Skip to content

feat: traceroute support for WireGuard and Tailscale tunnels#4108

Open
xdqi wants to merge 3 commits intoSagerNet:testingfrom
xdqi:feature/mtr-support
Open

feat: traceroute support for WireGuard and Tailscale tunnels#4108
xdqi wants to merge 3 commits intoSagerNet:testingfrom
xdqi:feature/mtr-support

Conversation

@xdqi
Copy link
Copy Markdown

@xdqi xdqi commented May 4, 2026

Add traceroute/mtr support for WireGuard and Tailscale TUN tunnels, enabling ICMP, UDP and TCP traceroute modes to work through proxy tunnels.

Features

  • WireGuard DirectRoute: Enable DirectRoute on WireGuard device stacks to support traceroute through WG tunnels
  • NAT device TTL forwarding: Forward TTL from incoming packets to outbound connections in WireGuard NAT device
  • Configurable hop limit: Add max_traceroute_hop_limit option to TUN inbound configuration
  • Configurable TTL decrement: Add decrement_ttl option for DirectRoute behavior
  • Group outbound support: Selector and URLTest groups propagate DirectRoute and TTL settings to selected outbounds

Dependencies

Changes

  • transport/wireguard/: DirectRoute integration in device_stack and device_nat
  • protocol/direct/outbound.go: Pass TTL to direct outbound connections
  • protocol/group/: Selector and URLTest DirectRoute propagation
  • protocol/tun/inbound.go: Configurable max traceroute hop limit
  • option/tun.go: New TUN option fields
  • route/route.go: DirectRoute connection handling

nekohasekai and others added 3 commits May 3, 2026 21:54
Add UDP and TCP DirectRoute handling to enable mtr --udp and mtr --tcp
through WireGuard and other tunnels.

- Add UDP DirectRoute with ICMPForwarder integration in direct outbound
- Add TCP DirectRoute for traceroute in route matching
- Pass ICMPForwarder to UDP/TCP forwarders in WireGuard stack
- Fix safe type assertion for DirectRouteOutbound in PreMatch
- Intercept ICMP errors in stackDevice before gVisor delivery
- Use import aliases for sing-tun packages
Add max_traceroute_hop_limit configuration for TUN inbound and enable
ICMP TTL decrement on WireGuard and Tailscale endpoints for VPN server mode.

- Add MaxTracerouteHopLimit option to TUN inbound configuration
- Pass local addresses to DirectRoute wrapper for TTL decrement
- Use DirectRoute wrapper for WireGuard and Tailscale stacks
- Enable ICMP TTL decrement on WG and Tailscale servers
@nekohasekai nekohasekai force-pushed the testing branch 4 times, most recently from 1b75d75 to 056c45c Compare May 11, 2026 16:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants