network_strategy behavior is different from description, and NetworkManager is broken on 1.11.0-beta.9

[aur3l14no]

Operating system

macOS

System version

15.2

Installation type

sing-box for macOS Graphical Client

If you are using a graphical client, please provide the version of the client.

1.11.0-beta.9

Version

No response

Description

Before 1.11.0-beta.9 (tested with beta.6 ~ beta.8)

With network_strategy: default or network_strategy: fallback, sing-box cannot utilize the network even if it is the ONLY network that satisfy the network_type condition.

For example, tailscale is of other type (VPN). But with the config file below, the 100.64.0.0/16 cannot be reached. Even though the log clearly shows:

Updated available networks: en0 (wifi), utun9 (other)

(utun9 is tailscale interface)

Interestingly, network_strategy: hybrid does work!

---

After 1.11.0-beta.9

The log no longer shows up and the tailscale network cannot be reached with any "network_strategy"

Updated available networks: en0 (wifi), utun9 (other)

Reproduction

Minimal config

{
  "log": {
    "level": "trace",
    "timestamp": true
  },
  "dns": {
    "servers": [
      {
        "tag": "local",
        "address": "223.5.5.5",
        "detour": "direct"
      },
      {
        "tag": "tailscale",
        "address": "100.100.100.100",
        "detour": "tailscale"
      }
    ],
    "rules": [
      {
        "domain_suffix": "ts.net",
        "server": "tailscale"
      }
    ]
  },
  "inbounds": [
    {
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "::1",
      "listen_port": 3333
    }
  ],
  "outbounds": [
    {
      "tag": "direct",
      "type": "direct"
    },
    {
      "tag": "tailscale",
      "type": "direct",
      "network_strategy": "hybrid",
      "network_type": "other"
    }
  ],
  "route": {
    "rules": [
      {
        "ip_cidr": "100.64.0.0/10",
        "outbound": "tailscale"
      },
      {
        "action": "sniff"
      },
      {
        "type": "logical",
        "mode": "or",
        "rules": [
          {
            "protocol": "dns"
          },
          {
            "inbound": "dns-in"
          }
        ],
        "action": "hijack-dns"
      }
    ],
    "auto_detect_interface": true
  }
}

Tested with

curl -x socks5://localhost:3333 100.x.x.x

Logs

No response

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

[nekohasekai]

What is NetworkManager is broken?

[aur3l14no]

What is NetworkManager is broken?

https://github.com/SagerNet/sing-box/blob/307bfb0d3ad87f43d9a162b0b315f76623b55601/route/network.go#L215C1-L215C12

I'm not sure but it seems func (r *NetworkManager) UpdateInterfaces() will not be not executed after 1.11.0-beta.9 using the provided config. Because no log is printed from it any more.