xray doesn't release connections in tproxy mode?

[orthoxerox]

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
• I searched issues and did not find any similar issues.
• The problem can be successfully reproduced in the latest Release

Description

I run xray via v2raya on OpenWRT (xray manually updated to 25.3.6). I've noticed that in tproxy mode the xray process consumes more and more memory until it's killed by the OS or I restart it from the v2raya UI. I tried investigating it and it looks like it doesn't release connections:

When I run gops to examine the process, it shows a whole lot of connections like these (IPs mangled to protect people's privacy), literally tens of thousands of them:

local/remote:	99.237.226.46:30832 <-> 0.0.0.0:0 (NONE)
local/remote:	80.71.157.148:57456 <-> 0.0.0.0:0 (NONE)

Active connections look like this:

local/remote:	4.110.8.10:6881 <-> nas-lan-ip:49711 (ESTABLISHED)

If I shut down my BitTorrent client (running on a different machine on the LAN), the growth is stopped, but existing connections aren't removed.

Reproduction Method

Configuration:

1. Machine X (NAS) with Transmission running in a container, only ports 9091 and 51413 (TCP and UDP) are passed through, UPnP is disabled, Transmission confirms that it's running in a passive mode (can't accept incoming connections).
2. Machine Y (router) with OpenWRT, v2raya and xray. xray is configured as shown below.

Client config

Details

{
    "inbounds": [
      {
        "port": 52345,
        "protocol": "dokodemo-door",
        "listen": "127.0.0.1",
        "sniffing": {
          "enabled": true,
          "destOverride": [
            "http",
            "tls",
            "quic"
          ],
          "metadataOnly": false,
          "domainsExcluded": [
            ""
          ]
        },
        "settings": {
          "network": "tcp,udp",
          "followRedirect": true
        },
        "streamSettings": {
          "sockopt": {
            "tproxy": "tproxy"
          }
        },
        "tag": "transparent_ipv4"
      },
      {
        "port": 39391,
        "protocol": "dokodemo-door",
        "listen": "127.0.0.1",
        "sniffing": {
          "enabled": false,
          "metadataOnly": false,
          "domainsExcluded": null
        },
        "settings": {
          "address": "127.0.0.1"
        },
        "streamSettings": null,
        "tag": "api-in_ipv4"
      }
    ],
    "outbounds": [
      {
        "tag": "proxy",
        "protocol": "shadowsocks",
        "settings": {
          "servers": [
            {
              "address": "xray-server-ip",
              "method": "aes-256-gcm",
              "password": "redacted",
              "port": 443
            }
          ]
        },
        "streamSettings": {
          "sockopt": {
            "mark": 128
          }
        }
      },
      {
        "tag": "direct",
        "protocol": "freedom",
        "settings": {
          "domainStrategy": "UseIP"
        },
        "streamSettings": {
          "sockopt": {
            "mark": 128
          }
        }
      },
      {
        "tag": "block",
        "protocol": "blackhole",
        "settings": {}
      }
    ],
    "routing": {
      "domainStrategy": "IPOnDemand",
      "domainMatcher": "mph",
      "rules": [
        {
          "type": "field",
          "outboundTag": "direct",
          "ip": [
            ""
          ],
          "port": "443"
        },
        {
          "type": "field",
          "outboundTag": "direct",
          "inboundTag": [
            "transparent_ipv4"
          ],
          "ip": [
            "geoip:private",
            "127.0.0.1/8",
            "router-wan-ip/23",
            "192.168.1.1/24",
            "::1/128",
            "fe80::11:4ff:fef5:8700/64"
          ],
          "port": "53"
        },
        {
          "type": "field",
          "outboundTag": "direct",
          "inboundTag": [
            "transparent_ipv4"
          ],
          "domain": [
            "geosite:category-ru",
            "geosite:category-gov-ru"
          ]
        },
        {
          "type": "field",
          "outboundTag": "direct",
          "inboundTag": [
            "transparent_ipv4"
          ],
          "ip": [
            "geoip:private",
            "geoip:ru",
            "127.0.0.1/8",
            "router-wan-ip/23",
            "192.168.1.1/24",
            "::1/128",
            "fe80::11:4ff:fef5:8700/64"
          ]
        },
        {
          "type": "field",
          "outboundTag": "proxy",
          "inboundTag": [
            "transparent_ipv4"
          ]
        },
        {
          "type": "field",
          "outboundTag": "api-out",
          "inboundTag": [
            "api-in_ipv4"
          ]
        },
        {
          "type": "field",
          "outboundTag": "proxy",
          "port": "0-65535"
        }
      ]
    },
    "api": {
      "tag": "api-out",
      "services": [
        "LoggerService"
      ]
    }
  }

Server config

Details

NA

Client log

Details

IPs mangled to protect people's privacy
2025/04/04 11:40:53.554 [I] [io.go:432] from nas-lan-ip:56269 accepted tcp:6.246.106.37:24638 [transparent_ipv4 -> proxy]
2025/04/04 11:40:53.679 [I] [io.go:432] from nas-lan-ip:38915 accepted tcp:9.231.24.254:55209 [transparent_ipv4 -> proxy]
2025/04/04 11:40:54.038 [I] [io.go:432] from nas-lan-ip:33882 accepted tcp:9.59.243.228:443 [transparent_ipv4 -> proxy]
2025/04/04 11:40:54.555 [I] [io.go:432] from nas-lan-ip:33111 accepted tcp:4.190.122.240:26765 [transparent_ipv4 -> direct]
2025/04/04 11:40:54.737 [I] [io.go:432] from nas-lan-ip:46349 accepted tcp:4.16.132.104:49488 [transparent_ipv4 -> proxy]
2025/04/04 11:40:54.835 [I] [io.go:432] from nas-lan-ip:45879 accepted tcp:9.194.38.104:41131 [transparent_ipv4 -> proxy]
2025/04/04 11:40:55.556 [I] [io.go:432] from nas-lan-ip:52223 accepted tcp:9.199.203.107:59595 [transparent_ipv4 -> proxy]
2025/04/04 11:40:55.556 [I] [io.go:432] from nas-lan-ip:35117 accepted tcp:2.219.90.74:57881 [transparent_ipv4 -> proxy]
2025/04/04 11:40:55.655 [I] [io.go:432] from nas-lan-ip:58827 accepted tcp:1.29.192.18:64109 [transparent_ipv4 -> proxy]
2025/04/04 11:40:56.998 [I] [io.go:432] from nas-lan-ip:47609 accepted tcp:9.46.251.235:26329 [transparent_ipv4 -> proxy]
2025/04/04 11:40:57.212 [I] [io.go:432] from nas-lan-ip:42189 accepted tcp:6.246.106.37:24638 [transparent_ipv4 -> proxy]
2025/04/04 11:40:57.555 [I] [io.go:432] from nas-lan-ip:45889 accepted tcp:2.95.181.170:12992 [transparent_ipv4 -> proxy]
2025/04/04 11:40:57.981 [I] [io.go:432] from nas-lan-ip:45355 accepted tcp:3.200.3.23:2031 [transparent_ipv4 -> proxy]
2025/04/04 11:40:57.981 [I] [io.go:432] from nas-lan-ip:43269 accepted tcp:8.38.156.146:53029 [transparent_ipv4 -> proxy]
2025/04/04 11:40:57.981 [I] [io.go:432] from nas-lan-ip:53943 accepted tcp:3.134.135.63:62726 [transparent_ipv4 -> proxy]
2025/04/04 11:40:57.981 [I] [io.go:432] from nas-lan-ip:44167 accepted tcp:2.233.4.78:28530 [transparent_ipv4 -> proxy]
2025/04/04 11:40:58.992 [I] [io.go:432] from nas-lan-ip:60001 accepted tcp:7.34.65.148:14410 [transparent_ipv4 -> proxy]
2025/04/04 11:40:59.092 [I] [io.go:432] from nas-lan-ip:55439 accepted tcp:2.219.90.74:57881 [transparent_ipv4 -> proxy]
2025/04/04 11:40:59.557 [I] [io.go:432] from nas-lan-ip:49335 accepted tcp:3.205.248.150:44444 [transparent_ipv4 -> proxy]
2025/04/04 11:40:59.559 [I] [io.go:432] from nas-lan-ip:33167 accepted tcp:3.71.17.173:59064 [transparent_ipv4 -> proxy]
2025/04/04 11:40:59.561 [I] [io.go:432] from nas-lan-ip:42995 accepted tcp:8.108.102.8:6881 [transparent_ipv4 -> proxy]
2025/04/04 11:40:59.566 [I] [io.go:432] from nas-lan-ip:48061 accepted tcp:1.158.202.120:6943 [transparent_ipv4 -> proxy]
2025/04/04 11:40:59.569 [I] [io.go:432] from nas-lan-ip:60903 accepted tcp:9.231.24.254:55209 [transparent_ipv4 -> proxy]

Server log

Details

NA

[Fangliding]

UDP tproxy 原理如此 核心并不知道UDP何时"关闭" 只能设置一个超时时间回收 UDP socket 我记得的话这个值大概是一分钟还是多少 短时间内建立巨量UDP连接(比如bt下载)可能导致这样的问题 显得大量连接未关闭
你可以尝试建立单个UDP连接发送数据后观测这个 socket 可以存活多久 如果超过五分钟没有数据包传输 socket 还是存在请再次报告
个人建议不要通过 tproxy 进行 bt 下载 这并不合适 大多数 bt 客户端应该都有 socks5 代理功能

[orthoxerox]

I tested this with a single UDP packet, and the socket is removed successfully. I'll switch Transmission to a socks5 proxy, thank you.