github.com/sagernet/sing-box@v1.2.7/docs/configuration/inbound/tun.md (about)

     1  !!! error ""
     2  
     3      Only supported on Linux, Windows and macOS.
     4  
     5  ### Structure
     6  
     7  ```json
     8  {
     9    "type": "tun",
    10    "tag": "tun-in",
    11    "interface_name": "tun0",
    12    "inet4_address": "172.19.0.1/30",
    13    "inet6_address": "fdfe:dcba:9876::1/126",
    14    "mtu": 9000,
    15    "auto_route": true,
    16    "strict_route": true,
    17    "inet4_route_address": [
    18      "0.0.0.0/1",
    19      "128.0.0.0/1"
    20    ],
    21    "inet6_route_address": [
    22      "::/1",
    23      "8000::/1"
    24    ],
    25    "endpoint_independent_nat": false,
    26    "stack": "system",
    27    "include_uid": [
    28      0
    29    ],
    30    "include_uid_range": [
    31      "1000-99999"
    32    ],
    33    "exclude_uid": [
    34      1000
    35    ],
    36    "exclude_uid_range": [
    37      "1000-99999"
    38    ],
    39    "include_android_user": [
    40      0,
    41      10
    42    ],
    43    "include_package": [
    44      "com.android.chrome"
    45    ],
    46    "exclude_package": [
    47      "com.android.captiveportallogin"
    48    ],
    49    "platform": {
    50      "http_proxy": {
    51        "enabled": false,
    52        "server": "127.0.0.1",
    53        "server_port": 8080
    54      }
    55    },
    56    
    57    ... // Listen Fields
    58  }
    59  ```
    60  
    61  !!! note ""
    62  
    63      You can ignore the JSON Array [] tag when the content is only one item
    64  
    65  !!! warning ""
    66  
    67      If tun is running in non-privileged mode, addresses and MTU will not be configured automatically, please make sure the settings are accurate.
    68  
    69  ### Fields
    70  
    71  #### interface_name
    72  
    73  Virtual device name, automatically selected if empty.
    74  
    75  #### inet4_address
    76  
    77  ==Required==
    78  
    79  IPv4 prefix for the tun interface.
    80  
    81  #### inet6_address
    82  
    83  IPv6 prefix for the tun interface.
    84  
    85  #### mtu
    86  
    87  The maximum transmission unit.
    88  
    89  #### auto_route
    90  
    91  Set the default route to the Tun.
    92  
    93  !!! error ""
    94  
    95      To avoid traffic loopback, set `route.auto_detect_interface` or `route.default_interface` or `outbound.bind_interface`
    96  
    97  !!! note "Use with Android VPN"
    98  
    99      By default, VPN takes precedence over tun. To make tun go through VPN, enable `route.override_android_vpn`.
   100  
   101  #### strict_route
   102  
   103  Enforce strict routing rules when `auto_route` is enabled:
   104  
   105  *In Linux*:
   106  
   107  * Let unsupported network unreachable
   108  * Route all connections to tun
   109  
   110  It prevents address leaks and makes DNS hijacking work on Android, but your device will not be accessible by others.
   111  
   112  *In Windows*:
   113  
   114  * Add firewall rules to prevent DNS leak caused by
   115    Windows' [ordinary multihomed DNS resolution behavior](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197552%28v%3Dws.10%29)
   116  
   117  It may prevent some applications (such as VirtualBox) from working properly in certain situations.
   118  
   119  #### inet4_route_address
   120  
   121  Use custom routes instead of default when `auto_route` is enabled.
   122  
   123  #### inet6_route_address
   124  
   125  Use custom routes instead of default when `auto_route` is enabled.
   126  
   127  #### endpoint_independent_nat
   128  
   129  !!! info ""
   130  
   131      This item is only available on the gvisor stack, other stacks are endpoint-independent NAT by default.
   132  
   133  Enable endpoint-independent NAT.
   134  
   135  Performance may degrade slightly, so it is not recommended to enable on when it is not needed.
   136  
   137  #### udp_timeout
   138  
   139  UDP NAT expiration time in seconds, default is 300 (5 minutes).
   140  
   141  #### stack
   142  
   143  TCP/IP stack.
   144  
   145  | Stack            | Description                                                                      | Status            |
   146  |------------------|----------------------------------------------------------------------------------|-------------------|
   147  | system (default) | Sometimes better performance                                                     | recommended       |
   148  | gVisor           | Better compatibility, based on [google/gvisor](https://github.com/google/gvisor) | recommended       |
   149  | LWIP             | Based on [eycorsican/go-tun2socks](https://github.com/eycorsican/go-tun2socks)   | upstream archived |
   150  
   151  !!! warning ""
   152  
   153      gVisor and LWIP stacks is not included by default, see [Installation](/#installation).
   154  
   155  #### include_uid
   156  
   157  !!! error ""
   158  
   159      UID rules are only supported on Linux and require auto_route.
   160  
   161  Limit users in route. Not limited by default.
   162  
   163  #### include_uid_range
   164  
   165  Limit users in route, but in range.
   166  
   167  #### exclude_uid
   168  
   169  Exclude users in route.
   170  
   171  #### exclude_uid_range
   172  
   173  Exclude users in route, but in range.
   174  
   175  #### include_android_user
   176  
   177  !!! error ""
   178  
   179      Android user and package rules are only supported on Android and require auto_route.
   180  
   181  Limit android users in route.
   182  
   183  | Common user  | ID  |
   184  |--------------|-----|
   185  | Main         | 0   |
   186  | Work Profile | 10  |
   187  
   188  #### include_package
   189  
   190  Limit android packages in route.
   191  
   192  #### exclude_package
   193  
   194  Exclude android packages in route.
   195  
   196  #### platform
   197  
   198  Platform-specific settings, provided by client applications.
   199  
   200  #### platform.http_proxy
   201  
   202  System HTTP proxy settings.
   203  
   204  ### Listen Fields
   205  
   206  See [Listen Fields](/configuration/shared/listen) for details.