UFW

After deploying sing-box TUN on Armbian, I encountered a rather counterintuitive issue: IPv6 ping works, but IPv6 HTTPS connections time out after enabling auto_redirect. The eventual finding was that the problem was not with IPv6 public routing or the proxy node, but rather that the Linux loopback interface lo was missing the ::1/128 address. This article documents the diagnostic process and the fix. Environment Linux: Armbian, ARM64, 6.18-series kernel sing-box: 1.14.x Network management: Netplan + NetworkManager Transparent proxy: TUN, auto_route: true, auto_redirect: true IPv6: Automatically configured by the upstream; the interface already has a global IPv6 address and an RA default route To protect privacy, this article omits the actual public IP addresses, MAC addresses, router address, domain names, and custom internal routing table numbers. The ULA addresses and test targets in the following examples are for demonstration purposes. ...

When running UFW and sing-box TUN simultaneously on a Linux bypass router, an easily misdiagnosed failure may occur: sing-box runs normally on the local machine, but LAN devices cannot access the Internet through the bypass router. Even if the TCP port that was blocked at the time is allowed, the problem may reappear after sing-box is restarted. This article documents an actually observed cause and a fix pending regression validation. All examples use documentation-reserved addresses and do not correspond to a real network. ...