbound/tun[0]: inbound packet connection to 172.217.163.46:443 +0000 2022-10-10 23:17:45 INFO [2287864816] outbound/hysteria[HY-out]: outbound packet connection to 172.217.163.46:443 +0000 2022-10-10 23:17:47 INFO [3087121693] inbound/tun[0]: inbound connection from 10.10.10.193:10192 +0000 2022-10-10 23:17:47 INFO [3087121693] inbound/tun[0]: inbound connection to 104.16.199.35:443 +0000 2022-10-10 23:17:47 DEBUG [3087121693] router: sniffed protocol: tls, domain: embed.videodelivery.net +0000 2022-10-10 23:17:47 INFO [3087121693] outbound/hysteria[HY-out]: outbound connection to 104.16.199.35:443 +0000 2022-10-10 23:17:47 INFO [4179455879] inbound/tun[0]: inbound connection from 172.19.0.1:53950 +0000 2022-10-10 23:17:47 INFO [4179455879] inbound/tun[0]: inbound connection to 8.8.4.4:853 +0000 2022-10-10 23:17:47 DEBUG [4179455879] router: sniffed protocol: tls +0000 2022-10-10 23:17:47 INFO [4179455879] outbound/hysteria[HY-out]: outbound connection to 8.8.4.4:853 +0000 2022-10-10 23:17:47 INFO [2063346069] inbound/tun[0]: inbound packet connection from 10.10.10.193:56335 +0000 2022-10-10 23:17:47 INFO [2063346069] inbound/tun[0]: inbound packet connection to 142.251.42.238:443 +0000 2022-10-10 23:17:47 INFO [2063346069] outbound/hysteria[HY-out]: outbound packet connection to 142.251.42.238:443 +0000 2022-10-10 23:17:48 INFO [1152810483] inbound/tun[0]: inbound packet connection from 10.10.10.193:59464 +0000 2022-10-10 23:17:48 INFO [1152810483] inbound/tun[0]: inbound packet connection to 104.17.110.184:443 +0000 2022-10-10 23:17:48 INFO [1152810483] outbound/hysteria[HY-out]: outbound packet connection to 104.17.110.184:443 +0000 2022-10-10 23:17:48 INFO [1379843006] inbound/tun[0]: inbound connection from 10.10.10.193:10193 +0000 2022-10-10 23:17:48 INFO [1379843006] inbound/tun[0]: inbound connection to 104.16.94.114:443 +0000 2022-10-10 23:17:48 DEBUG [1379843006] router: sniffed protocol: tls, domain: customer-eq7kiuol0tk9chox.cloudflarestream.com +0000 2022-10-10 23:17:48 INFO [1379843006] outbound/hysteria[HY-out]: outbound connection to 104.16.94.114:443 +0000 2022-10-10 23:17:49 INFO [4172923783] inbound/tun[0]: inbound connection from 10.10.10.193:10194 +0000 2022-10-10 23:17:49 INFO [4172923783] inbound/tun[0]: inbound connection to 151.101.128.176:443 +0000 2022-10-10 23:17:49 DEBUG [4172923783] router: sniffed protocol: tls, domain: js.stripe.com +0000 2022-10-10 23:17:49 INFO [4172923783] outbound/hysteria[HY-out]: outbound connection to 151.101.128.176:443 +0000 2022-10-10 23:17:49 INFO [643928211] inbound/tun[0]: inbound connection from 10.10.10.193:10195 +0000 2022-10-10 23:17:49 INFO [643928211] inbound/tun[0]: inbound connection to 104.18.26.8:443 +0000 2022-10-10 23:17:49 DEBUG [643928211] router: sniffed protocol: tls, domain: gates.cloudflare.com +0000 2022-10-10 23:17:49 INFO [643928211] outbound/hysteria[HY-out]: outbound connection to 104.18.26.8:443 +0000 2022-10-10 23:17:50 INFO [4103253475] inbound/tun[0]: inbound connection from 10.10.10.193:10196 +0000 2022-10-10 23:17:50 INFO [4103253475] inbound/tun[0]: inbound connection to 104.18.2.57:443 +0000 2022-10-10 23:17:50 DEBUG [4103253475] router: sniffed protocol: tls, domain: sparrow.cloudflare.com +0000 2022-10-10 23:17:50 INFO [4103253475] outbound/hysteria[HY-out]: outbound connection to 104.18.2.57:443 +0000 2022-10-10 23:17:50 INFO [2700207955] inbound/tun[0]: inbound connection from 10.10.10.193:10197 +0000 2022-10-10 23:17:50 INFO [2700207955] inbound/tun[0]: inbound connection to 52.34.194.100:443 +0000 2022-10-10 23:17:50 DEBUG [2700207955] router: sniffed protocol: tls, domain: m.stripe.com +0000 2022-10-10 23:17:50 INFO [2700207955] outbound/hysteria[HY-out]: outbound connection to 52.34.194.100:443 +0000 2022-10-10 23:17:50 INFO [3991032928] inbound/tun[0]: inbound connection from 10.10.10.193:10198 +0000 2022-10-10 23:17:50 INFO [3991032928] inbound/tun[0]: inbound connection to 151.101.128.176:443 +0000 2022-10-10 23:17:50 DEBUG [3991032928] router: sniffed protocol: tls, domain: js.stripe.com +0000 2022-10-10 23:17:50 INFO [3991032928] outbound/hysteria[HY-out]: outbound connection to 151.101.128.176:443 +0000 2022-10-10 23:17:50 INFO [2898397583] inbound/tun[0]: inbound connection from 10.10.10.193:10199 +0000 2022-10-10 23:17:50 INFO [2898397583] inbound/tun[0]: inbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 DEBUG [2898397583] router: sniffed protocol: tls, domain: r.stripe.com +0000 2022-10-10 23:17:50 INFO [2898397583] outbound/hysteria[HY-out]: outbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [287224550] inbound/tun[0]: inbound connection from 10.10.10.193:10200 +0000 2022-10-10 23:17:50 INFO [3210308756] inbound/tun[0]: inbound connection from 10.10.10.193:10202 +0000 2022-10-10 23:17:50 INFO [4043624055] inbound/tun[0]: inbound connection from 10.10.10.193:10201 +0000 2022-10-10 23:17:50 INFO [4043624055] inbound/tun[0]: inbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [65247062] inbound/tun[0]: inbound connection from 10.10.10.193:10203 +0000 2022-10-10 23:17:50 INFO [1673859752] inbound/tun[0]: inbound connection from 10.10.10.193:10204 +0000 2022-10-10 23:17:50 INFO [65247062] inbound/tun[0]: inbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [3210308756] inbound/tun[0]: inbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [1673859752] inbound/tun[0]: inbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [287224550] inbound/tun[0]: inbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 DEBUG [287224550] router: sniffed protocol: tls, domain: r.stripe.com +0000 2022-10-10 23:17:50 DEBUG [4043624055] router: sniffed protocol: tls, domain: r.stripe.com +0000 2022-10-10 23:17:50 INFO [287224550] outbound/hysteria[HY-out]: outbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [4043624055] outbound/hysteria[HY-out]: outbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 DEBUG [65247062] router: sniffed protocol: tls, domain: r.stripe.com +0000 2022-10-10 23:17:50 DEBUG [3210308756] router: sniffed protocol: tls, domain: r.stripe.com +0000 2022-10-10 23:17:50 DEBUG [1673859752] router: sniffed protocol: tls, domain: r.stripe.com +0000 2022-10-10 23:17:50 INFO [3210308756] outbound/hysteria[HY-out]: outbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [1673859752] outbound/hysteria[HY-out]: outbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 INFO [65247062] outbound/hysteria[HY-out]: outbound connection to 54.186.23.98:443 +0000 2022-10-10 23:17:50 DEBUG [4043624055] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10059: use of closed network connection +0000 2022-10-10 23:17:50 DEBUG [287224550] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10060: use of closed network connection +0000 2022-10-10 23:17:50 DEBUG [3210308756] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10062: use of closed network connection +0000 2022-10-10 23:17:50 DEBUG [65247062] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10061: use of closed network connection +0000 2022-10-10 23:17:50 DEBUG [1673859752] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10063: use of closed network connection +0000 2022-10-10 23:17:54 DEBUG [3426989148] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10016: use of closed network connection +0000 2022-10-10 23:17:59 INFO [1107873605] inbound/tun[0]: inbound connection from 10.10.10.193:10205 +0000 2022-10-10 23:17:59 INFO [1107873605] inbound/tun[0]: inbound connection to 162.125.85.13:443 +0000 2022-10-10 23:17:59 DEBUG [1107873605] router: sniffed protocol: tls, domain: client.dropbox.com +0000 2022-10-10 23:17:59 INFO [1107873605] outbound/hysteria[HY-out]: outbound connection to 162.125.85.13:443 +0000 2022-10-10 23:18:00 DEBUG [1107873605] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10067: use of closed network connection +0000 2022-10-10 23:18:00 DEBUG [2129729387] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10031: read: connection reset by peer | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10031: use of closed network connection +0000 2022-10-10 23:18:00 DEBUG [4179455879] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10050: use of closed network connection +0000 2022-10-10 23:18:03 INFO [1395632939] inbound/tun[0]: inbound packet connection from 10.10.10.193:53439 +0000 2022-10-10 23:18:03 INFO [1395632939] inbound/tun[0]: inbound packet connection to 203.208.41.98:443 +0000 2022-10-10 23:18:03 DEBUG [1395632939] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:18:03 INFO [1395632939] outbound/direct[direct]: outbound packet connection +0000 2022-10-10 23:18:03 INFO [4274950128] inbound/tun[0]: inbound connection from 10.10.10.193:10206 +0000 2022-10-10 23:18:03 INFO [4274950128] inbound/tun[0]: inbound connection to 35.190.80.1:443 +0000 2022-10-10 23:18:03 DEBUG [4274950128] router: sniffed protocol: tls, domain: a.nel.cloudflare.com +0000 2022-10-10 23:18:03 INFO [4274950128] outbound/hysteria[HY-out]: outbound connection to 35.190.80.1:443 +0000 2022-10-10 23:18:04 INFO [2599128056] inbound/tun[0]: inbound packet connection from 10.10.10.193:53166 +0000 2022-10-10 23:18:04 INFO [2599128056] inbound/tun[0]: inbound packet connection to 35.190.80.1:443 +0000 2022-10-10 23:18:04 INFO [2599128056] outbound/hysteria[HY-out]: outbound packet connection to 35.190.80.1:443 +0000 2022-10-10 23:18:04 INFO [3572379111] inbound/tun[0]: inbound packet connection from 10.10.10.193:59567 +0000 2022-10-10 23:18:04 INFO [3572379111] inbound/tun[0]: inbound packet connection to 142.251.42.225:443 +0000 2022-10-10 23:18:04 INFO [3572379111] outbound/hysteria[HY-out]: outbound packet connection to 142.251.42.225:443 +0000 2022-10-10 23:18:05 INFO [3836528466] inbound/tun[0]: inbound connection from 10.10.10.193:10207 +0000 2022-10-10 23:18:05 INFO [3836528466] inbound/tun[0]: inbound connection to 59.36.206.8:80 +0000 2022-10-10 23:18:05 INFO [913373707] inbound/tun[0]: inbound connection from 10.10.10.193:10208 +0000 2022-10-10 23:18:05 INFO [913373707] inbound/tun[0]: inbound connection to 111.63.147.88:443 +0000 2022-10-10 23:18:05 DEBUG [3836528466] router: sniffed protocol: http, domain: list3.ppstream.com.iqiyi.com +0000 2022-10-10 23:18:05 DEBUG [3836528466] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:18:05 INFO [3836528466] outbound/direct[direct]: outbound connection to 59.36.206.8:80 +0000 2022-10-10 23:18:05 DEBUG [913373707] router: sniffed protocol: tls, domain: uaa.if.iqiyi.com +0000 2022-10-10 23:18:05 DEBUG [913373707] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:18:05 INFO [913373707] outbound/direct[direct]: outbound connection to 111.63.147.88:443 +0000 2022-10-10 23:18:05 DEBUG [3836528466] inbound/tun[0]: connection closed: upload: readfrom tcp 10.10.10.202:44628->59.36.206.8:80: use of closed network connection +0000 2022-10-10 23:18:05 DEBUG [913373707] inbound/tun[0]: connection closed: upload: readfrom tcp 10.10.10.202:41214->111.63.147.88:443: use of closed network connection +0000 2022-10-10 23:18:05 INFO [3255878906] inbound/tun[0]: inbound packet connection from 10.10.10.193:51102 +0000 2022-10-10 23:18:05 INFO [3255878906] inbound/tun[0]: inbound packet connection to 142.251.42.234:443 +0000 2022-10-10 23:18:05 INFO [3255878906] outbound/hysteria[HY-out]: outbound packet connection to 142.251.42.234:443 +0000 2022-10-10 23:18:08 INFO [1356634204] inbound/tun[0]: inbound packet connection from 10.10.10.193:58653 +0000 2022-10-10 23:18:08 INFO [1356634204] inbound/tun[0]: inbound packet connection to 142.251.90.39:443 +0000 2022-10-10 23:18:08 INFO [1356634204] outbound/hysteria[HY-out]: outbound packet connection to 142.251.90.39:443 +0000 2022-10-10 23:18:08 INFO [2603977081] inbound/tun[0]: inbound connection from 10.10.10.193:10209 +0000 2022-10-10 23:18:08 INFO [2603977081] inbound/tun[0]: inbound connection to 142.251.90.39:443 +0000 2022-10-10 23:18:08 INFO [930913528] inbound/tun[0]: inbound connection from 10.10.10.193:10210 +0000 2022-10-10 23:18:08 INFO [930913528] inbound/tun[0]: inbound connection to 142.251.90.39:443 +0000 2022-10-10 23:18:08 DEBUG [2603977081] router: sniffed protocol: tls, domain: rr2---sn-oguelnzy.googlevideo.com +0000 2022-10-10 23:18:08 DEBUG [930913528] router: sniffed protocol: tls, domain: rr2---sn-oguelnzy.googlevideo.com +0000 2022-10-10 23:18:08 INFO [930913528] outbound/hysteria[HY-out]: outbound connection to 142.251.90.39:443 +0000 2022-10-10 23:18:08 INFO [2603977081] outbound/hysteria[HY-out]: outbound connection to 142.251.90.39:443 +0000 2022-10-10 23:18:08 DEBUG [789794300] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10039: use of closed network connection +0000 2022-10-10 23:18:08 DEBUG [721464286] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10019: use of closed network connection +0000 2022-10-10 23:18:11 INFO [2292711337] inbound/tun[0]: inbound connection from 10.10.10.193:10211 +0000 2022-10-10 23:18:11 INFO [2292711337] inbound/tun[0]: inbound connection to 142.251.43.10:443 +0000 2022-10-10 23:18:11 DEBUG [2292711337] router: sniffed protocol: tls, domain: remotedesktop-pa.googleapis.com +0000 2022-10-10 23:18:11 INFO [2292711337] outbound/hysteria[HY-out]: outbound connection to 142.251.43.10:443 +0000 2022-10-10 23:18:11 INFO [919928090] inbound/tun[0]: inbound connection from 10.10.10.193:10212 +0000 2022-10-10 23:18:11 INFO [919928090] inbound/tun[0]: inbound connection to 20.198.162.76:443 +0000 2022-10-10 23:18:11 DEBUG [919928090] router: sniffed protocol: tls, domain: skydrive.wns.windows.com +0000 2022-10-10 23:18:11 INFO [919928090] outbound/hysteria[HY-out]: outbound connection to 20.198.162.76:443 +0000 2022-10-10 23:18:11 INFO [2373286807] inbound/tun[0]: inbound connection from 10.10.10.193:10213 +0000 2022-10-10 23:18:11 INFO [2373286807] inbound/tun[0]: inbound connection to 13.107.42.12:443 +0000 2022-10-10 23:18:11 DEBUG [2373286807] router: sniffed protocol: tls, domain: chi01pap001.storage.live.com +0000 2022-10-10 23:18:11 INFO [2373286807] outbound/hysteria[HY-out]: outbound connection to 13.107.42.12:443 +0000 2022-10-10 23:18:12 INFO [271083910] inbound/tun[0]: inbound connection from 10.10.10.193:10214 +0000 2022-10-10 23:18:12 INFO [271083910] inbound/tun[0]: inbound connection to 13.107.42.12:443 +0000 2022-10-10 23:18:12 DEBUG [271083910] router: sniffed protocol: tls, domain: api.onedrive.com +0000 2022-10-10 23:18:12 INFO [271083910] outbound/hysteria[HY-out]: outbound connection to 13.107.42.12:443 +0000 2022-10-10 23:18:15 INFO [1790954502] inbound/tun[0]: inbound packet connection from 10.10.10.193:50694 +0000 2022-10-10 23:18:15 INFO [1790954502] inbound/tun[0]: inbound packet connection to 142.251.42.234:443 +0000 2022-10-10 23:18:15 INFO [1790954502] outbound/hysteria[HY-out]: outbound packet connection to 142.251.42.234:443 +0000 2022-10-10 23:18:15 INFO [91550595] inbound/tun[0]: inbound connection from 10.10.10.193:10215 +0000 2022-10-10 23:18:15 INFO [91550595] inbound/tun[0]: inbound connection to 35.185.44.232:443 +0000 2022-10-10 23:18:15 DEBUG [91550595] router: sniffed protocol: tls, domain: malware-filter.gitlab.io +0000 2022-10-10 23:18:15 INFO [91550595] outbound/hysteria[HY-out]: outbound connection to 35.185.44.232:443 +0000 2022-10-10 23:18:16 INFO [3614404276] inbound/tun[0]: inbound connection from 10.10.10.193:10216 +0000 2022-10-10 23:18:16 INFO [3614404276] inbound/tun[0]: inbound connection to 140.82.112.26:443 +0000 2022-10-10 23:18:16 DEBUG [3614404276] router: sniffed protocol: tls, domain: alive.github.com +0000 2022-10-10 23:18:16 INFO [3614404276] outbound/hysteria[HY-out]: outbound connection to 140.82.112.26:443 +0000 2022-10-10 23:18:18 INFO [2353827224] inbound/tun[0]: inbound packet connection from 10.10.10.193:59052 +0000 2022-10-10 23:18:18 INFO [2353827224] inbound/tun[0]: inbound packet connection to 142.251.42.238:443 +0000 2022-10-10 23:18:18 INFO [2353827224] outbound/hysteria[HY-out]: outbound packet connection to 142.251.42.238:443 +0000 2022-10-10 23:18:18 INFO [1295889994] inbound/tun[0]: inbound packet connection from 10.10.10.193:56258 +0000 2022-10-10 23:18:18 INFO [1295889994] inbound/tun[0]: inbound packet connection to 172.217.160.110:443 +0000 2022-10-10 23:18:18 INFO [1295889994] outbound/hysteria[HY-out]: outbound packet connection to 172.217.160.110:443 +0000 2022-10-10 23:18:21 DEBUG [91550595] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10098: use of closed network connection +0000 2022-10-10 23:18:23 INFO [3618123273] inbound/tun[0]: inbound connection from 10.10.10.193:10217 +0000 2022-10-10 23:18:23 INFO [3618123273] inbound/tun[0]: inbound connection to 140.82.112.26:443 +0000 2022-10-10 23:18:23 DEBUG [3618123273] router: sniffed protocol: tls, domain: alive.github.com +0000 2022-10-10 23:18:23 INFO [3618123273] outbound/hysteria[HY-out]: outbound connection to 140.82.112.26:443 +0000 2022-10-10 23:18:24 INFO [2213034750] inbound/tun[0]: inbound packet connection from 10.10.10.193:60342 +0000 2022-10-10 23:18:24 INFO [2213034750] inbound/tun[0]: inbound packet connection to 203.208.41.98:443 +0000 2022-10-10 23:18:24 INFO [50302924] inbound/tun[0]: inbound packet connection from 10.10.10.193:59093 +0000 2022-10-10 23:18:24 INFO [50302924] inbound/tun[0]: inbound packet connection to 203.208.40.98:443 +0000 2022-10-10 23:18:24 DEBUG [2213034750] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:18:24 INFO [2213034750] outbound/direct[direct]: outbound packet connection +0000 2022-10-10 23:18:24 DEBUG [50302924] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:18:24 INFO [50302924] outbound/direct[direct]: outbound packet connection +0000 2022-10-10 23:18:25 INFO [4151951951] inbound/tun[0]: inbound connection from 10.10.10.193:10218 +0000 2022-10-10 23:18:25 INFO [4151951951] inbound/tun[0]: inbound connection to 172.67.164.149:443 +0000 2022-10-10 23:18:25 DEBUG [4151951951] router: sniffed protocol: tls, domain: sagernet.org +0000 2022-10-10 23:18:25 INFO [4151951951] outbound/hysteria[HY-out]: outbound connection to 172.67.164.149:443 +0000 2022-10-10 23:18:26 INFO [2065176874] inbound/tun[0]: inbound packet connection from 10.10.10.193:57488 +0000 2022-10-10 23:18:26 INFO [2065176874] inbound/tun[0]: inbound packet connection to 172.67.164.149:443 +0000 2022-10-10 23:18:26 INFO [2065176874] outbound/hysteria[HY-out]: outbound packet connection to 172.67.164.149:443 +0000 2022-10-10 23:18:26 INFO [1316647631] inbound/tun[0]: inbound connection from 10.10.10.193:10219 +0000 2022-10-10 23:18:26 INFO [1316647631] inbound/tun[0]: inbound connection to 146.59.166.237:443 +0000 2022-10-10 23:18:26 DEBUG [1316647631] router: sniffed protocol: tls, domain: plugin.myip.ms +0000 2022-10-10 23:18:26 INFO [1316647631] outbound/hysteria[HY-out]: outbound connection to 146.59.166.237:443 +0000 2022-10-10 23:18:26 INFO [3400121746] inbound/tun[0]: inbound connection from 10.10.10.193:10220 +0000 2022-10-10 23:18:26 INFO [3400121746] inbound/tun[0]: inbound connection to 34.149.204.188:443 +0000 2022-10-10 23:18:26 DEBUG [3400121746] router: sniffed protocol: tls, domain: count.getloli.com +0000 2022-10-10 23:18:26 INFO [3400121746] outbound/hysteria[HY-out]: outbound connection to 34.149.204.188:443 +0000 2022-10-10 23:18:27 INFO [3125022333] inbound/tun[0]: inbound connection from 172.19.0.1:53956 +0000 2022-10-10 23:18:27 INFO [3125022333] inbound/tun[0]: inbound connection to 8.8.4.4:853 +0000 2022-10-10 23:18:27 DEBUG [3125022333] router: sniffed protocol: tls +0000 2022-10-10 23:18:27 INFO [3125022333] outbound/hysteria[HY-out]: outbound connection to 8.8.4.4:853 +0000 2022-10-10 23:18:27 INFO [315895046] inbound/tun[0]: inbound connection from 10.10.10.193:10221 +0000 2022-10-10 23:18:27 INFO [315895046] inbound/tun[0]: inbound connection to 20.205.243.168:443 +0000 2022-10-10 23:18:27 DEBUG [315895046] router: sniffed protocol: tls, domain: api.github.com +0000 2022-10-10 23:18:27 INFO [315895046] outbound/hysteria[HY-out]: outbound connection to 20.205.243.168:443 +0000 2022-10-10 23:18:27 INFO [4225764941] inbound/tun[0]: inbound connection from 10.10.10.193:10222 +0000 2022-10-10 23:18:27 INFO [4225764941] inbound/tun[0]: inbound connection to 146.59.166.237:443 +0000 2022-10-10 23:18:27 DEBUG [4225764941] router: sniffed protocol: tls, domain: plugin.myip.ms +0000 2022-10-10 23:18:27 INFO [4225764941] outbound/hysteria[HY-out]: outbound connection to 146.59.166.237:443 +0000 2022-10-10 23:18:27 INFO [2962291859] inbound/tun[0]: inbound packet connection from 10.10.10.193:62731 +0000 2022-10-10 23:18:27 INFO [2962291859] inbound/tun[0]: inbound packet connection to 142.251.46.234:443 +0000 2022-10-10 23:18:27 INFO [2962291859] outbound/hysteria[HY-out]: outbound packet connection to 142.251.46.234:443 +0000 2022-10-10 23:18:36 INFO [1318627543] inbound/tun[0]: inbound connection from 10.10.10.193:10223 +0000 2022-10-10 23:18:36 INFO [1318627543] inbound/tun[0]: inbound connection to 162.125.85.19:443 +0000 2022-10-10 23:18:36 DEBUG [1318627543] router: sniffed protocol: tls, domain: api.dropboxapi.com +0000 2022-10-10 23:18:36 INFO [1318627543] outbound/hysteria[HY-out]: outbound connection to 162.125.85.19:443 +0000 2022-10-10 23:18:37 DEBUG [4238048833] inbound/tun[0]: connection closed: upload: readfrom tcp 10.10.10.202:45472->183.60.220.130:443: use of closed network connection +0000 2022-10-10 23:18:37 DEBUG [3125022333] inbound/tun[0]: connection closed: upload: EOF | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10107: use of closed network connection +0000 2022-10-10 23:18:37 DEBUG [1316647631] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10105: use of closed network connection | download: EOF +0000 2022-10-10 23:18:37 DEBUG [4233825981] inbound/tun[0]: connection closed: upload: readfrom tcp 10.10.10.202:43176->183.60.220.132:443: use of closed network connection +0000 2022-10-10 23:18:40 DEBUG [3654428069] inbound/tun[0]: connection closed: upload: readfrom tcp 10.10.10.202:55576->183.60.220.140:443: use of closed network connection +0000 2022-10-10 23:18:45 INFO [3951334374] inbound/tun[0]: inbound connection from 172.19.0.1:53958 +0000 2022-10-10 23:18:45 INFO [3951334374] inbound/tun[0]: inbound connection to 8.8.4.4:853 +0000 2022-10-10 23:18:45 DEBUG [3951334374] router: sniffed protocol: tls +0000 2022-10-10 23:18:45 INFO [3951334374] outbound/hysteria[HY-out]: outbound connection to 8.8.4.4:853 +0000 2022-10-10 23:18:46 INFO [1541321147] inbound/tun[0]: inbound packet connection from 10.10.10.193:60745 +0000 2022-10-10 23:18:46 INFO [1541321147] inbound/tun[0]: inbound packet connection to 203.208.41.98:443 +0000 2022-10-10 23:18:46 DEBUG [1541321147] router: match[2] geosite=cn geoip=[cn private] => direct +0000 2022-10-10 23:18:46 INFO [1541321147] outbound/direct[direct]: outbound packet connection +0000 2022-10-10 23:18:52 INFO [4186695788] inbound/tun[0]: inbound connection from 10.10.10.193:10224 +0000 2022-10-10 23:18:52 INFO [4186695788] inbound/tun[0]: inbound connection to 162.125.35.134:443 +0000 2022-10-10 23:18:52 DEBUG [4186695788] router: sniffed protocol: tls, domain: bolt.dropbox.com +0000 2022-10-10 23:18:52 INFO [4186695788] outbound/hysteria[HY-out]: outbound connection to 162.125.35.134:443 +0000 2022-10-10 23:18:53 DEBUG [2700207955] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10055: use of closed network connection | download: EOF +0000 2022-10-10 23:19:08 DEBUG [2603977081] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10085: use of closed network connection | download: EOF +0000 2022-10-10 23:19:08 DEBUG [930913528] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10086: use of closed network connection | download: EOF +0000 2022-10-10 23:19:08 DEBUG [1790954502] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [1227481241] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [1152810483] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2353827224] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [3572379111] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2287864816] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [3255878906] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [1295889994] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [1356634204] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [817011471] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [1265020833] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2700174859] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2599128056] inbound/tun[0]: connection closed: download: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [1541321147] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: read udp [::]:41988: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2063346069] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [1395632939] inbound/tun[0]: connection closed: download: read udp [::]:50608: use of closed network connection | upload: io: read/write on closed pipe | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2962291859] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2065176874] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [50302924] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: read udp [::]:55504: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [2213034750] inbound/tun[0]: connection closed: upload: io: read/write on closed pipe | download: read udp [::]:49354: use of closed network connection | upstream: context canceled +0000 2022-10-10 23:19:08 DEBUG [4011330395] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10015: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10015: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [3614404276] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10099: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10099: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [2663881473] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10018: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10018: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [2898397583] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10058: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10058: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [3122258567] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10036: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10036: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [1379843006] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10051: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10051: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [4225764941] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10109: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10109: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [2292711337] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10088: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10088: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [643928211] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10053: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10053: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [4186695788] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10112: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10112: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [3087121693] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10049: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10049: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [4103253475] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10054: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10054: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [4151951951] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10104: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10104: Application error 0x0 +0000 2022-10-10 23:19:08 DEBUG [1318627543] inbound/tun[0]: connection closed: upload: read tcp4 172.19.0.1:41601->172.19.0.2:10110: use of closed network connection | download: readfrom tcp4 172.19.0.1:41601->172.19.0.2:10110: Application error 0x0 ```
nekohasekai commented 2 years ago

Please describe how to reproduce the bug.

Gzxhwq commented 2 years ago

Block the protocol quic in the sing-box route rule , then use Chrome with extention "HTTP Indicator" to browser some http3 website (e.g. cloudflare/google/youtube) for a while, then you can see the page is http/3 protocol. Or use Wireshark can catch quic payload packet.

But if use block udp port 443 route rule in sing-box. This will not happen.

![image](https://user-images.githubusercontent.com/8738520/195054027-0a8acf0e-edee-4765-9af8-2ef39678facd.png)
mazzz1y commented 2 years ago

the same for me

malikshi commented 2 years ago

+1 same cases, instead of blocking through protocol quic, i used conventional one which is block udp 443 for time being.

nekohasekai commented 2 years ago

Try 3f1fe814ef0168e95875c647ed1b038d302b8786

Gzxhwq commented 2 years ago

Fixed https://github.com/SagerNet/sing-box/commit/3f1fe814ef0168e95875c647ed1b038d302b8786