Leadaxe 确认一例 Linux system 栈断流由防火墙阻断，并补充排障文档

Leadaxe 在 singbox-launcher #129 中根据报告者的后续验证和容器复现，确认该案例是主机防火墙丢弃 system 栈本地 TCP 转发器的连接，并非栈本身故障。他已将窄范围 firewall-cmd 规则及地址匹配、--reload 注意事项加入 Linux 排障文档；默认栈仍为 system，gvisor 保留为无需更改防火墙的替代方案。auto_redirect: true 能否在报告者环境中不加防火墙例外直接通行，仍待测试，再据此决定 launcher 是否在 Linux 生成该选项，因此问题继续保持打开。

作者原文@Leadaxe
Thank you for the follow-up and for the container reproduction. That settles the cause for this case: a host firewall dropping the system stack's local TCP forwarder (172.16.0.2 to 172.16.0.1), not the stack itself.
Added a troubleshooting entry with your narrow firewall-cmd rule and the caveats about addresses and --reload: docs/TROUBLESHOOTING.md, Linux section (cbaa95a5). The default stack stays system; gvisor remains the fallback that needs no firewall changes.
One open question remains: whether auto_redirect: true (nftables-based routing, "always recommended on Linux" in the sing-box docs) passes traffic on your setup without any firewall exception. If you get a chance to run the test from the earlier comment, that decides whether the launcher should emit auto_redirect on Linux. Leaving the issue open for that; otherwise it can be closed as documented.

返回动态列表查看原文