LeadaxeLxBox / sing-box-lx 开发者

作者发言

GitHub·2026.09.18 08:45:29（UTC+8）

Leadaxe：说明 singbox-launcher 在 Linux 下将默认 TUN 堆栈调整为 gvisor 的原因

Leadaxe 说明 singbox-launcher 将 Linux 默认 TUN 堆栈调整为 gvisor 的原因：原 system 堆栈在缺少 auto_redirect 时完全依赖 iproute2，容易被 firewalld 或 nftables 静默拦截；mixed 堆栈同样保留 TCP 上的 system 路径，因此直接默认采用 gvisor。

作者原文@Leadaxe

Thanks for the unusually thorough diagnostic — the SOCKS-inbound control test is what makes this conclusive.

Confirmed on our side: the launcher's own template hard-defaulted tun_stack to system on Linux, while upstream sing-box built with_gvisor defaults to mixed. So this was the launcher's choice, not a core default. We also do not emit auto_redirect yet, which the sing-box docs recommend on Linux — without it the system stack relies entirely on iproute2 rules, and a firewalld/nftables policy can drop that path silently. mixed would not help here either: it keeps the system stack for TCP, which is exactly what stalls in your report.

What you can do right now: the selector already exists and persists — Wizard → Settings → "TUN stack" → gvisor, then restart the VPN. Your "stack": "gvisor" output is exactly what it produces.

Changed in develop: the Linux default is now gvisor (template, with a note about firewalld/nftables in the setting's help text); it ships with the next release together with the template update. Exposing auto_redirect as a proper option is tracked separately, since that addresses the root cause of the system stack rather than working around it.