BlankwonderSurge 创始开发者

作者发言

Telegram·2026.10.14 22:24:44（UTC+8）

blankwonder：Surge 新增接受经 Tailscale 与 WireGuard 进来的连接，并说明入站不受 Tailscale 访问控制策略约束

Surge TestFlight Feed 发布「Incoming Connections for Tailscale and WireGuard」：Surge 现在除了向外发送流量，也能接受经 Tailscale 与 WireGuard 进来的连接；入站请求与其它请求一样走规则与策略，并出现在请求列表中。Tailscale 方面：accept-incoming = true 允许 tailnet 内其它设备通过本机的 tailnet 地址连接（例如使用 Surge 的 HTTP/SOCKS5 代理或本机上其它服务）；advertise-exit-node = true 把本机作为出口节点，选择它的其它 tailnet 设备会把全部上网流量交给 Surge 的规则转发；advertise-routes = 192.168.1.0/24, ... 把本机作为所列网络的子网路由器；出口节点与子网路由需在 Tailscale 管理控制台批准后生效。WireGuard 方面：accept-incoming = true 允许对端经已有隧道向本机发起连接；listen-port = 51820 让 Surge 作为 WireGuard 服务端，客户端可以不填 endpoint，Surge 在连接时学习客户端地址并在其变化时跟进；客户端可把 Surge 的隧道地址设为 DNS 服务器，由 Surge 的 DNS 应答查询。作者注明：Surge 不会对入站连接应用 Tailscale 的访问控制策略，可用 SRC-IP 等规则限制谁能访问哪些目标。需要 iOS 5.24.0+ / Mac 6.11.0+。

频道原文@SurgeTestFlightFeed

Incoming Connections for Tailscale and WireGuard

Surge can now accept connections that come in through Tailscale and WireGuard, not just send traffic out. Incoming requests are handled like any other request: they go through your rules and policies and show up in the request list.

Tailscale

• accept-incoming = true: other devices on your tailnet can connect to this device through its tailnet address. For example, they can use Surge's HTTP/SOCKS5 proxy or other services running on this device.
• advertise-exit-node = true: offer this device as an exit node. Other tailnet devices that select it send all their internet traffic through Surge's rules.
• advertise-routes = 192.168.1.0/24, ...: offer this device as a subnet router for the listed networks.
• Exit nodes and subnet routes take effect after you approve them in the Tailscale admin console.

WireGuard

• accept-incoming = true: the peer side can open connections to this device through an existing tunnel.
• listen-port = 51820: Surge acts as a WireGuard server that phones, laptops, and other clients can connect to. A peer can leave out endpoint; Surge learns the client's address when it connects and keeps up when the address changes.
• Clients can set Surge's tunnel address as their DNS server, and Surge's DNS will answer their queries.

Note: Surge does not apply your Tailscale access control policy to incoming connections. Use rules such as SRC-IP to limit who can reach which destination.

Requires iOS 5.24.0+ / Mac 6.11.0+. See the Tailscale and WireGuard pages in the manual for details and example configurations.