Bug: Windows TUN stack fails to route IPv6 traffic properly

[PandaWorker]

Operating system

Windows

System version

Windows 11 ltsc 24H2

Installation type

sing-box for Windows Graphical Client

If you are using a graphical client, please provide the version of the client.

SFW 1.14.0

Version

1.14.0

Description

When using tun with ipv6 and auto_route, if there is no ipv6 output on the device, tun does not work correctly on Windows. IPv6 does not return the “Network unreachable” error; it simply breaks the connection.

I checked on Android/iOS/MacOS — it works everywhere except Windows.

Reproduction

1. add repro config

{
  "log": {
    "disabled": false,
    "level": "trace"
  },
  "dns": {
    "servers": [
      {
        "tag": "local-dns",
        "type": "local"
      }
    ],
    "rules": [],
    "final": "local-dns"
  },
  "inbounds": [
    {
      "tag": "tun-in",
      "type": "tun",
      "address": [
        "172.19.0.1/30",
        "fdfe:dcba:9876::0/126"
      ],
      "auto_route": true,
      "strict_route": true,
      "stack": "mixed"
    }
  ],
  "outbounds": [
    {
      "type": "direct",
      "tag": "direct"
    }
  ],
  "route": {
    "final": "direct",
    "auto_detect_interface": true,
    "rules": [
      {
        "inbound": "tun-in",
        "action": "sniff"
      },
      {
        "type": "logical",
        "mode": "or",
        "rules": [
          {
            "protocol": "dns"
          },
          {
            "port": 53
          }
        ],
        "action": "hijack-dns"
      }
    ]
  }
}

2. curl request

C:\Users\user>curl -iv https://yandex.com/
* Host yandex.com:443 was resolved.
* IPv6: 2a02:6b8:a::a
* IPv4: 5.255.255.77, 77.88.55.88, 77.88.44.55
*   Trying [2a02:6b8:a::a]:443...
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* Recv failure: Connection was reset
* schannel: failed to receive handshake, SSL/TLS connection failed
* closing connection #0
curl: (35) Recv failure: Connection was reset

3. remove ipv6 from tun address
4. curl request

C:\Users\user>curl -iv --connect-to ::[2a02:6b8:a::a]:443 https://yandex.com
*   Trying [2a02:6b8:a::a]:443...
* connect to 2a02:6b8:a::a port 443 from :: port 52168 failed: Network unreachable
* Failed to connect to yandex.com:443 via 2a02:6b8:a::a:443 after 33 ms: Could not connect to server
* closing connection #0
curl: (7) Failed to connect to yandex.com:443 via 2a02:6b8:a::a:443 after 33 ms: Could not connect to server

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.