LeadaxeLxBox / sing-box-lx 开发者

作者发言

GitHub·2026.10.30 17:42:23（UTC+8）

Leadaxe：Technitium 本机 DNS 与 sing-box TUN、劫持和 FakeIP 的边界

在 singbox-launcher issue #141 的回复中，Leadaxe 说明 Windows strict route 开启时会阻断到 127.0.0.1 的 DNS，DNS hijack 会截获 Technitium 自身的上游查询并使递归/DNSSEC 失效；应改用 DoH/DoT 或关闭劫持，避免把 127.0.0.1 设成造成 sing-box 循环的明文上游，启用 FakeIP 时也应关闭以免缓存地址在 VPN 停止后继续提供。

作者原文@Leadaxe

Thanks for the details.

Technitium on 127.0.0.1 — it can work, but a few settings get in the way:

1. Settings → TUN strict route must be off. On Windows strict route blocks DNS (port 53) to everything except the tunnel, and that includes 127.0.0.1 — Windows can't reach Technitium at all.
2. Rules → Traffic Processing → DNS hijack catches Technitium's own upstream queries on port 53 and answers them from the launcher's DNS settings instead. Recursive mode and DNSSEC validation in Technitium won't work that way. Either give Technitium DoH/DoT forwarders (encrypted queries aren't hijacked — they're routed by your rules like any other app), or turn DNS hijack off.
3. If Technitium's upstream is plain DNS, don't set 127.0.0.1 as the launcher's DNS server — that's a loop (sing-box → Technitium → tunnel → sing-box → …).

If FakeIP is enabled, turn it off as well — Technitium would cache the fake addresses and keep serving them after the VPN stops.

If it still struggles after that, please describe what exactly fails (which apps, what error) and attach the sing-box log from that moment.