mirror of
https://github.com/SagerNet/sing-box.git
synced 2025-06-08 03:34:13 +08:00
documentation: Update actual behaviors of auto_redirect and strict_route
This commit is contained in:
世界
parent
023218e6e7
commit
cb68a40c43
@ -213,7 +213,7 @@ Set the default route to the Tun.
|
||||
|
||||
!!! note "Also enable `auto_redirect`"
|
||||
|
||||
`auto_redirect` is always recommended on Linux, it provides better routing, higher performance (better than tproxy), and avoids conflicts with Docker bridge networks.
|
||||
`auto_redirect` is always recommended on Linux, it provides better routing, higher performance (better than tproxy), and avoids conflicts between TUN and Docker bridge networks.
|
||||
|
||||
#### iproute2_table_index
|
||||
|
||||
@ -239,20 +239,21 @@ Linux iproute2 rule start index generated by `auto_route`.
|
||||
|
||||
Only supported on Linux with `auto_route` enabled.
|
||||
|
||||
Automatically configure iptables/nftables to redirect connections.
|
||||
Improve TUN routing and performance using nftables.
|
||||
|
||||
Auto redirect is always recommended on Linux, it provides better routing,
|
||||
`auto_redirect` is always recommended on Linux, it provides better routing,
|
||||
higher performance (better than tproxy),
|
||||
and avoids conflicts with Docker bridge networks.
|
||||
and avoids conflicts between TUN and Docker bridge networks.
|
||||
|
||||
*In Android*：
|
||||
|
||||
Only local IPv4 connections are forwarded. To share your VPN connection over hotspot or repeater,
|
||||
Note that `auto_redirect` also works on Android,
|
||||
but due to the lack of `nftables` and `ip6tables`,
|
||||
only simple IPv4 TCP forwarding is performed.
|
||||
To share your VPN connection over hotspot or repeater on Android,
|
||||
use [VPNHotspot](https://github.com/Mygod/VPNHotspot).
|
||||
|
||||
*In Linux*:
|
||||
|
||||
`auto_route` with `auto_redirect` works as expected on routers **without intervention**.
|
||||
`auto_redirect` also automatically inserts compatibility rules
|
||||
into the OpenWrt fw4 table, i.e.
|
||||
it will work on routers without any extra configuration.
|
||||
|
||||
Conflict with `route.default_mark` and `[dialOptions].routing_mark`.
|
||||
|
||||
@ -279,17 +280,15 @@ Enforce strict routing rules when `auto_route` is enabled:
|
||||
*In Linux*:
|
||||
|
||||
* Let unsupported network unreachable
|
||||
* Make ICMP traffic route to tun instead of upstream interfaces
|
||||
* Route all connections to tun
|
||||
|
||||
It prevents IP address leaks and makes DNS hijacking work on Android.
|
||||
* For legacy reasons, when neither `strict_route` nor `auto_redirect` are enabled, all ICMP traffic will not go through TUN.
|
||||
|
||||
*In Windows*:
|
||||
|
||||
* Add firewall rules to prevent DNS leak caused by
|
||||
* Let unsupported network unreachable
|
||||
* prevent DNS leak caused by
|
||||
Windows' [ordinary multihomed DNS resolution behavior](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
|
||||
|
||||
It may prevent some applications (such as VirtualBox) from working properly in certain situations.
|
||||
It may prevent some Windows applications (such as VirtualBox) from working properly in certain situations.
|
||||
|
||||
#### route_address
|
||||
|
||||
|
||||
@ -217,7 +217,7 @@ tun 接口的 IPv6 前缀。
|
||||
|
||||
!!! note "也启用 `auto_redirect`"
|
||||
|
||||
在 Linux 上始终推荐使用 `auto_redirect`，它提供更好的路由， 更高的性能（优于 tproxy）， 并避免与 Docker 桥接网络冲突。
|
||||
在 Linux 上始终推荐使用 `auto_redirect`，它提供更好的路由， 更高的性能（优于 tproxy）， 并避免 TUN 与 Docker 桥接网络冲突。
|
||||
|
||||
#### iproute2_table_index
|
||||
|
||||
@ -241,19 +241,16 @@ tun 接口的 IPv6 前缀。
|
||||
|
||||
!!! quote ""
|
||||
|
||||
仅支持 Linux，且需要 `auto_route` 已启用。
|
||||
仅支持 Linux，且需要 `auto_route` 已启用。
|
||||
|
||||
自动配置 iptables/nftables 以重定向连接。
|
||||
通过使用 nftables 改善 TUN 路由和性能。
|
||||
|
||||
在 Linux 上始终推荐使用 auto redirect，它提供更好的路由， 更高的性能（优于 tproxy）， 并避免与 Docker 桥接网络冲突。
|
||||
在 Linux 上始终推荐使用 `auto_redirect`，它提供更好的路由、更高的性能（优于 tproxy），并避免了 TUN 和 Docker 桥接网络之间的冲突。
|
||||
|
||||
*在 Android 中*：
|
||||
请注意，`auto_redirect` 也适用于 Android，但由于缺少 `nftables` 和 `ip6tables`，仅执行简单的 IPv4 TCP 转发。
|
||||
若要在 Android 上通过热点或中继器共享 VPN 连接，请使用 [VPNHotspot](https://github.com/Mygod/VPNHotspot)。
|
||||
|
||||
仅转发本地 IPv4 连接。 要通过热点或中继共享您的 VPN 连接，请使用 [VPNHotspot](https://github.com/Mygod/VPNHotspot)。
|
||||
|
||||
*在 Linux 中*:
|
||||
|
||||
带有 `auto_redirect` 的 `auto_route` 在路由器上**无需干预**即可按预期工作。
|
||||
`auto_redirect` 还会自动将兼容性规则插入 OpenWrt 的 fw4 表中，即无需额外配置即可在路由器上工作。
|
||||
|
||||
与 `route.default_mark` 和 `[dialOptions].routing_mark` 冲突。
|
||||
|
||||
@ -261,7 +258,7 @@ tun 接口的 IPv6 前缀。
|
||||
|
||||
!!! question "自 sing-box 1.10.0 起"
|
||||
|
||||
`auto_redriect` 使用的连接输入标记。
|
||||
`auto_redirect` 使用的连接输入标记。
|
||||
|
||||
默认使用 `0x2023`。
|
||||
|
||||
@ -269,29 +266,25 @@ tun 接口的 IPv6 前缀。
|
||||
|
||||
!!! question "自 sing-box 1.10.0 起"
|
||||
|
||||
`auto_redriect` 使用的连接输出标记。
|
||||
`auto_redirect` 使用的连接输出标记。
|
||||
|
||||
默认使用 `0x2024`。
|
||||
|
||||
#### strict_route
|
||||
|
||||
启用 `auto_route` 时执行严格的路由规则。
|
||||
当启用 `auto_route` 时，强制执行严格的路由规则：
|
||||
|
||||
*在 Linux 中*:
|
||||
*在 Linux 中*：
|
||||
|
||||
* 让不支持的网络无法到达
|
||||
* 使 ICMP 流量路由到 tun 而不是上游接口
|
||||
* 将所有连接路由到 tun
|
||||
* 使不支持的网络不可达。
|
||||
* 出于历史遗留原因，当未启用 `strict_route` 或 `auto_redirect` 时，所有 ICMP 流量将不会通过 TUN。
|
||||
|
||||
它可以防止 IP 地址泄漏，并使 DNS 劫持在 Android 上工作。
|
||||
*在 Windows 中*：
|
||||
|
||||
*在 Windows 中*:
|
||||
* 使不支持的网络不可达。
|
||||
* 阻止 Windows 的 [普通多宿主 DNS 解析行为](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29) 造成的 DNS 泄露
|
||||
|
||||
* 添加防火墙规则以阻止 Windows
|
||||
的 [普通多宿主 DNS 解析行为](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
|
||||
造成的 DNS 泄露
|
||||
|
||||
它可能会使某些应用程序（如 VirtualBox）在某些情况下无法正常工作。
|
||||
它可能会使某些 Windows 应用程序（如 VirtualBox）在某些情况下无法正常工作。
|
||||
|
||||
#### route_address
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user