安卓手机 sing-box 和 tailscale 共存配置参考

一开始折腾 Clash-Meta 和 tailscaled-socks5-android 浪费了很多时间，指定 Userspace networking mode 的 socks5 代理出口一直报错：

dial tail-socks match IPCIDR/100.64.0.0/10 --> error: context deadline exceeded 172.19.0.1:41221 -> 100.170.x.x:9801 io/timeout 

测试版本：Android 15 + SFA 1.14.0-alpha.15 、Windows-amd64 + SFA 1.13.9

基础配置来源：OkProxyConf Sing-Box Generator，修改 outbounds 和 endpoint 的配置

重点：

1. sing-box inbounds 的 tun 不能加 route_exclude_address，加了的话 100.64.0.0/10 会走直连不经过 tun （和 Windows 上的 Clash 配置有区别，被坑了）
2. 要访问自己的子网设备，route -> rules 的 IPCIDR 要加上自己的内网网段（ 192.168.x.x/16)，不然规则往下匹配会走直连

配置参考：

{ "$schema": "https://raw.githubusercontent.com/xmdhs/sing-box-generate-schema/refs/heads/master/schema.generated.json", "log": { "disabled": false, "level": "error", "timestamp": true }, "dns": { "strategy": "prefer_ipv4", "servers": [ { "tag": "dns_remote", "type": "https", "server": "1.1.1.1", "detour": "proxy" }, { "tag": "dns_cn", "type": "https", "server": "223.5.5.5" }, { "tag": "dns_local", "type": "udp", "server": "223.5.5.5" }, { "tag": "dns_fakeip", "type": "fakeip", "inet4_range": "198.18.0.0/15", "inet6_range": "fc00::/18" } ], "rules": [ { "clash_mode": "direct", "server": "dns_cn" }, { "clash_mode": "global", "server": "dns_remote" }, { "rule_set": "geosite-cn", "server": "dns_cn" }, { "query_type": [ "A", "AAAA" ], "rule_set": "geosite-geolocation-!cn", "server": "dns_fakeip" } ], "final": "dns_remote" }, "inbounds": [ { "tag": "tun-in", "type": "tun", "address": [ "172.19.0.1/30", "fdfe:dcba:9876::1/126" ], "mtu": 9000, "auto_route": true, "strict_route": true, "stack": "mixed" }, { "tag": "mixed-in", "type": "mixed", "listen": "127.0.0.1", "listen_port": 7890 } ], "experimental": { "clash_api": { "external_controller": "127.0.0.1:9095", "external_ui": "ui", "external_ui_download_url": "https://gh-proxy.com/https://github.com/Zephyruso/zashboard/archive/refs/heads/gh-pages.zip", "external_ui_download_detour": "direct" }, "cache_file": { "enabled": true, "path": "cache.db" } }, "outbounds": [ { "tag": "proxy", "type": "selector", "default": "urltest", "outbounds": [ "urltest", "hysteria2", "tls-reality" ] }, { "tag": "urltest", "type": "urltest", "outbounds": [ "hysteria2", "tls-reality" ] }, { "password": "", "server": "", "server_port": 443, "tag": "hysteria2", "tls": { "enabled": true, "server_name": "" }, "type": "hysteria2" }, { "server": "", "server_port": 443, "tag": "tls-reality", "tls": { "enabled": true, "server_name": "www.visa.com.hk", "utls": { "enabled": true, "fingerprint": "chrome" }, "reality": { "enabled": true, "public_key": "", "short_id": "" } }, "type": "vless", "uuid": "", "flow": "xtls-rprx-vision" } ], "endpoints": [ { "type": "tailscale", "tag": "tailscale-in", "auth_key": "", "accept_routes": true, "system_interface": false, "udp_timeout": "1m" } ], "route": { "default_domain_resolver": { "server": "dns_local" }, "rules": [ { "domain_suffix": [ "ts.net" ], "outbound": "tailscale-in" }, { "ip_cidr": [ "100.64.0.0/10", "fd7a:115c:a1e0::/48", "192.168.31.1/24" ], "outbound": "tailscale-in" }, { "action": "sniff", "sniffer": [ "http", "tls", "quic", "dns" ], "timeout": "500ms" }, { "type": "logical", "mode": "or", "rules": [ { "port": 53 }, { "protocol": "dns" } ], "action": "hijack-dns" }, { "ip_is_private": true, "action": "route", "outbound": "direct" }, { "rule_set": [ "geosite-category-ads-all" ], "action": "reject" }, { "clash_mode": "Global", "action": "route", "outbound": "proxy" }, { "clash_mode": "Direct", "action": "route", "outbound": "direct" }, { "type": "logical", "mode": "and", "rules": [ { "rule_set": "geosite-geolocation-!cn" }, { "invert": true, "rule_set": [ "geosite-cn" ] } ], "action": "route", "outbound": "proxy" }, { "rule_set": [ "geosite-cn" ], "action": "route", "outbound": "direct" }, { "rule_set": [ "geoip-cn" ], "action": "route", "outbound": "direct" } ], "auto_detect_interface": true, "rule_set": [ { "tag": "geosite-category-ads-all", "type": "remote", "format": "binary", "url": "https://ghfast.top/https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/refs/heads/sing/geo/geosite/category-ads-all.srs" }, { "tag": "geoip-cn", "type": "remote", "format": "binary", "url": "https://ghfast.top/https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/refs/heads/sing/geo/geoip/cn.srs" }, { "tag": "geosite-cn", "type": "remote", "format": "binary", "url": "https://ghfast.top/https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/refs/heads/sing/geo/geosite/cn.srs" }, { "tag": "geosite-geolocation-!cn", "type": "remote", "format": "binary", "url": "https://ghfast.top/https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/refs/heads/sing/geo/geosite/geolocation-!cn.srs" } ] } } 

以下报错是正常的，不用管：

missing Tailscale IPv4 address 报错 implicit default HTTP client using default outbound for remote rule-sets is deprecated ，https://github.com/SagerNet/sing-box/issues/4051 说在 1.14-alpha 修了，但是启动还是会提示 

REF：

1. 在 Android 上同时使用 Clash for Android 和 Tailscale
2. sb 集成 Tailscale 访问内网