From 15a9ace4fd37149ae2020ed6c7e8ee32c6e9ab9e Mon Sep 17 00:00:00 2001 From: garmr-ulfr Date: Mon, 13 Jul 2026 10:58:31 -0700 Subject: [PATCH 1/2] fix(vpn): remove deprecated endpoint-independent NAT from tun defaults `EndpointIndependentNat` is only supported on gVisor stacks and is deprecated, so drop it from the system stack tun configuration. --- vpn/boxoptions_default.go | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/vpn/boxoptions_default.go b/vpn/boxoptions_default.go index adc9d91d..f88df293 100644 --- a/vpn/boxoptions_default.go +++ b/vpn/boxoptions_default.go @@ -45,12 +45,11 @@ func baseInbounds() []O.Inbound { } tunOpts := &O.TunInboundOptions{ - InterfaceName: "utun225", - Address: tunAddress, - AutoRoute: true, - StrictRoute: true, - EndpointIndependentNat: true, // needed for QUIC migration and hole-punching - Stack: "system", + InterfaceName: "utun225", + Address: tunAddress, + AutoRoute: true, + StrictRoute: true, + Stack: "system", } switch common.Platform { case "android": From 7a96ac66a7bb657e44ece23f81c0ba708d4d58bb Mon Sep 17 00:00:00 2001 From: garmr-ulfr Date: Mon, 13 Jul 2026 11:16:31 -0700 Subject: [PATCH 2/2] enable EndpointIndependentNat only on android with gvisor and ios --- vpn/boxoptions_default.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/vpn/boxoptions_default.go b/vpn/boxoptions_default.go index f88df293..f62acf7b 100644 --- a/vpn/boxoptions_default.go +++ b/vpn/boxoptions_default.go @@ -59,10 +59,12 @@ func baseInbounds() []O.Inbound { slog.Warn("kernel version unknown, keeping default TUN stack") } else if kernelBelow(kv, minAndroidSystemStackKernel) { tunOpts.Stack = "gvisor" + tunOpts.EndpointIndependentNat = true slog.Info("kernel below 5.10, using gvisor TUN stack", "kernel", kv) } case "ios": tunOpts.Stack = "" + tunOpts.EndpointIndependentNat = true case "linux": tunOpts.AutoRedirect = true }