sing-box TUN 模式网络慢问题诊断与优化

# 测试国内网站 - 正常
curl -w "Total: %{time_total}s\n" -o /dev/null -s https://www.baidu.com
# Total: 0.086s

# 测试 Google - 失败 (SSL 错误)
curl -w "Total: %{time_total}s\n" -o /dev/null -s https://www.google.com
# exit code 60, SSL certificate problem

# 系统 DNS 返回错误 IP (Meta 的 IP，不是 Google)
dig +short www.google.com
# 31.13.94.36

# sing-box DNS 返回正确 IP
dig +short www.google.com @127.0.0.1
# 142.250.194.164

// sing-box config.json
"route_exclude_address_set": ["geoip-cn"]

"servers": [
  {
    "server": "1.1.1.1",
    "tag": "remote",
    "type": "udp",
    "detour": "节点选择"  // selector 类型
  }
]

# sing-box DNS 查询超时
dig +short google.com @127.0.0.1
# connection timed out

# 日志显示
# ERROR dns: exchange failed for google.com: dial tcp 1.1.1.1:443: i/o timeout

# curl 优先使用 IPv6
curl -v https://www.google.com
# Trying [2607:f8b0:4007:804::2004]:443...
# SSL_ERROR_SYSCALL

# 强制 IPv4 成功
curl -4 https://www.google.com
# 成功

// 从 9000 改为 1400
"mtu": 1400

// 删除这行，让所有流量过 TUN
// "route_exclude_address_set": ["geoip-cn"]

{
  "action": "route",
  "outbound": "DIRECT",
  "rule_set": ["geosite-cn", "geoip-cn"]
}

{
  "tag": "remote",
  "type": "udp",
  "server": "1.1.1.1",
  "detour": "具体代理节点"  // 不是 selector
}

sudo networksetup -setdnsservers Wi-Fi 127.0.0.1

// 移除 IPv6 地址
"address": [
  "172.19.0.1/30"
  // 删除: "2001:0470:f9da:fdfa::1/64"
]

{
  "dns": {
    "strategy": "prefer_ipv4",
    "servers": [
      {
        "tag": "remote",
        "type": "udp",
        "server": "1.1.1.1",
        "detour": "具体代理节点"  // 不要用 selector
      },
      {
        "tag": "cn",
        "type": "udp",
        "server": "223.5.5.5"  // 国内 DNS 不需要 detour
      }
    ]
  },
  "inbounds": [{
    "type": "tun",
    "address": ["172.19.0.1/30"],  // 仅 IPv4
    "mtu": 1400,
    "route_exclude_address": [
      "192.168.0.0/16",
      "10.0.0.0/8"
    ]
    // 不要 route_exclude_address_set: ["geoip-cn"]
  }]
}