Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

QQ音乐(p2p/udp？)导致VPN断开 #1890

Open
5 tasks done
yanhao98 opened this issue Jun 25, 2024 · 7 comments
Open
5 tasks done

QQ音乐(p2p/udp？)导致VPN断开 #1890

yanhao98 opened this issue Jun 25, 2024 · 7 comments

Comments

@yanhao98
Copy link

操作系统

iOS

系统版本

iOS 17.5.1（21F90）：iPhone 15 Pro、iPhone 11 Pro Max

安装类型

sing-box 原始命令行程序

如果您使用图形客户端程序，请提供该程序版本。

1.9.3

版本

No response

描述

使用QQ音乐听歌听一会就会导致VPN断开。（下面有我自己的解决方法。）

之前提过一次 #1858 （可忽略），我希望我这里能提供更多信息，所以又进行测试后再提一次。

断开后 metacubexd 的截图。

image

重现方式

我获取日志的代码

因为我不知道怎么能拿到iOS上的日志文件。所以在手机上点了 Enabled 后马上运行这个脚本来监听ws拿日志。

import * as fs from "fs";
const ws = new WebSocket("ws://192.168.31.92:9090/logs?token=&level=trace");

const filePath = "mobile.log";
ws.addEventListener("open", () => {
  console.log("WebSocket 连接已打开");
  fs.writeFileSync(filePath, "");
  fs.appendFileSync(filePath, `启动时间: ${new Date().toLocaleString()}\n`);
});

ws.addEventListener("message", (event) => {
  const message = `收到消息: ${event.data}`;
  console.log(message);
  fs.appendFileSync(filePath, event.data);
});

ws.addEventListener("close", (event) => {
  console.log(`WebSocket 连接已关闭，代码: ${event.code}, 原因: ${event.reason}`);
  fs.appendFileSync(filePath, `关闭时间: ${new Date().toLocaleString()}\n`);
});

ws.addEventListener("error", (error) => {
  console.error("WebSocket 连接出错:", error);
});

下面两个配置的区别

如果让这个域名 twns.p2ptun.qq.com 🚫_dns_block 或者 🎭_fakeip VPN都不会断开。

{
  "dns": {
    "rules": [
      // { "query_type": [ "A", "AAAA" ], "server": "🎭_fakeip" }
      // { "domain": "twns.p2ptun.qq.com", "server": "🎭_fakeip" }
      { "domain": "twns.p2ptun.qq.com", "server": "🚫_dns_block" }
    ]
  }
}

会导致断开的配置

{
  "log": { "level": "trace", "disabled": false, "output": "box.log", "timestamp": true },
  "experimental": {
    "clash_api": { "external_controller": "0.0.0.0:9090", "default_mode": "📜 规则" },
    "cache_file": { "enabled": true, "path": "cache.db", "store_fakeip": true, "store_rdrc": true }
  },
  "dns": {
    "strategy": "ipv4_only",
    "servers": [
      { "tag": "🏠_local_dns", "address": "h3://223.5.5.5/dns-query", "detour": "📶_不代理" }
    ]
  },
  "inbounds": [
    { "tag": "🚇", "type": "tun", "stack": "gvisor", "inet4_address": "172.19.0.1/30", "auto_route": true, "strict_route": false, "endpoint_independent_nat": false, "sniff": true }
  ],
  "route": {
    "final": "📶_不代理", "auto_detect_interface": true,
    "rules": [
      { "outbound": "🧩_DNS解析", "protocol": "dns" },
      { "outbound": "🧩_DNS解析", "port": 53 },
      { "outbound": "📶_不代理", "ip_is_private": true }
    ]
  },
  "outbounds": [
    { "tag": "📶_不代理", "type": "direct" },
    { "tag": "🧩_DNS解析", "type": "dns" }
  ]
}

会导致断开的配置的日志

mobile-realip.log

可以正常使用的配置

{
  "log": { "level": "trace", "disabled": false, "output": "box.log", "timestamp": true },
  "experimental": {
    "clash_api": { "external_controller": "0.0.0.0:9090", "default_mode": "📜 规则" },
    "cache_file": { "enabled": true, "path": "cache.db", "store_fakeip": true, "store_rdrc": true }
  },
  "dns": {
    "strategy": "ipv4_only",
    "servers": [
      { "tag": "🏠_local_dns", "address": "h3://223.5.5.5/dns-query", "detour": "📶_不代理" },
      { "tag": "🎭_fakeip", "address": "fakeip" },
      { "tag": "🚫_dns_block", "address": "rcode://success" }
    ],
    "rules": [
      // { "query_type": [ "A", "AAAA" ], "server": "🎭_fakeip" }
      // { "domain": "twns.p2ptun.qq.com", "server": "🎭_fakeip" }
      { "domain": "twns.p2ptun.qq.com", "server": "🚫_dns_block" }
    ],
    "fakeip": { "enabled": true, "inet4_range": "198.18.0.0/15" }
  },
  "inbounds": [
    { "tag": "🚇", "type": "tun", "stack": "gvisor", "inet4_address": "172.19.0.1/30", "auto_route": true, "strict_route": false, "endpoint_independent_nat": false, "sniff": true }
  ],
  "route": {
    "final": "📶_不代理", "auto_detect_interface": true,
    "rules": [
      { "outbound": "🧩_DNS解析", "protocol": "dns" },
      { "outbound": "🧩_DNS解析", "port": 53 },
      { "outbound": "📶_不代理", "ip_is_private": true }
    ]
  },
  "outbounds": [
    { "tag": "📶_不代理", "type": "direct" },
    { "tag": "🧩_DNS解析", "type": "dns" }
  ]
}

可以正常使用的配置的日志 🚫_dns_block

mobile-dns_block.log

可以正常使用的配置的日志 🎭_fakeip

mobile-fakeip.log

日志

Settings - View Service Log: 没有崩溃日志。

Service Log 没有内容显示：Empty content，
如果需要提供更多信息，请指导我如何提供“”

支持我们

完整性要求

  • 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
  • 我保证提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
  • 我保证提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器、TUN、图形界面客户端或者其他闭源软件。
  • 我保证提供了完整的配置文件与日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。
@yanhao98 yanhao98 changed the title QQ音乐(p2p/udp)导致VPN断开 QQ音乐(p2p/udp？)导致VPN断开 Jun 25, 2024
@nekohasekai
Copy link
Member

感谢测试，是否可以再测试 sniff + protocol stun block 能否识别到？

以及网易云也有类似的情况，不知道有没有解决办法。

@yanhao98
Copy link
Author

感谢测试，是否可以再测试 sniff + protocol stun block 能否识别到？

以及网易云也有类似的情况，不知道有没有解决办法。

是否是这样。下面两个配置分别是：
①：dns.rules{ "protocol": ["stun"], "server": "🚫_dns_block" } 有问题
②：①基础上 + inbounds 中的 tun: "sniff_override_destination": true 有问题
日志中好像也没有 sniffed packet protocol: stun

// 这样也试过，也有问题。

{
  "route": {
    "rules": [
      { "protocol": "stun","outbound":"🚫_拦截" }
    ]
  },
  "outbounds": [
    { "tag": "🚫_拦截", "type": "block" }
  ]
}
配置文件 
{
  "log": { "level": "trace", "disabled": false, "output": "box.log", "timestamp": true },
  "experimental": {
    "clash_api": { "external_controller": "0.0.0.0:9090", "default_mode": "📜 规则" },
    "cache_file": { "enabled": true, "path": "cache.db", "store_fakeip": true, "store_rdrc": true }
  },
  "dns": {
    "strategy": "ipv4_only",
    "servers": [
      { "tag": "🏠_local_dns", "address": "h3://223.5.5.5/dns-query", "detour": "📶_不代理" },
      { "tag": "🚫_dns_block", "address": "rcode://success" }
    ],
    "rules": [
      { "protocol": ["stun"], "server": "🚫_dns_block" }
    ]
  },
  "inbounds": [
    { "tag": "🚇", "type": "tun", "stack": "gvisor", "inet4_address": "172.19.0.1/30", "auto_route": true, "strict_route": false, "endpoint_independent_nat": false, "sniff": true }
  ],
  "route": {
    "final": "📶_不代理", "auto_detect_interface": true,
    "rules": [
      { "outbound": "🧩_DNS解析", "protocol": "dns" },
      { "outbound": "🧩_DNS解析", "port": 53 },
      { "outbound": "📶_不代理", "ip_is_private": true }
    ]
  },
  "outbounds": [
    { "tag": "📶_不代理", "type": "direct" },
    { "tag": "🧩_DNS解析", "type": "dns" }
  ]
}

日志：
测QQ音乐 dns_protocol_stun_block.log

配置文件 
{
  "log": { "level": "trace", "disabled": false, "output": "box.log", "timestamp": true },
  "experimental": {
    "clash_api": { "external_controller": "0.0.0.0:9090", "default_mode": "📜 规则" },
    "cache_file": { "enabled": true, "path": "cache.db", "store_fakeip": true, "store_rdrc": true }
  },
  "dns": {
    "strategy": "ipv4_only",
    "servers": [
      { "tag": "🏠_local_dns", "address": "h3://223.5.5.5/dns-query", "detour": "📶_不代理" },
      { "tag": "🚫_dns_block", "address": "rcode://success" }
    ],
    "rules": [
      { "protocol": ["stun"], "server": "🚫_dns_block" }
    ]
  },
  "inbounds": [
    { "tag": "🚇", "type": "tun", "stack": "gvisor", "inet4_address": "172.19.0.1/30", "auto_route": true, "strict_route": false, "endpoint_independent_nat": false, 
      "sniff": true, // 这个之前的上面的配置就是这样。
      "sniff_override_destination": true // 增加了这里
    }
  ],
  "route": {
    "final": "📶_不代理", "auto_detect_interface": true,
    "rules": [
      { "outbound": "🧩_DNS解析", "protocol": "dns" },
      { "outbound": "🧩_DNS解析", "port": 53 },
      { "outbound": "📶_不代理", "ip_is_private": true }
    ]
  },
  "outbounds": [
    { "tag": "📶_不代理", "type": "direct" },
    { "tag": "🧩_DNS解析", "type": "dns" }
  ]
}

日志：
测QQ音乐-stun_sniff_override_destination.log

@yanhao98
Copy link
Author

yanhao98 commented Jun 25, 2024 •
edited
Loading

然后补充一下，这是Mac上面的QQ音乐，Mac没有问题。（只会有几个UDP连接）

image image

iOS上面目前我观察到每次都是301个。其中有一次出现了两个301。

IMG_2549

这个问题确实困扰了我很久，对我而言使用 dns_block 或 fake_ip 算是解决了...

还有一种情况就是：全局代理时（应该）也不会出现问题。如果需要更多测试我很愿意帮忙（我这里也只能帮到这个忙了。）

@nekohasekai
Copy link
Member

inbound packet connection to 113.108.28.102:3478

你能提供首个连接到端口 3478 的 UDP 数据包 Wireshark 抓包文件吗？

@yanhao98
Copy link
Author

yanhao98 commented Jun 25, 2024 •
edited
Loading

inbound packet connection to 113.108.28.102:3478

你能提供首个连接到端口 3478 的 UDP 数据包 Wireshark 抓包文件吗？

Wireshark 我之前没有实际使用过。我按照以下步骤操作提供日志和抓包文件。

测试准备：
手机和Mac通过USB连接，Mac运行 rvictl -s 手机UUID。Wireshark 监听网卡 rvi0
Wireshark有一个提示，但是数据能监听到。不知道是否有影响。
image

这一次测试出现了很多个IP（测试设备不同）（最后断开VPN断开时的IP是 120.41.105.203:43575 ）。我看metacubexd的观察：好像前面的IP的连接个数都是刚开始 301 个连接，然后很快变成了1 。

image image image
配置文件(也就是最开始的【会导致断开的配置】) 
{
  "log": { "level": "trace", "disabled": false, "output": "box.log", "timestamp": true },
  "experimental": {
    "clash_api": { "external_controller": "0.0.0.0:9090", "default_mode": "📜 规则" },
    "cache_file": { "enabled": true, "path": "cache.db", "store_fakeip": true, "store_rdrc": true }
  },
  "dns": {
    "strategy": "ipv4_only",
    "servers": [
      { "tag": "🏠_local_dns", "address": "h3://223.5.5.5/dns-query", "detour": "📶_不代理" }
    ]
  },
  "inbounds": [
    { "tag": "🚇", "type": "tun", "stack": "gvisor", "inet4_address": "172.19.0.1/30", "auto_route": true, "strict_route": false, "endpoint_independent_nat": false, "sniff": true }
  ],
  "route": {
    "final": "📶_不代理", "auto_detect_interface": true,
    "rules": [
      { "outbound": "🧩_DNS解析", "protocol": "dns" },
      { "outbound": "🧩_DNS解析", "port": 53 },
      { "outbound": "📶_不代理", "ip_is_private": true }
    ]
  },
  "outbounds": [
    { "tag": "📶_不代理", "type": "direct" },
    { "tag": "🧩_DNS解析", "type": "dns" }
  ]
}

sing-box 日志：
测QQ音乐-Wireshark.log

Wireshark 的抓包文件超过25MB了，我上传到了这里：
https://github.com/yanhao98/files/releases/tag/sing-box-files

然后好像我看了下这些建立UDP连接的IP，在日志中没有看到是哪个域名的解析结果。
twns.p2ptun.qq.com的解析结果的IP倒是也有进行连接。

{"type":"info","payload":"dns: exchanged twns.p2ptun.qq.com A twns.p2ptun.qq.com. 8 IN A 112.60.24.38"}
{"type":"info","payload":"[4204896304 0ms] inbound/tun[🚇]: inbound packet connection to 112.60.24.38:3478"}

@yyysuo
Copy link

yyysuo commented Jul 1, 2024

环境与楼主相同，只不过手机是14 plus，用gvisor就会断开，屏蔽了楼主提供的域名也不行，只能缓解而已，改system就没问题了，另外这个问题实在是很久了，从1.7时代应该就有。

@yanhao98
Copy link
Author

yanhao98 commented Jul 1, 2024

环境与楼主相同，只不过手机是14 plus，用gvisor就会断开，屏蔽了楼主提供的域名也不行，只能缓解而已，改system就没问题了，另外这个问题实在是很久了，从1.7时代应该就有。

image

我用指定域名 fakeip + gvisor 已经用了3天10GB+的流量没有出现问题，我最开始尝试这样解决的时候是发现：我在全局代理的时候不会断开。然后尝试了全部都使用fakeip（也就是{ "query_type": [ "A", "AAAA" ], "server": "🎭_fakeip" }）。然后尝试了单独域名 fakeip。你也可以再试试全局代理或者全部使用fakeip呢。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@yyysuo @yanhao98 @nekohasekai