Add autoSystemWfpBlockLeak - #903
Open
patterniha wants to merge 10 commits into
Open
patterniha wants to merge 10 commits into
patterniha wants to merge 10 commits into
Conversation
Document the Windows-only `strictRoute` option of the TUN inbound (true by default), added in XTLS/Xray-core#6853: with autoSystemRoutingTable set, WFP filters keep DNS (when `dns` is set), and IPv6 when the TUN cannot carry it, of every program but Xray from leaving outside the TUN. Setting it to false turns them off. In English, Chinese and Russian. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follows XTLS/Xray-core#6853, where strictRoute now defaults to false like sing-box's strict_route: the filters are only added when it is enabled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follows XTLS/Xray-core#6853: on Windows 11, Windows Server 2022 and later, the Windows DNS Client service may only connect through the TUN interface, so DNS over HTTPS or TLS set up for another interface cannot leave through it either; name resolution on the local network (LLMNR, mDNS) stays allowed. Also say why port 53 is blocked for all programs: Windows sends each interface's queries through that interface whatever the routes say, and other programs reach a DNS server on the local network through its more specific LAN route. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follows XTLS/Xray-core#6853, where the option is now named after what it sets up in the system, like autoSystemRoutingTable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follows XTLS/Xray-core#6853. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follows XTLS/Xray-core#6853: an IP version, IPv4 or IPv6, is blocked when no route of it is in autoSystemRoutingTable, whatever gateway holds, as Windows gives the TUN link-local addresses of its own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follows XTLS/Xray-core#6853: Xray assigns no address on Linux, Windows gives the TUN interface link-local addresses itself, and macOS and FreeBSD use 169.254.10.1/30. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d `autoSystemDnsToGateway` Follows XTLS/Xray-core#6853: autoSystemWfpBlockLeak takes ["dns", "misconfig"]. The dns field now explains what Windows does with the servers and what the other systems do instead, autoSystemDnsToGateway (Linux) gets its own section, and the old macOS-only note under gateway is folded into the note for all systems. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Follows XTLS/Xray-core#6853. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sToGateway` cannot apply Follows XTLS/Xray-core#6853. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
XTLS/Xray-core#6853