Leadaxe：进程规则只作用于真正进入 TUN 的流量，sing-box 不提供 TUN metric 设置，可用 route_exclude_address 排除其他网关网段
在 singbox-launcher issue #141（降低 TUN metric/优先级后进程规则是否仍生效）下，开发者 Leadaxe 回复：进程规则只作用于真正进入 TUN 的流量，sing-box 只对收到的连接识别所属进程；如果其他网关的路由优先，该流量会完全绕过 sing-box，任何规则（进程或其他）都不适用。TUN metric 不是 sing-box 暴露的设置：使用 auto_route 时它在 Windows 上硬编码 metric 0，在 Linux 上使用策略路由（ip rules 加一张独立表），在 macOS 上使用按前缀的路由；另外操作系统优先匹配最长前缀，metric 只在相同前缀之间比较，因此推送自身子网的 VPN 已经胜过 TUN 的默认路由。当前可用做法是在「设置 → TUN 路由排除地址」（route_exclude_address）里列出其他网关的子网，让它们在系统层面留在隧道之外（按设计进程规则不会作用于这些流量）。作者还询问用户的系统、另一网关是什么、哪些流量应走哪里，以判断是否值得增加「绑定特定接口的直连出站并在规则中选择」这一能力。
作者原文@LeadaxeProcess rules only apply to traffic that actually enters the TUN — sing-box identifies the owning process for connections it receives. If another gateway's routes take precedence, that traffic bypasses sing-box completely: no rules (process or otherwise) apply to it.
A TUN metric setting isn't something sing-box exposes: with
auto_routeit hard-codes metric 0 on Windows, uses policy routing (ip rules + a separate table) on Linux, and per-prefix routes on macOS. Also note the OS picks the longest matching prefix first — metric only breaks ties between equal prefixes — so a VPN that pushes its own subnets already wins over the TUN default route.What you can use today: Settings → TUN route exclude addresses (
route_exclude_address). List the subnets of your other gateway there and they'll stay outside the tunnel at the OS level (process rules won't apply to that traffic, by design).If what you actually want is "send app X through the other gateway" while keeping process rules — that would need a direct outbound bound to a specific interface, selectable in rules. Could you describe your setup (OS, what the other gateway is, which traffic should go where)? Then we can see whether that's worth adding.