Xray TUN not identified as Remote Access Interface in Windows

[Kapkap5454]

The issue is following: xray-tun is not identified as Remote Access Interface Type.

I will not follow any template intentionally and am ready if this issue goes unanswered. I just don't understand which logs or configs would be useful here.

But I am curious if it's possible to make Xray tun be identified as Remote Access Interface Type.

Currently I use v2rayN which can use sing-box tun. This setup being identified as Remote Access allows to create a very simple rule in built-in Windows Firewall to block all connections for all interfaces type but Remote Access. This allows to create sort of kill switch for proxy, in case it suddenly goes down. Very convenient.
But doesn't work when I switch v2rayN to use xray TUN.

I tried to study the subject but haven't come to a conclusion as to what makes windows firewall see tun as this type or that....
So I don't really know if it's an issue at all and if anyone uses this firewall rule as I did.

*A bit offtopic, xray tun seems to fail for me at all, if i dont set SendThrough to my local wi-fi IP in v2rayN settings. So doesn't work automatically.

[Fangliding]

如果你要讨论问题应该去discussions

[RPRX]

现在有两个讨论区了，这样分吧：

• 偏技术的 Xray-core 使用/配置问题去 https://github.com/XTLS/Xray-core/discussions
• 偏宏观的反审查想法、事件去 https://github.com/XTLS/BBS/issues
• 或者你可以加入中文群/伊朗群/俄罗斯群，啥都能聊

[RPRX]

不过我也不确定这个是否属于 issue，@LjhAUMEM 你看一下

[Fangliding]

他都 "I will not follow any template intentionally and am ready if this issue goes unanswered. I just don't understand which logs or configs would be useful here." 了 现在连版本号和有没有用那什么自动route都是一把问号

[RPRX]

自动 route 与否应该不影响这个，他说的其余部分我也好奇，所以先等 @LjhAUMEM 看一下吧

[Kapkap5454]

他都 "I will not follow any template intentionally and am ready if this issue goes unanswered. I just don't understand which logs or configs would be useful here." 了 现在连版本号和有没有用那什么自动route都是一把问号

Windows 10, v2rayN 7.21.0, xray 26.4.25, sing box 1.13.11.

Auto-generated inbound config by v2rayN (using xray TUN) looks like this:

Click to show code

  "inbounds": [
    {
      "tag": "socks",
      "port": 10808,
      "listen": "127.0.0.1",
      "protocol": "mixed",
      "sniffing": {
        "enabled": false,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      },
      "settings": {
        "auth": "noauth",
        "udp": true,
        "allowTransparent": false
      }
    },
    {
      "tag": "tun",
      "protocol": "tun",
      "sniffing": {
        "enabled": false,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      },
      "settings": {
        "name": "xray_tun",
        "MTU": 9000,
        "gateway": [
          "172.18.0.1/30",
          "fdfe:dcba:9876::1/126"
        ],
        "autoSystemRoutingTable": [
          "0.0.0.0/0",
          "::/0"
        ],
        "autoOutboundsInterface": "auto"
      }
    }
  ],

To switch v2rayN back to singbox tun -> options -> tun mode settings -> legacy tun protect ON.

The windows firewall rule I use as killswitch: Outbound rule, Action - block the connection. Scope – Remote IP – Add predefined set of computers – Internet, Apply to interfaces – all, but not Remote access.
In singbox tun mode it allows only connections through proxy, no leaks. In xray tun I have no internet.

Firefox shows this when I try to load a page:
Secure Connection Failed
An error occurred during a connection to pikabu.ru. PR_END_OF_FILE_ERROR
Error code: PR_END_OF_FILE_ERROR
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

Curl:
$ curl https://www.google.com
curl: (35) Send failure: Broken pipe

Client logs
2026/04/27 14:33:05.996061 [Info] [1194601314] transport/internet/splithttp: failed to GET https://my.proxyserver.com/mypath/ > Get "https://my.proxyserver.com/mypath/14b7e150-8105-474b-84ab-a1956df52614": dial tcp MY_SERVER_IP:443: connectex: An attempt was made to access a socket in a way forbidden by its access permissions.

*Errr, I don't know why, but currently xray tun started to work without SendThrough set (I set to 192.168.50.21, pc local ip). Yesterday and day before yesterday it definitely didn't, I spent many hours trying to find out SendThrough was the cause for me, turning on/off different settings. Confused. So only problem with firewall now exists.

[Fangliding]

自动 route 与否应该不影响这个，他说的其余部分我也好奇，所以先等 @LjhAUMEM 看一下吧

还有他说的这个 Remote Access Interface 都不知道是什么 去谷歌上搜 Remote Access Interface Windows 鬼都搜不到 甚至会搜回谷歌刚爬的这个issue本身。。

[Kapkap5454]

Rebooted. Full configs.

v2rayN autoconfig, singbox TUN (works with firewall rule ON)

Click

{
  "log": {
    "loglevel": "warning"
  },
  "dns": {
    "hosts": {
      "dns.google": [
        "8.8.8.8",
        "8.8.4.4",
        "2001:4860:4860::8888",
        "2001:4860:4860::8844"
      ],
      "dns.alidns.com": [
        "223.5.5.5",
        "223.6.6.6",
        "2400:3200::1",
        "2400:3200:baba::1"
      ],
      "one.one.one.one": [
        "1.1.1.1",
        "1.0.0.1",
        "2606:4700:4700::1111",
        "2606:4700:4700::1001"
      ],
      "1dot1dot1dot1.cloudflare-dns.com": [
        "1.1.1.1",
        "1.0.0.1",
        "2606:4700:4700::1111",
        "2606:4700:4700::1001"
      ],
      "cloudflare-dns.com": [
        "104.16.249.249",
        "104.16.248.249",
        "2606:4700::6810:f8f9",
        "2606:4700::6810:f9f9"
      ],
      "dns.cloudflare.com": [
        "104.16.132.229",
        "104.16.133.229",
        "2606:4700::6810:84e5",
        "2606:4700::6810:85e5"
      ],
      "dot.pub": [
        "1.12.12.12",
        "120.53.53.53"
      ],
      "doh.pub": [
        "1.12.12.12",
        "120.53.53.53"
      ],
      "dns.quad9.net": [
        "9.9.9.9",
        "149.112.112.112",
        "2620:fe::fe",
        "2620:fe::9"
      ],
      "dns.yandex.net": [
        "77.88.8.8",
        "77.88.8.1",
        "2a02:6b8::feed:0ff",
        "2a02:6b8:0:1::feed:0ff"
      ],
      "dns.sb": [
        "185.222.222.222",
        "2a09::"
      ],
      "dns.umbrella.com": [
        "208.67.220.220",
        "208.67.222.222",
        "2620:119:35::35",
        "2620:119:53::53"
      ],
      "dns.sse.cisco.com": [
        "208.67.220.220",
        "208.67.222.222",
        "2620:119:35::35",
        "2620:119:53::53"
      ],
      "engage.cloudflareclient.com": [
        "162.159.192.1"
      ]
    },
    "servers": [
      {
        "address": "1.1.1.1",
        "domains": [
          "my.proxyserver.com"
        ],
        "skipFallback": true,
        "tag": "direct-dns-1"
      },
      "https://1.1.1.1/dns-query"
    ],
    "tag": "dns-module"
  },
  "inbounds": [
    {
      "tag": "socks",
      "port": 10808,
      "listen": "127.0.0.1",
      "protocol": "mixed",
      "sniffing": {
        "enabled": false,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      },
      "settings": {
        "auth": "noauth",
        "udp": true,
        "allowTransparent": false
      }
    },
    {
      "tag": "tun",
      "protocol": "tun",
      "sniffing": {
        "enabled": false,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      },
      "settings": {
        "name": "xray_tun",
        "MTU": 9000,
        "gateway": [
          "172.18.0.1/30",
          "fdfe:dcba:9876::1/126"
        ],
        "autoSystemRoutingTable": [
          "0.0.0.0/0",
          "::/0"
        ],
        "autoOutboundsInterface": "auto"
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "my.proxyserver.com",
            "port": 443,
            "users": [
              {
                "id": "1432079b-fb75-4c56-9f82-3a34ebd6315c",
                "email": "t@t.tt",
                "security": "auto",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "tlsSettings": {
          "allowInsecure": false,
          "serverName": "my.proxyserver.com",
          "alpn": [
            "h2",
            "http/1.1"
          ],
          "fingerprint": "chrome"
        },
        "xhttpSettings": {
          "path": "/mypath",
          "mode": "stream-up",
          "extra": {
            "xmux": {
              "maxConnections": "4-5",
              "hMaxRequestTimes": "600-900",
              "hMaxReusableSecs": "1800-3000"
            }
          }
        }
      },
      "mux": {
        "enabled": false,
        "concurrency": -1
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    },
    {
      "tag": "dns",
      "protocol": "dns"
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "inboundTag": [
          "api"
        ],
        "outboundTag": "api"
      },
      {
        "port": "135,137-139,5353",
        "network": "udp",
        "outboundTag": "block"
      },
      {
        "outboundTag": "block",
        "ip": [
          "224.0.0.0/3",
          "ff00::/8"
        ]
      },
      {
        "port": "53",
        "outboundTag": "dns",
        "process": [
          "v2ray.exe",
          "mihomo-windows-amd64-v1.exe",
          "mihomo-windows-amd64-compatible.exe",
          "mihomo-windows-amd64.exe",
          "mihomo-windows-arm64.exe",
          "clash.exe",
          "mihomo.exe",
          "hysteria.exe",
          "naive.exe",
          "naiveproxy.exe",
          "tuic-client.exe",
          "tuic.exe",
          "sing-box-client.exe",
          "sing-box.exe",
          "juicity-client.exe",
          "juicity.exe",
          "hysteria-windows-amd64.exe",
          "hysteria-linux-amd64.exe",
          "brook_windows_amd64.exe",
          "brook_linux_amd64.exe",
          "brook.exe",
          "overtls-bin.exe",
          "overtls.exe",
          "shadowquic.exe",
          "mieru.exe"
        ]
      },
      {
        "outboundTag": "direct",
        "process": [
          "v2ray.exe",
          "xray.exe",
          "mihomo-windows-amd64-v1.exe",
          "mihomo-windows-amd64-compatible.exe",
          "mihomo-windows-amd64.exe",
          "mihomo-windows-arm64.exe",
          "clash.exe",
          "mihomo.exe",
          "hysteria.exe",
          "naive.exe",
          "naiveproxy.exe",
          "tuic-client.exe",
          "tuic.exe",
          "sing-box-client.exe",
          "sing-box.exe",
          "juicity-client.exe",
          "juicity.exe",
          "hysteria-windows-amd64.exe",
          "hysteria-linux-amd64.exe",
          "brook_windows_amd64.exe",
          "brook_linux_amd64.exe",
          "brook.exe",
          "overtls-bin.exe",
          "overtls.exe",
          "shadowquic.exe",
          "mieru.exe",
          "xray/",
          "self/"
        ]
      },
      {
        "port": "53",
        "outboundTag": "dns"
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "process": [
          "mullvadbrowser.exe"
        ]
      },
      {
        "type": "field",
        "inboundTag": [
          "direct-dns-1"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "inboundTag": [
          "dns-module"
        ],
        "outboundTag": "proxy"
      }
    ]
  }
}

v2rayN autoconfig, xray TUN (works only with firewall rule off)

Click

{
  "log": {
    "loglevel": "warning"
  },
  "dns": {
    "hosts": {
      "dns.google": [
        "8.8.8.8",
        "8.8.4.4",
        "2001:4860:4860::8888",
        "2001:4860:4860::8844"
      ],
      "dns.alidns.com": [
        "223.5.5.5",
        "223.6.6.6",
        "2400:3200::1",
        "2400:3200:baba::1"
      ],
      "one.one.one.one": [
        "1.1.1.1",
        "1.0.0.1",
        "2606:4700:4700::1111",
        "2606:4700:4700::1001"
      ],
      "1dot1dot1dot1.cloudflare-dns.com": [
        "1.1.1.1",
        "1.0.0.1",
        "2606:4700:4700::1111",
        "2606:4700:4700::1001"
      ],
      "cloudflare-dns.com": [
        "104.16.249.249",
        "104.16.248.249",
        "2606:4700::6810:f8f9",
        "2606:4700::6810:f9f9"
      ],
      "dns.cloudflare.com": [
        "104.16.132.229",
        "104.16.133.229",
        "2606:4700::6810:84e5",
        "2606:4700::6810:85e5"
      ],
      "dot.pub": [
        "1.12.12.12",
        "120.53.53.53"
      ],
      "doh.pub": [
        "1.12.12.12",
        "120.53.53.53"
      ],
      "dns.quad9.net": [
        "9.9.9.9",
        "149.112.112.112",
        "2620:fe::fe",
        "2620:fe::9"
      ],
      "dns.yandex.net": [
        "77.88.8.8",
        "77.88.8.1",
        "2a02:6b8::feed:0ff",
        "2a02:6b8:0:1::feed:0ff"
      ],
      "dns.sb": [
        "185.222.222.222",
        "2a09::"
      ],
      "dns.umbrella.com": [
        "208.67.220.220",
        "208.67.222.222",
        "2620:119:35::35",
        "2620:119:53::53"
      ],
      "dns.sse.cisco.com": [
        "208.67.220.220",
        "208.67.222.222",
        "2620:119:35::35",
        "2620:119:53::53"
      ],
      "engage.cloudflareclient.com": [
        "162.159.192.1"
      ]
    },
    "servers": [
      {
        "address": "1.1.1.1",
        "domains": [
          "my.proxyserver.com"
        ],
        "skipFallback": true,
        "tag": "direct-dns-1"
      },
      "https://1.1.1.1/dns-query"
    ],
    "tag": "dns-module"
  },
  "inbounds": [
    {
      "tag": "socks",
      "port": 10808,
      "listen": "127.0.0.1",
      "protocol": "mixed",
      "sniffing": {
        "enabled": false,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      },
      "settings": {
        "auth": "noauth",
        "udp": true,
        "allowTransparent": false
      }
    },
    {
      "tag": "tun",
      "protocol": "tun",
      "sniffing": {
        "enabled": false,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      },
      "settings": {
        "name": "xray_tun",
        "MTU": 9000,
        "gateway": [
          "172.18.0.1/30",
          "fdfe:dcba:9876::1/126"
        ],
        "autoSystemRoutingTable": [
          "0.0.0.0/0",
          "::/0"
        ],
        "autoOutboundsInterface": "auto"
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "my.proxyserver.com",
            "port": 443,
            "users": [
              {
                "id": "1432079b-fb75-4c56-9f82-3a34ebd6315c",
                "email": "t@t.tt",
                "security": "auto",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "tlsSettings": {
          "allowInsecure": false,
          "serverName": "my.proxyserver.com",
          "alpn": [
            "h2",
            "http/1.1"
          ],
          "fingerprint": "chrome"
        },
        "xhttpSettings": {
          "path": "/mypath",
          "mode": "stream-up",
          "extra": {
            "xmux": {
              "maxConnections": "4-5",
              "hMaxRequestTimes": "600-900",
              "hMaxReusableSecs": "1800-3000"
            }
          }
        }
      },
      "mux": {
        "enabled": false,
        "concurrency": -1
      }
    },
    {
      "tag": "direct",
      "protocol": "freedom"
    },
    {
      "tag": "block",
      "protocol": "blackhole"
    },
    {
      "tag": "dns",
      "protocol": "dns"
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "type": "field",
        "inboundTag": [
          "api"
        ],
        "outboundTag": "api"
      },
      {
        "port": "135,137-139,5353",
        "network": "udp",
        "outboundTag": "block"
      },
      {
        "outboundTag": "block",
        "ip": [
          "224.0.0.0/3",
          "ff00::/8"
        ]
      },
      {
        "port": "53",
        "outboundTag": "dns",
        "process": [
          "v2ray.exe",
          "mihomo-windows-amd64-v1.exe",
          "mihomo-windows-amd64-compatible.exe",
          "mihomo-windows-amd64.exe",
          "mihomo-windows-arm64.exe",
          "clash.exe",
          "mihomo.exe",
          "hysteria.exe",
          "naive.exe",
          "naiveproxy.exe",
          "tuic-client.exe",
          "tuic.exe",
          "sing-box-client.exe",
          "sing-box.exe",
          "juicity-client.exe",
          "juicity.exe",
          "hysteria-windows-amd64.exe",
          "hysteria-linux-amd64.exe",
          "brook_windows_amd64.exe",
          "brook_linux_amd64.exe",
          "brook.exe",
          "overtls-bin.exe",
          "overtls.exe",
          "shadowquic.exe",
          "mieru.exe"
        ]
      },
      {
        "outboundTag": "direct",
        "process": [
          "v2ray.exe",
          "xray.exe",
          "mihomo-windows-amd64-v1.exe",
          "mihomo-windows-amd64-compatible.exe",
          "mihomo-windows-amd64.exe",
          "mihomo-windows-arm64.exe",
          "clash.exe",
          "mihomo.exe",
          "hysteria.exe",
          "naive.exe",
          "naiveproxy.exe",
          "tuic-client.exe",
          "tuic.exe",
          "sing-box-client.exe",
          "sing-box.exe",
          "juicity-client.exe",
          "juicity.exe",
          "hysteria-windows-amd64.exe",
          "hysteria-linux-amd64.exe",
          "brook_windows_amd64.exe",
          "brook_linux_amd64.exe",
          "brook.exe",
          "overtls-bin.exe",
          "overtls.exe",
          "shadowquic.exe",
          "mieru.exe",
          "xray/",
          "self/"
        ]
      },
      {
        "port": "53",
        "outboundTag": "dns"
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "process": [
          "mullvadbrowser.exe"
        ]
      },
      {
        "type": "field",
        "inboundTag": [
          "direct-dns-1"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "inboundTag": [
          "dns-module"
        ],
        "outboundTag": "proxy"
      }
    ]
  }
}

Client logs in debug mode for v2rayN in xray TUN mode with firewall rule ON:

Click

----- Message cleared -----
2026/04/27 15:44:41.285779 [Info] [3417995094] proxy/tun: processing from tcp:172.18.0.1:52438 to tcp:4.207.247.138:443
2026/04/27 15:44:41.286899 [Info] [3417995094] app/dispatcher: default route for tcp:4.207.247.138:443
2026/04/27 15:44:41.286899 [Debug] [3417995094] transport/internet/splithttp: XMUX: removing xmuxClient, IsClosed() = true, OpenUsage = 0, leftUsage = -1, LeftRequests = 600, UnreusableAt = 2026-04-27 16:20:14.8183717 +0200 CEST m=+2140.464020001
2026/04/27 15:44:41.286899 [Debug] [3417995094] transport/internet/splithttp: XMUX: creating xmuxClient because xmuxClients is empty
2026/04/27 15:44:41.286899 [Info] [3417995094] transport/internet/splithttp: XHTTP is dialing to tcp:my.proxyserver.com:443, mode stream-up, HTTP version 2, host my.proxyserver.com
2026/04/27 15:44:41.287073 from tcp:172.18.0.1:52438 accepted tcp:4.207.247.138:443 [tun >> proxy]
2026/04/27 15:44:41.287134 [Debug] [3417995094] transport/internet: dialing to tcp:my.proxyserver.com:443
2026/04/27 15:44:41.295224 [Info] [872922236] proxy/tun: processing from tcp:172.18.0.1:52439 to tcp:4.207.247.138:443
2026/04/27 15:44:41.295789 [Info] [872922236] app/dispatcher: default route for tcp:4.207.247.138:443
2026/04/27 15:44:41.295789 [Debug] [872922236] transport/internet/splithttp: XMUX: creating xmuxClient because maxConnections was not hit, xmuxClients = 1
2026/04/27 15:44:41.295789 from tcp:172.18.0.1:52439 accepted tcp:4.207.247.138:443 [tun >> proxy]
2026/04/27 15:44:41.295789 [Info] [872922236] transport/internet/splithttp: XHTTP is dialing to tcp:my.proxyserver.com:443, mode stream-up, HTTP version 2, host my.proxyserver.com
2026/04/27 15:44:41.295789 [Debug] [872922236] transport/internet: dialing to tcp:my.proxyserver.com:443
2026/04/27 15:44:41.303125 [Info] [872922236] transport/internet/splithttp: failed to GET https://my.proxyserver.com/mypath/ > Get "https://my.proxyserver.com/mypath/8d57f592-c39e-41b8-87fa-cdd450a72c58": dial tcp MY_SERVER_IP:443: connectex: An attempt was made to access a socket in a way forbidden by its access permissions.
2026/04/27 15:44:41.303125 [Info] [3417995094] transport/internet/splithttp: failed to GET https://my.proxyserver.com/mypath/ > Get "https://my.proxyserver.com/mypath/9392860f-4931-4a28-8889-adf1cd5f76e3": dial tcp MY_SERVER_IP:443: connectex: An attempt was made to access a socket in a way forbidden by its access permissions.
2026/04/27 15:44:41.303125 [Debug] [3417995094] transport/internet: dialing to tcp:my.proxyserver.com:443
2026/04/27 15:44:41.303125 [Debug] [872922236] transport/internet: dialing to tcp:my.proxyserver.com:443
2026/04/27 15:44:41.304259 [Info] [872922236] proxy/vless/outbound: tunneling request to tcp:4.207.247.138:443 via my.proxyserver.com:443
2026/04/27 15:44:41.304259 [Info] [3417995094] proxy/vless/outbound: tunneling request to tcp:4.207.247.138:443 via my.proxyserver.com:443

Details

[Kapkap5454]

This is what LLM gives on Remote Access interface type in Windows Firewall:

"🔑 What “RemoteAccess” actually corresponds to

This maps to Windows RAS (Remote Access Service) interfaces:

VPN connections (IKEv2, PPTP, L2TP, SSTP)
dial-up / PPP interfaces
DirectAccess
RRAS-created interfaces

👉 In other words:

RemoteAccess = interface created by Windows remote access stack (RAS)
🔥 What makes an interface “RemoteAccess”

Not firewall rules. Not ports. Not traffic.

👉 It’s determined by how the interface is registered in Windows networking stack

Specifically:

interface type (NDIS / IfType)
whether it belongs to RAS subsystem
whether Windows sees it as a VPN connection"

[Kapkap5454]

v2rayN TUN settings window

[Kapkap5454]

Ran lot of poweshell commands to compare singbox tun vs xray tun, guided by LLM.

First it noticed:
"You found one real difference:

singbox_tun IPv4 Forwarding : Enabled
xray_tun IPv4 Forwarding : Disabled

Everything else is basically the same:

singbox: SWD\WINTUN{GUID}
xray: SWD\WINTUN{GUID}

So both are Wintun software devices, not RAS/VPN:

Get-VpnConnection = empty"

And advised Set-NetIPInterface -InterfaceAlias "xray_tun" -AddressFamily IPv4 -Forwarding Enabled.
This didn't help.

Then it advised:
PS C:\WINDOWS\system32> Get-NetRoute -InterfaceAlias "singbox_tun"

ifIndex DestinationPrefix NextHop RouteMetric ifMetric PolicyStore

---

28 255.255.255.255/32 0.0.0.0 256 ActiveStore
28 224.0.0.0/4 0.0.0.0 256 ActiveStore
28 172.18.0.3/32 0.0.0.0 256 ActiveStore
28 172.18.0.1/32 0.0.0.0 256 ActiveStore
28 172.18.0.0/30 0.0.0.0 256 ActiveStore
28 0.0.0.0/0 172.18.0.2 0 ActiveStore
28 ff00::/8 :: 256 ActiveStore
28 fdfe:dcba:9876::1/128 :: 256 ActiveStore
28 fdfe:dcba:9876::/126 :: 256 ActiveStore
28 ::/0 fdfe:dcba:9876::2 0 ActiveStore

PS C:\WINDOWS\system32> Get-NetRoute -InterfaceAlias "xray_tun"

ifIndex DestinationPrefix NextHop RouteMetric ifMetric PolicyStore

---

28 172.18.0.3/32 0.0.0.0 256 ActiveStore
28 172.18.0.1/32 0.0.0.0 256 ActiveStore
28 172.18.0.0/30 0.0.0.0 256 ActiveStore
28 0.0.0.0/0 0.0.0.0 0 ActiveStore
28 fdfe:dcba:9876::1/128 :: 256 ActiveStore
28 fdfe:dcba:9876::/126 :: 256 ActiveStore
28 ::/0 :: 0 ActiveStore

And concluded:
"🔴 The REAL difference (finally visible)

Compare default routes:

Xray:
0.0.0.0/0 → 0.0.0.0
sing-box:
0.0.0.0/0 → 172.18.0.2 ← gateway
🧠 What that means
Xray TUN
no gateway
→ “I am the endpoint”
→ behaves like host-only interface
sing-box TUN
has gateway
→ “traffic goes THROUGH me”
→ behaves like routed interface (like VPN)
💥 THIS is the key

Windows Firewall RemoteAccess classification is tied to:

👉 interfaces that act like routed/VPN interfaces (have next hop / gateway)

NOT just:

driver
forwarding flag
Wintun
🔥 Why this matters
sing-box:
interface → has gateway → looks like VPN
→ Windows treats as RemoteAccess-like
Xray:
interface → no gateway → looks like local adapter
→ NOT RemoteAccess"

No idea if thats the reason yet.