Allow customizing TUN DNS mode and hijack interface DNS by default

nekohasekai · nekohasekai · commit bb60b58f00f4 · 2026-05-02T19:18:41.000+08:00
diff --git a/docs/configuration/dns/rule.md b/docs/configuration/dns/rule.md
@@ -513,6 +513,7 @@ Match specified DNS servers' preferred domains.
 | `local`     | Match hosts entries, neighbor-resolved hosts, and mDNS local domains         |
 | `mdns`      | Match mDNS local domains (`*.local.` and IPv4/IPv6 link-local reverse zones) |
 | `tailscale` | Match MagicDNS hosts and DNS route suffixes                                  |
+| `resolved`  | Match split DNS and search domains from systemd-resolved links               |
 
 #### wifi_ssid
 
diff --git a/docs/configuration/dns/rule.zh.md b/docs/configuration/dns/rule.zh.md
@@ -505,6 +505,7 @@ Available values: `wifi`, `cellular`, `ethernet` and `other`.
 | `local`     | 匹配 hosts 中的条目、邻居解析得到的主机名以及 mDNS 本地域名                         |
 | `mdns`      | 匹配 mDNS 本地域名（`*.local.` 以及 IPv4/IPv6 链路本地反向区域）              |
 | `tailscale` | 匹配 MagicDNS 主机和 DNS 路由后缀                                    |
+| `resolved`  | 匹配 systemd-resolved 链路中的分流域名和搜索域                            |
 
 #### wifi_ssid
 
diff --git a/docs/configuration/dns/server/hosts.md b/docs/configuration/dns/server/hosts.md
@@ -89,13 +89,9 @@ Example:
             ],
             "rules": [
               {
-                "action": "evaluate",
+                "preferred_by": "hosts",
+                "action": "route",
                 "server": "hosts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
               }
             ]
           }
diff --git a/docs/configuration/dns/server/hosts.zh.md b/docs/configuration/dns/server/hosts.zh.md
@@ -89,13 +89,9 @@ hosts 文件路径列表。
             ],
             "rules": [
               {
-                "action": "evaluate",
+                "preferred_by": "hosts",
+                "action": "route",
                 "server": "hosts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
               }
             ]
           }
diff --git a/docs/configuration/dns/server/resolved.md b/docs/configuration/dns/server/resolved.md
@@ -61,13 +61,9 @@ If not enabled, `NXDOMAIN` will be returned for requests that do not match searc
             ],
             "rules": [
               {
-                "action": "evaluate",
+                "preferred_by": "resolved",
+                "action": "route",
                 "server": "resolved"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
               }
             ]
           }
diff --git a/docs/configuration/dns/server/resolved.zh.md b/docs/configuration/dns/server/resolved.zh.md
@@ -60,13 +60,9 @@ icon: material/new-box
             ],
             "rules": [
               {
-                "action": "evaluate",
+                "preferred_by": "resolved",
+                "action": "route",
                 "server": "resolved"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
               }
             ]
           }
diff --git a/docs/configuration/dns/server/tailscale.md b/docs/configuration/dns/server/tailscale.md
@@ -73,13 +73,9 @@ Default resolvers are not consulted for single-label queries regardless of `acce
             ],
             "rules": [
               {
-                "action": "evaluate",
+                "preferred_by": "ts",
+                "action": "route",
                 "server": "ts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
               }
             ]
           }
diff --git a/docs/configuration/dns/server/tailscale.zh.md b/docs/configuration/dns/server/tailscale.zh.md
@@ -73,13 +73,9 @@ icon: material/new-box
             ],
             "rules": [
               {
-                "action": "evaluate",
+                "preferred_by": "ts",
+                "action": "route",
                 "server": "ts"
-              },
-              {
-                "match_response": true,
-                "ip_accept_any": true,
-                "action": "respond"
               }
             ]
           }
diff --git a/docs/configuration/inbound/tun.md b/docs/configuration/inbound/tun.md
@@ -5,7 +5,9 @@ icon: material/new-box
 !!! quote "Changes in sing-box 1.14.0"
 
     :material-plus: [include_mac_address](#include_mac_address)  
-    :material-plus: [exclude_mac_address](#exclude_mac_address)
+    :material-plus: [exclude_mac_address](#exclude_mac_address)  
+    :material-plus: [dns_mode](#dns_mode)  
+    :material-plus: [dns_address](#dns_address)
 
 !!! quote "Changes in sing-box 1.13.3"
 
@@ -73,6 +75,11 @@ icon: material/new-box
     "fdfe:dcba:9876::1/126"
   ],
   "mtu": 9000,
+  "dns_mode": "hijack",
+  "dns_address": [
+    "172.18.0.2",
+    "fdfe:dcba:9876::2"
+  ],
   "auto_route": true,
   "iproute2_table_index": 2022,
   "iproute2_rule_index": 9000,
@@ -216,6 +223,52 @@ IPv6 prefix for the tun interface.
 
 The maximum transmission unit.
 
+#### dns_mode
+
+!!! question "Since sing-box 1.14.0"
+
+How DNS is handled on the TUN interface.
+
+| Mode       | Description                                                                                                                                                |
+|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `disabled` | Do not configure native DNS and do not hijack DNS traffic.                                                                                                 |
+| `native`   | Set the platform's native interface DNS where possible: per-interface DNS on Windows and Apple platforms, and `systemd-resolved` interface DNS on Linux.   |
+| `hijack`   | Same as `native`, with additional port 53 hijacking described below. Used by default.                                                                      |
+
+`hijack` adds the following on top of `native`:
+
+*On Linux*: only DNS sent to non-local destinations can be intercepted.
+Traffic destined to addresses on the host's own interfaces (such as
+`127.0.0.53` or the host's LAN-side IP) is delivered through the kernel
+`local` routing table before any user rule applies, and `OUTPUT` NAT cannot
+redirect packets going through `lo`.
+
+- Without `auto_redirect`, an `iproute2` rule makes port 53 skip the `main`
+  table's specific-route lookup, forcing DNS that would otherwise be
+  delivered through a directly-attached subnet through the TUN. Destination
+  addresses are not rewritten.
+- With `auto_redirect`, an nftables rule DNATs port 53 traffic directly to
+  [`dns_address`](#dns_address).
+
+*On Windows with [`strict_route`](#strict_route)*: a WFP filter blocks port
+53 traffic going through interfaces other than the TUN.
+
+#### dns_address
+
+!!! question "Since sing-box 1.14.0"
+
+List of DNS server addresses used by [`dns_mode`](#dns_mode).
+
+When unset, sing-box derives one address per family by taking the next IP after
+the first IPv4/IPv6 entry in [`address`](#address). Connections toward those
+derived addresses are additionally hijacked into the sing-box DNS module,
+equivalent to a [`hijack-dns`](/configuration/route/rule_action/#hijack-dns)
+route action; this preserves the behaviour from before this option was added.
+
+When set, this auto-hijack is not applied; configure an explicit
+[`hijack-dns`](/configuration/route/rule_action/#hijack-dns) route rule if the
+behaviour is still required.
+
 #### gso
 
 !!! failure "Deprecated in sing-box 1.11.0"
diff --git a/docs/configuration/inbound/tun.zh.md b/docs/configuration/inbound/tun.zh.md
@@ -5,7 +5,9 @@ icon: material/new-box
 !!! quote "sing-box 1.14.0 中的更改"
 
     :material-plus: [include_mac_address](#include_mac_address)  
-    :material-plus: [exclude_mac_address](#exclude_mac_address)
+    :material-plus: [exclude_mac_address](#exclude_mac_address)  
+    :material-plus: [dns_mode](#dns_mode)  
+    :material-plus: [dns_address](#dns_address)
 
 !!! quote "sing-box 1.13.3 中的更改"
 
@@ -73,6 +75,11 @@ icon: material/new-box
     "fdfe:dcba:9876::1/126"
   ],
   "mtu": 9000,
+  "dns_mode": "hijack",
+  "dns_address": [
+    "172.18.0.2",
+    "fdfe:dcba:9876::2"
+  ],
   "auto_route": true,
   "iproute2_table_index": 2022,
   "iproute2_rule_index": 9000,
@@ -222,6 +229,46 @@ tun 接口的 IPv6 前缀。
 
 最大传输单元。
 
+#### dns_mode
+
+!!! question "自 sing-box 1.14.0 起"
+
+TUN 接口上 DNS 的处理方式。
+
+| 模式       | 描述                                                                                                  |
+|------------|-------------------------------------------------------------------------------------------------------|
+| `disabled` | 不设置原生 DNS，也不劫持 DNS 流量。                                                                    |
+| `native`   | 尽可能设置平台的原生接口 DNS：Windows 与 Apple 上的接口 DNS，Linux 上的 `systemd-resolved` 接口 DNS。   |
+| `hijack`   | 与 `native` 相同，并额外执行下文所述的 53 端口劫持。默认使用。                                         |
+
+`hijack` 在 `native` 之上额外执行：
+
+*Linux*：只能劫持发往非本机地址的 DNS。发往本机接口地址（如 `127.0.0.53`
+或本机 LAN 接口 IP）的流量由内核 `local` 路由表在所有用户规则之前直接交付，
+`OUTPUT` 链 NAT 也无法对走 `lo` 的包生效。
+
+- 未启用 `auto_redirect` 时：通过 `iproute2` 规则让 53 端口跳过 `main` 表的
+  具体路由查找，把本来会经直连子网直接送达的 DNS 改走 TUN —— 不重写目的地址。
+- 启用 `auto_redirect` 时：通过 nftables 规则将 53 端口流量直接 DNAT 至
+  [`dns_address`](#dns_address)。
+
+*Windows 启用 [`strict_route`](#strict_route) 时*：通过 WFP 过滤器阻止经由非
+TUN 接口的 53 端口流量。
+
+#### dns_address
+
+!!! question "自 sing-box 1.14.0 起"
+
+[`dns_mode`](#dns_mode) 使用的 DNS 服务器地址列表。
+
+未设置时，sing-box 会按地址族在 [`address`](#address) 的第一个 IPv4/IPv6
+条目后面取下一个 IP 作为 DNS 服务器地址，并将流向这些推导地址的连接额外劫持到
+sing-box DNS 模块，等价于一条
+[`hijack-dns`](/zh/configuration/route/rule_action/#hijack-dns) 路由动作；这与此选项加入之前的行为一致。
+
+设置后，将不再自动劫持；如仍需此行为，请显式配置
+[`hijack-dns`](/zh/configuration/route/rule_action/#hijack-dns) 路由规则。
+
 #### gso
 
 !!! failure "已在 sing-box 1.11.0 废弃"
diff --git a/experimental/libbox/tun.go b/experimental/libbox/tun.go
@@ -7,13 +7,19 @@ import (
 	"github.com/sagernet/sing-box/option"
 	tun "github.com/sagernet/sing-tun"
 	"github.com/sagernet/sing/common"
-	E "github.com/sagernet/sing/common/exceptions"
+)
+
+const (
+	DNSModeDisabled = tun.DNSModeDisabled
+	DNSModeNative   = tun.DNSModeNative
+	DNSModeHijack   = tun.DNSModeHijack
 )
 
 type TunOptions interface {
 	GetInet4Address() RoutePrefixIterator
 	GetInet6Address() RoutePrefixIterator
-	GetDNSServerAddress() (*StringBox, error)
+	GetDNSMode() *StringBox
+	GetDNSServerAddress() (StringIterator, error)
 	GetMTU() int32
 	GetAutoRoute() bool
 	GetStrictRoute() bool
@@ -89,11 +95,16 @@ func (o *tunOptions) GetInet6Address() RoutePrefixIterator {
 	return mapRoutePrefix(o.Inet6Address)
 }
 
-func (o *tunOptions) GetDNSServerAddress() (*StringBox, error) {
-	if len(o.Inet4Address) == 0 || o.Inet4Address[0].Bits() == 32 {
-		return nil, E.New("need one more IPv4 address for DNS hijacking")
+func (o *tunOptions) GetDNSMode() *StringBox {
+	return wrapString(o.Options.DNSMode)
+}
+
+func (o *tunOptions) GetDNSServerAddress() (StringIterator, error) {
+	dnsServers, err := o.Options.DNSServerAddress()
+	if err != nil {
+		return nil, err
 	}
-	return wrapString(o.Inet4Address[0].Addr().Next().String()), nil
+	return newIterator(common.Map(dnsServers, netip.Addr.String)), nil
 }
 
 func (o *tunOptions) GetMTU() int32 {
diff --git a/go.mod b/go.mod
@@ -44,7 +44,7 @@ require (
 	github.com/sagernet/sing-shadowsocks v0.2.8
 	github.com/sagernet/sing-shadowsocks2 v0.2.1
 	github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11
-	github.com/sagernet/sing-tun v0.8.10-0.20260427231103-812b89ea042d
+	github.com/sagernet/sing-tun v0.8.10-0.20260502074200-87904db3a2c1
 	github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1
 	github.com/sagernet/smux v1.5.50-sing-box-mod.1
 	github.com/sagernet/tailscale v1.92.4-sing-box-1.13-mod.7
diff --git a/go.sum b/go.sum
@@ -256,8 +256,8 @@ github.com/sagernet/sing-shadowsocks2 v0.2.1 h1:dWV9OXCeFPuYGHb6IRqlSptVnSzOelnq
 github.com/sagernet/sing-shadowsocks2 v0.2.1/go.mod h1:RnXS0lExcDAovvDeniJ4IKa2IuChrdipolPYWBv9hWQ=
 github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11 h1:tK+75l64tm9WvEFrYRE1t0YxoFdWQqw/h7Uhzj0vJ+w=
 github.com/sagernet/sing-shadowtls v0.2.1-0.20250503051639-fcd445d33c11/go.mod h1:sWqKnGlMipCHaGsw1sTTlimyUpgzP4WP3pjhCsYt9oA=
-github.com/sagernet/sing-tun v0.8.10-0.20260427231103-812b89ea042d h1:rcFzy3rMpx9M/Zel+YLd2iNGHl0ElH7T8Pl7Y6oxPOQ=
-github.com/sagernet/sing-tun v0.8.10-0.20260427231103-812b89ea042d/go.mod h1:QvarqUtHfj1ULaRR+6kZOS/OoCE+pYGq67A5tyIy+dQ=
+github.com/sagernet/sing-tun v0.8.10-0.20260502074200-87904db3a2c1 h1:JaW/aRriLE4fgCBLM6wFlpDcscJwRmAgHVRgN0ePOkA=
+github.com/sagernet/sing-tun v0.8.10-0.20260502074200-87904db3a2c1/go.mod h1:QvarqUtHfj1ULaRR+6kZOS/OoCE+pYGq67A5tyIy+dQ=
 github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1 h1:aSwUNYUkVyVvdmBSufR8/nRFonwJeKSIROxHcm5br9o=
 github.com/sagernet/sing-vmess v0.2.8-0.20250909125414-3aed155119a1/go.mod h1:P11scgTxMxVVQ8dlM27yNm3Cro40mD0+gHbnqrNGDuY=
 github.com/sagernet/smux v1.5.50-sing-box-mod.1 h1:XkJcivBC9V4wBjiGXIXZ229aZCU1hzcbp6kSkkyQ478=
diff --git a/option/tun.go b/option/tun.go
@@ -14,6 +14,8 @@ type TunInboundOptions struct {
 	InterfaceName                 string                           `json:"interface_name,omitempty"`
 	MTU                           uint32                           `json:"mtu,omitempty"`
 	Address                       badoption.Listable[netip.Prefix] `json:"address,omitempty"`
+	DNSMode                       string                           `json:"dns_mode,omitempty"`
+	DNSAddress                    badoption.Listable[netip.Addr]   `json:"dns_address,omitempty"`
 	AutoRoute                     bool                             `json:"auto_route,omitempty"`
 	IPRoute2TableIndex            int                              `json:"iproute2_table_index,omitempty"`
 	IPRoute2RuleIndex             int                              `json:"iproute2_rule_index,omitempty"`
diff --git a/protocol/tun/hook.go b/protocol/tun/hook.go
diff --git a/protocol/tun/inbound.go b/protocol/tun/inbound.go
diff --git a/route/route.go b/route/route.go

Original file line number	Diff line number	Diff line change
`@@ -89,13 +89,9 @@ Example:`
`89`	`89`	`],`
`90`	`90`	`"rules": [`
`91`	`91`	`{`
`92`		`- "action": "evaluate",`
	`92`	`+ "preferred_by": "hosts",`
	`93`	`+ "action": "route",`
`93`	`94`	`"server": "hosts"`
`94`		`- },`
`95`		`- {`
`96`		`- "match_response": true,`
`97`		`- "ip_accept_any": true,`
`98`		`- "action": "respond"`
`99`	`95`	`}`
`100`	`96`	`]`
`101`	`97`	`}`
Original file line number	Diff line number	Diff line change
`@@ -89,13 +89,9 @@ hosts 文件路径列表。`
`89`	`89`	`],`
`90`	`90`	`"rules": [`
`91`	`91`	`{`
`92`		`- "action": "evaluate",`
	`92`	`+ "preferred_by": "hosts",`
	`93`	`+ "action": "route",`
`93`	`94`	`"server": "hosts"`
`94`		`- },`
`95`		`- {`
`96`		`- "match_response": true,`
`97`		`- "ip_accept_any": true,`
`98`		`- "action": "respond"`
`99`	`95`	`}`
`100`	`96`	`]`
`101`	`97`	`}`
Original file line number	Diff line number	Diff line change
@@ -61,13 +61,9 @@ If not enabled, `NXDOMAIN` will be returned for requests that do not match searc
`61`	`61`	`],`
`62`	`62`	`"rules": [`
`63`	`63`	`{`
`64`		`- "action": "evaluate",`
	`64`	`+ "preferred_by": "resolved",`
	`65`	`+ "action": "route",`
`65`	`66`	`"server": "resolved"`
`66`		`- },`
`67`		`- {`
`68`		`- "match_response": true,`
`69`		`- "ip_accept_any": true,`
`70`		`- "action": "respond"`
`71`	`67`	`}`
`72`	`68`	`]`
`73`	`69`	`}`
Original file line number	Diff line number	Diff line change
`@@ -60,13 +60,9 @@ icon: material/new-box`
`60`	`60`	`],`
`61`	`61`	`"rules": [`
`62`	`62`	`{`
`63`		`- "action": "evaluate",`
	`63`	`+ "preferred_by": "resolved",`
	`64`	`+ "action": "route",`
`64`	`65`	`"server": "resolved"`
`65`		`- },`
`66`		`- {`
`67`		`- "match_response": true,`
`68`		`- "ip_accept_any": true,`
`69`		`- "action": "respond"`
`70`	`66`	`}`
`71`	`67`	`]`
`72`	`68`	`}`
Original file line number	Diff line number	Diff line change
@@ -73,13 +73,9 @@ Default resolvers are not consulted for single-label queries regardless of `acce
`73`	`73`	`],`
`74`	`74`	`"rules": [`
`75`	`75`	`{`
`76`		`- "action": "evaluate",`
	`76`	`+ "preferred_by": "ts",`
	`77`	`+ "action": "route",`
`77`	`78`	`"server": "ts"`
`78`		`- },`
`79`		`- {`
`80`		`- "match_response": true,`
`81`		`- "ip_accept_any": true,`
`82`		`- "action": "respond"`
`83`	`79`	`}`
`84`	`80`	`]`
`85`	`81`	`}`
Original file line number	Diff line number	Diff line change
`@@ -73,13 +73,9 @@ icon: material/new-box`
`73`	`73`	`],`
`74`	`74`	`"rules": [`
`75`	`75`	`{`
`76`		`- "action": "evaluate",`
	`76`	`+ "preferred_by": "ts",`
	`77`	`+ "action": "route",`
`77`	`78`	`"server": "ts"`
`78`		`- },`
`79`		`- {`
`80`		`- "match_response": true,`
`81`		`- "ip_accept_any": true,`
`82`		`- "action": "respond"`
`83`	`79`	`}`
`84`	`80`	`]`
`85`	`81`	`}`