The tun + hijack-dns + fakeip cause DNS resolve loopback

[kkocdko]

I can provide the min runnable config (be careful, all direct):

{
  "dns": {
    "servers": [
      { "tag": "local", "type": "local", "detour": "direct" },
      { "tag": "fakeip", "type": "fakeip", "inet4_range": "198.18.0.0/15", "inet6_range": "fc00::/18" }
    ],
    "rules": [{ "query_type": ["A", "AAAA"], "server": "fakeip" }],
    "strategy": "prefer_ipv4",
    "independent_cache": true
  },
  "route": {
    "default_domain_resolver": "local",
    "rules": [
      { "action": "sniff" },
      // { "process_name": "sing-box-1-12-0-alpha-12", "protocol": "dns", "outbound": "direct" }, // 1.12
      { "process_name": "noop-rule-to-trigger-process-name-sniff", "protocol": "dns", "outbound": "direct" },
      { "protocol": "dns", "action": "hijack-dns" },
      { "domain": ["dns.weixin.qq.com"], "action": "reject" },
      { "outbound": "direct" }
    ],
    "auto_detect_interface": true
  },
  "inbounds": [
    {
      "type": "tun",
      "address": ["172.18.0.1/30", "fdfe:dcba:9876::1/126"],
      "auto_route": true,
      "strict_route": true
    }
  ],
  "outbounds": [{ "tag":"direct","type":"direct" }]
}

Then, when I run curl -v -4 https://www.baidu.com:

[kkocdko@klp1 apps]$ curl -v -4 https://www.baidu.com
* Uses proxy env variable no_proxy == 'localhost,127.0.0.0/8,::1'
* Host www.baidu.com:443 was resolved.
* IPv6: (none)
* IPv4: 198.18.0.3
*   Trying 198.18.0.3:443...
* ALPN: curl offers http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* Recv failure: Connection reset by peer
* OpenSSL SSL_connect: Connection reset by peer in connection to www.baidu.com:443 
* closing connection #0
curl: (35) Recv failure: Connection reset by peer

The sing-box log:

[kkocdko@klp1 apps]$ sudo ~/misc/code/utils4linux/proxy/proxy 
INFO[0000] network: updated default interface wlp4s0, index 3
TRACE[0000] inbound/tun[0]: creating stack
INFO[0000] inbound/tun[0]: started at tun0
INFO[0001] sing-box started (1.00s)
INFO[0003] router: found process path: /usr/bin/curl
INFO[0003] [2142467851 0ms] inbound/tun[0]: inbound packet connection from 172.18.0.1:55621
INFO[0003] [2142467851 0ms] inbound/tun[0]: inbound packet connection to 192.168.101.1:53
INFO[0003] [2142467851 0ms] router: found process path: /usr/bin/curl
DEBUG[0003] [2142467851 0ms] router: match[0] => sniff
DEBUG[0003] [2142467851 0ms] router: sniffed packet protocol: dns
DEBUG[0003] [2142467851 0ms] router: match[2] protocol=dns => hijack-dns
DEBUG[0003] [2142467851 0ms] dns: exchange www.baidu.com. IN A
DEBUG[0003] [2142467851 0ms] dns: match[1] query_type=[A AAAA] => route(fakeip)
DEBUG[0003] [2142467851 0ms] dns: exchanged www.baidu.com NOERROR 600
INFO[0003] [2142467851 0ms] dns: exchanged A www.baidu.com. 600 IN A 198.18.0.3
INFO[0003] router: found process path: /usr/bin/curl
DEBUG[0003] router: found fakeip domain: www.baidu.com
INFO[0003] [4108667525 0ms] inbound/tun[0]: inbound connection from 172.18.0.1:47716
INFO[0003] [4108667525 0ms] inbound/tun[0]: inbound connection to 198.18.0.3:443
INFO[0003] [4108667525 10ms] router: found process path: /usr/bin/curl
DEBUG[0003] [4108667525 10ms] router: found fakeip domain: www.baidu.com
DEBUG[0003] [4108667525 10ms] router: match[0] => sniff
DEBUG[0003] [4108667525 10ms] router: sniffed protocol: tls, domain: www.baidu.com
DEBUG[0003] [4108667525 10ms] router: match[4] => route(direct)
INFO[0003] [4108667525 10ms] outbound/direct[direct]: outbound connection to www.baidu.com:443
INFO[0003] router: found process path: /home/kkocdko/misc/code/utils4linux/proxy/dist/sing-box-1-12-0-alpha-12
INFO[0003] [2802389441 0ms] inbound/tun[0]: inbound packet connection from 172.18.0.1:46082
INFO[0003] [2802389441 0ms] inbound/tun[0]: inbound packet connection to 192.168.101.1:53
INFO[0003] router: found process path: /home/kkocdko/misc/code/utils4linux/proxy/dist/sing-box-1-12-0-alpha-12
INFO[0003] [2265126469 0ms] inbound/tun[0]: inbound packet connection from 172.18.0.1:49882
INFO[0003] [2265126469 0ms] inbound/tun[0]: inbound packet connection to 192.168.101.1:53
INFO[0003] [2802389441 3ms] router: found process path: /home/kkocdko/misc/code/utils4linux/proxy/dist/sing-box-1-12-0-alpha-12
DEBUG[0003] [2802389441 3ms] router: match[0] => sniff
DEBUG[0003] [2802389441 3ms] router: sniffed packet protocol: dns
DEBUG[0003] [2802389441 3ms] router: match[2] protocol=dns => hijack-dns
DEBUG[0003] [2802389441 3ms] dns: exchange www.baidu.com. IN AAAA
DEBUG[0003] [2802389441 3ms] dns: match[1] query_type=[A AAAA] => route(fakeip)
DEBUG[0003] [2802389441 3ms] dns: exchanged www.baidu.com NOERROR 600
INFO[0003] [2802389441 4ms] dns: exchanged AAAA www.baidu.com. 600 IN AAAA fc00::3
INFO[0003] [2265126469 2ms] router: found process path: /home/kkocdko/misc/code/utils4linux/proxy/dist/sing-box-1-12-0-alpha-12
DEBUG[0003] [2265126469 2ms] router: match[0] => sniff
DEBUG[0003] [2265126469 2ms] router: sniffed packet protocol: dns
DEBUG[0003] [2265126469 2ms] router: match[2] protocol=dns => hijack-dns
DEBUG[0003] [2265126469 2ms] dns: exchange www.baidu.com. IN A
DEBUG[0003] [2265126469 2ms] dns: match[1] query_type=[A AAAA] => route(fakeip)
DEBUG[0003] [2265126469 2ms] dns: exchanged www.baidu.com NOERROR 600
INFO[0003] [2265126469 2ms] dns: exchanged A www.baidu.com. 600 IN A 198.18.0.3
ERROR[0008] [4108667525 5.1s] connection: open outbound connection: dial tcp 198.18.0.3:443: i/o timeout

As you can see, curl -> sing-box hijack-dns -> sing-box fakeip -> curl -> sing-box hijack-dns -> sing-box dns resolve -> captured by sing-box itself -> sing-box itself try to connect to fakeip

sing-box 1.12.0 alpha 12, linux 6.11 x86-64 fedora 40

[kkocdko]

And, when I uncomment this rule in route.rules :

{ "process_name": "sing-box-1-12-0-alpha-12", "protocol": "dns", "outbound": "direct" }

All works fine.

So, in my humble opinion: sing-box 1.12.x hijacked the dns query sent by itself.

And, in v1.11, this problem is not exist. The dns query sent by sing-box itself will not be hijacked.

[nekohasekai]

Try fef8309