TUN inbound: Handle weak host send and forwarding on the outbound interface on Windows

Windows ignores the binding of autoOutboundsInterface (IP_UNICAST_IF) when the outbound interface has weak host send or forwarding on for an IP version routed to the TUN: Xray's own connections then go into the TUN, from that interface's address, and stall. While the TUN runs, weak host send is turned off on that interface for those IP versions, and turned on again when it stops or another interface takes over. Forwarding, which Mobile Hotspot and Internet Connection Sharing need, cannot be turned off without breaking them, so it is reported instead: the TUN does not start while it is on, and an error is logged when it comes on later. Fixes https://github.com/XTLS/Xray-core/issues/6776 Reports the cause of https://github.com/XTLS/Xray-core/issues/6872 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-05 21:38:12 +03:00 · 2026-10-05 15:14:52 +03:30
parent 7da5dae650
commit 6b0f06fb2b
3 changed files with 145 additions and 0 deletions
@@ -213,6 +213,8 @@ If the filters cannot be added, Xray does not start. They are removed when Xray

 `autoSystemWfpBlockLeak` (Windows only) is empty by default, as the filters break some setups: with `"dns"`, a local DNS resolver other programs use (e.g. on `127.0.0.1:53`), the DNS of another VPN on its own interface, virtual machines whose NAT resolves names on the host, or signing in to a captive portal; with `"misconfigtun"`, IPv4 or IPv6 on the local network while no route of that version leads to the TUN. Without the filters, DNS may leak as described above. To keep an IP version out of the TUN on purpose while still blocking DNS leaks, use only `["dns"]`.

+`autoOutboundsInterface` (the default with `autoSystemRoutingTable`) keeps Xray's own connections out of the TUN by binding them to another interface, which Windows only honors while that interface has weak host send and forwarding off for the IP versions routed to the TUN. Otherwise, Windows sends them into the TUN, from that interface's address, and they stall. While the TUN runs, Xray therefore turns weak host send off on that interface, and on again when it stops or another interface takes over. Forwarding cannot be turned off this way, as Mobile Hotspot and Internet Connection Sharing need it: the TUN does not start while it is on, and an error is logged when it comes on later.
+
 You can give the adapter ip address manually, you can live Windows to give it autogenerated ip address (which take few seconds), it doesn't matter, the traffic going _through_ the interface will be forwarded into the app for proxying. \
 Minimal configuration that will work for local machine is routing passing the traffic on-link through the interface.
 You will need the interface id for that, unfortunately it is going to change with every Xray start due to implementation ambiguity between Xray and wintun driver.
@@ -46,6 +46,7 @@ type WindowsTun struct {
 	luid     winipcfg.LUID
 	cbr      winipcfg.ChangeCallback
 	cbi      winipcfg.ChangeCallback
+	guard    outboundGuard
 	wfp      windows.Handle
 	resolver *savedResolver
 	skipStop chan struct{}
@@ -297,10 +298,23 @@ startOver:
 	}

 	if updater != nil {
+		// Xray's own connections have to stay out of the IP versions routed
+		// to the TUN, which needs Windows to honor the binding to updater's
+		// interface.
+		if route4 {
+			t.guard.families = append(t.guard.families, windows.AF_INET)
+		}
+		if route6 {
+			t.guard.families = append(t.guard.families, windows.AF_INET6)
+		}
+		if problem := t.guard.check(); problem != "" {
+			return errors.New(problem)
+		}
 		// Only a registered callback goes into the fields: a nil pointer in
 		// them would not compare equal to nil in Close.
 		cbr, err := winipcfg.RegisterRouteChangeCallback(func(notificationType winipcfg.MibNotificationType, route *winipcfg.MibIPforwardRow2) {
 			updater.Update()
+			t.guard.recheck()
 		})
 		if err != nil {
 			return err
@@ -308,6 +322,7 @@ startOver:
 		t.cbr = cbr
 		cbi, err := winipcfg.RegisterInterfaceChangeCallback(func(notificationType winipcfg.MibNotificationType, iface *winipcfg.MibIPInterfaceRow) {
 			updater.Update()
+			t.guard.recheck()
 		})
 		if err != nil {
 			return err
@@ -331,6 +346,7 @@ func (t *WindowsTun) Close() error {
 	if t.cbi != nil {
 		t.cbi.Unregister()
 	}
+	t.guard.restore()
 	if t.luid != 0 {
 		t.luid.FlushRoutes(windows.AF_INET)
 		t.luid.FlushIPAddresses(windows.AF_INET)
@@ -0,0 +1,127 @@
+//go:build windows
+
+package tun
+
+import (
+	"context"
+	"slices"
+	"strings"
+	"sync"
+
+	"github.com/xtls/xray-core/common/errors"
+	"golang.org/x/sys/windows"
+	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
+)
+
+// outboundGuard keeps Windows to the binding of autoOutboundsInterface, which
+// keeps Xray's own connections out of the TUN. With weak host send or
+// forwarding on for an IP version on the bound interface, Windows sends them
+// where the routes lead, into the TUN, from that interface's address, and
+// drops what comes back to that address through the TUN, so they stall.
+//
+// For the IP versions routed to the TUN, weak host send is turned off on the
+// bound interface while the TUN runs, and turned on again when the TUN stops
+// or another interface takes over. Forwarding is what Mobile Hotspot and
+// Internet Connection Sharing need, so it is only reported.
+type outboundGuard struct {
+	sync.Mutex
+	families  []winipcfg.AddressFamily
+	luid      winipcfg.LUID            // of the interface last checked
+	turnedOff []winipcfg.AddressFamily // where weak host send was turned off on it
+	reported  string                   // the forwarding problem last logged
+	stopped   bool
+}
+
+// check turns weak host send off on the bound interface, and returns what is
+// wrong if forwarding is on there.
+func (g *outboundGuard) check() string {
+	g.Lock()
+	defer g.Unlock()
+	if g.stopped {
+		return ""
+	}
+	var luid winipcfg.LUID
+	var name string
+	if iface := updater.Get(); iface != nil {
+		luid, _ = winipcfg.LUIDFromIndex(uint32(iface.Index))
+		name = iface.Name
+	}
+	if luid != g.luid {
+		g.restoreLocked()
+		g.luid = luid
+	}
+	if luid == 0 {
+		return ""
+	}
+	var forwarding []string
+	for _, family := range g.families {
+		row, err := luid.IPInterface(family)
+		if err != nil {
+			continue // the interface lacks that IP version
+		}
+		if row.ForwardingEnabled {
+			forwarding = append(forwarding, familyName(family))
+		}
+		if !row.WeakHostSend {
+			continue
+		}
+		if err := setWeakHostSend(row, false); err != nil {
+			errors.LogWarningInner(context.Background(), err, "[tun] unable to turn weak host send off for ", familyName(family), " on ", name)
+			continue
+		}
+		if !slices.Contains(g.turnedOff, family) {
+			g.turnedOff = append(g.turnedOff, family)
+		}
+		errors.LogInfo(context.Background(), "[tun] weak host send turned off for ", familyName(family), " on ", name, " while the TUN runs, as Windows would ignore autoOutboundsInterface")
+	}
+	if len(forwarding) > 0 {
+		return "forwarding is on for " + strings.Join(forwarding, " and ") + " on " + name + ", as Mobile Hotspot and Internet Connection Sharing turn it on, so Windows ignores autoOutboundsInterface there, and Xray's own connections go into the TUN and stall"
+	}
+	return ""
+}
+
+// recheck is check for a running TUN, which logs a forwarding problem once.
+func (g *outboundGuard) recheck() {
+	problem := g.check()
+	g.Lock()
+	changed := problem != g.reported
+	g.reported = problem
+	g.Unlock()
+	if changed && problem != "" {
+		errors.LogError(context.Background(), "[tun] ", problem)
+	}
+}
+
+// restore turns weak host send on again where check turned it off, for good.
+func (g *outboundGuard) restore() {
+	g.Lock()
+	defer g.Unlock()
+	g.restoreLocked()
+	g.stopped = true
+}
+
+func (g *outboundGuard) restoreLocked() {
+	for _, family := range g.turnedOff {
+		if row, err := g.luid.IPInterface(family); err == nil {
+			if err := setWeakHostSend(row, true); err != nil {
+				errors.LogWarningInner(context.Background(), err, "[tun] unable to turn weak host send on again for ", familyName(family))
+			}
+		}
+	}
+	g.turnedOff = nil
+}
+
+func setWeakHostSend(row *winipcfg.MibIPInterfaceRow, on bool) error {
+	row.WeakHostSend = on
+	if row.Family == windows.AF_INET {
+		row.SitePrefixLength = 0 // as SetIpInterfaceEntry requires for IPv4
+	}
+	return row.Set()
+}
+
+func familyName(family winipcfg.AddressFamily) string {
+	if family == windows.AF_INET {
+		return "IPv4"
+	}
+	return "IPv6"
+}