documentation: Bump version

Co-authored-by: anytls <anytls>

common/dialer/dialer.go

@@ -24,6 +24,7 @@ type Options struct {
 	ResolverOnDetour bool
 	NewDialer        bool
 	LegacyDNSDialer  bool
+	DirectOutbound   bool
 }
 
 // TODO: merge with NewWithOptions
@@ -108,7 +109,7 @@ func NewWithOptions(options Options) (N.Dialer, error) {
 				dnsQueryOptions.Transport = dnsTransport.Default()
 			} else if options.NewDialer {
 				return nil, E.New("missing domain resolver for domain server address")
-			} else {
+			} else if !options.DirectOutbound {
 				deprecated.Report(options.Context, deprecated.OptionMissingDomainResolver)
 			}
 		}

common/sniff/dns.go

@@ -11,7 +11,6 @@ import (
 	C "github.com/sagernet/sing-box/constant"
 	"github.com/sagernet/sing/common"
 	"github.com/sagernet/sing/common/buf"
-	M "github.com/sagernet/sing/common/metadata"
 	"github.com/sagernet/sing/common/task"
 
 	mDNS "github.com/miekg/dns"
@@ -47,9 +46,6 @@ func DomainNameQuery(ctx context.Context, metadata *adapter.InboundContext, pack
 	if err != nil {
 		return err
 	}
-	if len(msg.Question) == 0 || msg.Question[0].Qclass != mDNS.ClassINET || !M.IsDomainName(msg.Question[0].Name) {
-		return os.ErrInvalid
-	}
 	metadata.Protocol = C.ProtocolDNS
 	return nil
 }

common/sniff/dns_test.go

@@ -0,0 +1,23 @@
+package sniff_test
+
+import (
+	"context"
+	"encoding/hex"
+	"testing"
+
+	"github.com/sagernet/sing-box/adapter"
+	"github.com/sagernet/sing-box/common/sniff"
+	C "github.com/sagernet/sing-box/constant"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestSniffDNS(t *testing.T) {
+	t.Parallel()
+	query, err := hex.DecodeString("740701000001000000000000012a06676f6f676c6503636f6d0000010001")
+	require.NoError(t, err)
+	var metadata adapter.InboundContext
+	err = sniff.DomainNameQuery(context.TODO(), &metadata, query)
+	require.NoError(t, err)
+	require.Equal(t, C.ProtocolDNS, metadata.Protocol)
+}

docs/changelog.md

@@ -2,10 +2,16 @@
 icon: material/alert-decagram
 ---
 
-#### 1.12.0-alpha.23
+#### 1.12.0-beta.1
 
+* Improve `auto_redirect` **1**
 * Fixes and improvements
 
+**1**:
+
+Now `auto_redirect` fixes compatibility issues between tun and Docker bridge networks,
+see [Tun](/configuration/inbound/tun/#auto_redirect).
+
 ### 1.11.6
 
 * Fixes and improvements

docs/configuration/inbound/tun.md

@@ -211,6 +211,10 @@ Set the default route to the Tun.
 
     By default, VPN takes precedence over tun. To make tun go through VPN, enable `route.override_android_vpn`.
 
+!!! note "Also enable `auto_redirect`"
+
+    `auto_redirect` is always recommended on Linux, it provides better routing, higher performance (better than tproxy), and avoids conflicts with Docker bridge networks.
+
 #### iproute2_table_index
 
 !!! question "Since sing-box 1.10.0"
@@ -237,6 +241,10 @@ Linux iproute2 rule start index generated by `auto_route`.
 
 Automatically configure iptables/nftables to redirect connections.
 
+Auto redirect is always recommended on Linux, it provides better routing,
+higher performance (better than tproxy),
+and avoids conflicts with Docker bridge networks.
+
 *In Android*：
 
 Only local IPv4 connections are forwarded. To share your VPN connection over hotspot or repeater,
@@ -246,11 +254,13 @@ use [VPNHotspot](https://github.com/Mygod/VPNHotspot).
 
 `auto_route` with `auto_redirect` works as expected on routers **without intervention**.
 
+Conflict with `route.default_mark` and `[dialOptions].routing_mark`.
+
 #### auto_redirect_input_mark
 
 !!! question "Since sing-box 1.10.0"
 
-Connection input mark used by `route[_exclude]_address_set` with `auto_redirect`.
+Connection input mark used by `auto_redirect`.
 
 `0x2023` is used by default.
 
@@ -258,7 +268,7 @@ Connection input mark used by `route[_exclude]_address_set` with `auto_redirect`
 
 !!! question "Since sing-box 1.10.0"
 
-Connection input mark used by `route[_exclude]_address_set` with `auto_redirect`.
+Connection output mark used by `auto_redirect`.
 
 `0x2024` is used by default.
 
@@ -368,8 +378,6 @@ Exclude custom routes when `auto_route` is enabled.
     Add the destination IP CIDR rules in the specified rule-sets to the firewall.
     Matched traffic will bypass the sing-box routes.
 
-    Conflict with `route.default_mark` and `[dialOptions].routing_mark`.
-
 === "Without `auto_redirect` enabled"
 
     !!! question "Since sing-box 1.11.0"

docs/configuration/inbound/tun.zh.md

@@ -215,6 +215,10 @@ tun 接口的 IPv6 前缀。
 
     VPN 默认优先于 tun。要使 tun 经过 VPN，启用 `route.override_android_vpn`。
 
+!!! note "也启用 `auto_redirect`"
+
+  在 Linux 上始终推荐使用 `auto_redirect`，它提供更好的路由， 更高的性能（优于 tproxy）， 并避免与 Docker 桥接网络冲突。
+
 #### iproute2_table_index
 
 !!! question "自 sing-box 1.10.0 起"
@@ -241,19 +245,23 @@ tun 接口的 IPv6 前缀。
 
 自动配置 iptables/nftables 以重定向连接。
 
+在 Linux 上始终推荐使用 auto redirect，它提供更好的路由， 更高的性能（优于 tproxy）， 并避免与 Docker 桥接网络冲突。
+
 *在 Android 中*：
 
 仅转发本地 IPv4 连接。 要通过热点或中继共享您的 VPN 连接，请使用 [VPNHotspot](https://github.com/Mygod/VPNHotspot)。
 
 *在 Linux 中*:
 
-带有 `auto_redirect `的 `auto_route` 可以在路由器上按预期工作，**无需干预**。
+带有 `auto_redirect` 的 `auto_route` 在路由器上**无需干预**即可按预期工作。
+
+与 `route.default_mark` 和 `[dialOptions].routing_mark` 冲突。
 
 #### auto_redirect_input_mark
 
 !!! question "自 sing-box 1.10.0 起"
 
-`route_address_set` 和 `route_exclude_address_set` 使用的连接输入标记。
+`auto_redriect` 使用的连接输入标记。
 
 默认使用 `0x2023`。
 
@@ -261,7 +269,7 @@ tun 接口的 IPv6 前缀。
 
 !!! question "自 sing-box 1.10.0 起"
 
-`route_address_set` 和 `route_exclude_address_set` 使用的连接输出标记。
+`auto_redriect` 使用的连接输出标记。
 
 默认使用 `0x2024`。
 
@@ -342,8 +350,6 @@ tun 接口的 IPv6 前缀。
     将指定规则集中的目标 IP CIDR 规则添加到防火墙。
     不匹配的流量将绕过 sing-box 路由。
 
-    与 `route.default_mark` 和 `[dialOptions].routing_mark` 冲突。
-
 === "`auto_redirect` 未启用"
 
     !!! question "自 sing-box 1.11.0 起"

go.mod

@@ -32,7 +32,7 @@ require (
 	github.com/sagernet/sing-shadowsocks v0.2.7
 	github.com/sagernet/sing-shadowsocks2 v0.2.0
 	github.com/sagernet/sing-shadowtls v0.2.1-0.20250316154757-6f9e732e5056
-	github.com/sagernet/sing-tun v0.6.2-0.20250319123703-35b5747b44ec
+	github.com/sagernet/sing-tun v0.6.2
 	github.com/sagernet/sing-vmess v0.2.0
 	github.com/sagernet/smux v0.0.0-20231208180855-7041f6ea79e7
 	github.com/sagernet/tailscale v1.80.3-mod.2

go.sum

@@ -190,8 +190,8 @@ github.com/sagernet/sing-shadowsocks2 v0.2.0 h1:wpZNs6wKnR7mh1wV9OHwOyUr21VkS3wK
 github.com/sagernet/sing-shadowsocks2 v0.2.0/go.mod h1:RnXS0lExcDAovvDeniJ4IKa2IuChrdipolPYWBv9hWQ=
 github.com/sagernet/sing-shadowtls v0.2.1-0.20250316154757-6f9e732e5056 h1:GFNJQAHhSXqAfxAw1wDG/QWbdpGH5Na3k8qUynqWnEA=
 github.com/sagernet/sing-shadowtls v0.2.1-0.20250316154757-6f9e732e5056/go.mod h1:HyacBPIFiKihJQR8LQp56FM4hBtd/7MZXnRxxQIOPsc=
-github.com/sagernet/sing-tun v0.6.2-0.20250319123703-35b5747b44ec h1:9/OYGb9qDmUFIhqd3S+3eni62EKRQR1rSmRH18baA/M=
-github.com/sagernet/sing-tun v0.6.2-0.20250319123703-35b5747b44ec/go.mod h1:fisFCbC4Vfb6HqQNcwPJi2CDK2bf0Xapyz3j3t4cnHE=
+github.com/sagernet/sing-tun v0.6.2 h1:SoylB/8dA6bRWoUhi4GbFb4WkKL0SMCpmYcvumPndo0=
+github.com/sagernet/sing-tun v0.6.2/go.mod h1:fisFCbC4Vfb6HqQNcwPJi2CDK2bf0Xapyz3j3t4cnHE=
 github.com/sagernet/sing-vmess v0.2.0 h1:pCMGUXN2k7RpikQV65/rtXtDHzb190foTfF9IGTMZrI=
 github.com/sagernet/sing-vmess v0.2.0/go.mod h1:jDAZ0A0St1zVRkyvhAPRySOFfhC+4SQtO5VYyeFotgA=
 github.com/sagernet/smux v0.0.0-20231208180855-7041f6ea79e7 h1:DImB4lELfQhplLTxeq2z31Fpv8CQqqrUwTbrIRumZqQ=

protocol/direct/outbound.go

@@ -48,7 +48,12 @@ func NewOutbound(ctx context.Context, router adapter.Router, logger log.ContextL
 	if options.Detour != "" {
 		return nil, E.New("`detour` is not supported in direct context")
 	}
-	outboundDialer, err := dialer.New(ctx, options.DialerOptions, true)
+	outboundDialer, err := dialer.NewWithOptions(dialer.Options{
+		Context:        ctx,
+		Options:        options.DialerOptions,
+		RemoteIsDomain: true,
+		DirectOutbound: true,
+	})
 	if err != nil {
 		return nil, err
 	}

protocol/tun/inbound.go

@@ -245,7 +245,7 @@ func NewInbound(ctx context.Context, router adapter.Router, logger log.ContextLo
 		if err != nil {
 			return nil, E.Cause(err, "initialize auto-redirect")
 		}
-		if !C.IsAndroid && (len(inbound.routeRuleSet) > 0 || len(inbound.routeExcludeRuleSet) > 0) {
+		if !C.IsAndroid {
 			inbound.tunOptions.AutoRedirectMarkMode = true
 			err = networkManager.RegisterAutoRedirectOutputMark(inbound.tunOptions.AutoRedirectOutputMark)
 			if err != nil {