操作系统和版本
Windows 11 Insider Preview, version 26200 (x64)
预期情况
In TUN mode, traffic from specific applications (e.g., Google Chrome) should be detected by the "App" routing rule and sent to the "Proxy" outbound. Process name matching should work as it does in v7.16.6.
实际情况
In v7.17.1, traffic from applications fails to match the "App" rule. Xray logs show "raw-read tcp" connection resets because the traffic falls through to the "Final" rule (which is set to Direct), instead of being routed to Proxy. The GUI seems to generate an incorrect config regarding sniffing or inbound settings for TUN mode.
复现方法
I performed a cross-test to isolate the issue. The problem is NOT in the Xray/Sing-box cores, but in the v2rayN.exe (v7.17.1) itself.
Test Environment:
- OS: Windows 11 Build 26200
- Routing Rule: "App" -> Proxy, "Final" -> Direct.
Experiments:
- v7.17.1 Clean Install -> FAILS. Traffic ignores App rule, goes Direct, and gets blocked/reset.
- v7.16.6 Clean Install -> WORKS. Traffic matches App rule, goes Proxy.
- v7.16.6 GUI + Cores from v7.17.1 -> WORKS. (Proof that new cores are fine).
- v7.17.1 GUI + Cores from v7.16.6 -> FAILS. (Proof that v7.17.1 GUI logic/config generation is broken).
It seems v7.17.1 generates a config.json that breaks process matching (sniffing) on this Windows build.
软件日志
No GUI crash errors. The issue is in routing logic (see Core Logs below).
内核日志
-- v7.17.1 (FAILED) --
Xray 25.10.15 (Xray, Penetrates Everything.)
[Info] infra/conf/serial: Reading config: &{Name:config.json Format:json}
[Warning] core: Xray 25.10.15 started
...
connection: connection download closed: raw-read tcp 192.168.x.x:50513->64.233.164.188:5228: An existing connection was forcibly closed by the remote host.
connection: connection download closed: raw-read tcp 192.168.x.x:60307->173.194.73.188:5228: An existing connection was forcibly closed by the remote host.
(Traffic goes Direct and fails)
-- v7.16.6 with same settings (SUCCESS) --
Xray 25.10.15 (Xray, Penetrates Everything.)
[Info] infra/conf/serial: Reading config: &{Name:config.json Format:json}
[Warning] core: Xray 25.10.15 started
...
from tcp:127.0.0.1:63696 accepted tcp:www.google.com:443 [socks -> proxy]
from tcp:127.0.0.1:59041 accepted tcp:142.250.153.188:5228 [socks -> proxy]
(Traffic matches the rule and goes to Proxy)
(Result: Site works because it was correctly routed to Proxy via App rule)
额外信息
This issue might be related to how v7.17.1 handles "sniffing" or "inbound" configuration for the Tun interface on Windows Insider builds.
我确认已更新至最新版本
我确认已查询历史issues
我确认系统版本是受支持的
操作系统和版本
Windows 11 Insider Preview, version 26200 (x64)
预期情况
In TUN mode, traffic from specific applications (e.g., Google Chrome) should be detected by the "App" routing rule and sent to the "Proxy" outbound. Process name matching should work as it does in v7.16.6.
实际情况
In v7.17.1, traffic from applications fails to match the "App" rule. Xray logs show "raw-read tcp" connection resets because the traffic falls through to the "Final" rule (which is set to Direct), instead of being routed to Proxy. The GUI seems to generate an incorrect config regarding sniffing or inbound settings for TUN mode.
复现方法
I performed a cross-test to isolate the issue. The problem is NOT in the Xray/Sing-box cores, but in the v2rayN.exe (v7.17.1) itself.
Test Environment:
Experiments:
It seems v7.17.1 generates a
config.jsonthat breaks process matching (sniffing) on this Windows build.软件日志
No GUI crash errors. The issue is in routing logic (see Core Logs below).
内核日志
-- v7.17.1 (FAILED) --
Xray 25.10.15 (Xray, Penetrates Everything.)
[Info] infra/conf/serial: Reading config: &{Name:config.json Format:json}
[Warning] core: Xray 25.10.15 started
...
connection: connection download closed: raw-read tcp 192.168.x.x:50513->64.233.164.188:5228: An existing connection was forcibly closed by the remote host.
connection: connection download closed: raw-read tcp 192.168.x.x:60307->173.194.73.188:5228: An existing connection was forcibly closed by the remote host.
(Traffic goes Direct and fails)
-- v7.16.6 with same settings (SUCCESS) --
Xray 25.10.15 (Xray, Penetrates Everything.)
[Info] infra/conf/serial: Reading config: &{Name:config.json Format:json}
[Warning] core: Xray 25.10.15 started
...
from tcp:127.0.0.1:63696 accepted tcp:www.google.com:443 [socks -> proxy]
from tcp:127.0.0.1:59041 accepted tcp:142.250.153.188:5228 [socks -> proxy]
(Traffic matches the rule and goes to Proxy)
(Result: Site works because it was correctly routed to Proxy via App rule)
额外信息
This issue might be related to how v7.17.1 handles "sniffing" or "inbound" configuration for the Tun interface on Windows Insider builds.
我确认已更新至最新版本
我确认已查询历史issues
我确认系统版本是受支持的