Add bridge outbound

2026-07-08 00:10:00 +08:00
parent f617dc42aa
commit c7fe778cae
35 changed files with 3586 additions and 12 deletions
@@ -0,0 +1,69 @@
+---
+icon: material/new-box
+---
+
+!!! question "Since sing-box 1.14.0"
+
+# Bridge
+
+!!! quote ""
+
+    Requires privileges. Supported on Linux, macOS, rooted Android, and jailbroken iOS.
+
+    For graphical clients: on macOS, only available in the standalone version and requires the
+    Root Helper; on Android, requires root permission; on iOS, requires jailbreak.
+
+`bridge` is the L3 counterpart of the `direct` outbound: it forwards L3 connections
+(TCP, UDP and ICMP) directly out of a network interface. Route L3 traffic to it from a TUN
+or other L3 endpoints via the `route` action in
+[Pre-match](/configuration/shared/pre-match/); L4 connections will be rejected.
+
+### Structure
+
+```json
+{
+  "type": "bridge",
+  "tag": "bridge-out",
+
+  "interface": "",
+  "bridge_name": "",
+  "iproute2_table_index": 0,
+  "iproute2_rule_index": 0
+}
+```
+
+### Fields
+
+#### interface
+
+Interface name for forwarded traffic to egress.
+
+The default interface will be used by default.
+
+Forwarded traffic will be dropped while the interface is unavailable.
+
+#### bridge_name
+
+Custom bridge TUN interface name prefix, `bridge` is used by default.
+
+Not effective on Apple platforms.
+
+#### iproute2_table_index
+
+!!! quote ""
+
+    Only supported on Linux, and only takes effect when `interface` is set.
+
+Linux iproute2 table index for pinned egress routes.
+
+`2200` + instance index is used by default.
+
+#### iproute2_rule_index
+
+!!! quote ""
+
+    Only supported on Linux.
+
+Linux iproute2 rule start index.
+
+`100` is used by default.
@@ -0,0 +1,67 @@
+---
+icon: material/new-box
+---
+
+!!! question "自 sing-box 1.14.0 起"
+
+# Bridge
+
+!!! quote ""
+
+    需要特权。支持 Linux、macOS、rooted Android 和越狱 iOS。
+
+    对于图形客户端：macOS 仅独立版本可用，且需要 Root Helper；Android 需要 root 权限；iOS 需要越狱。
+
+`bridge` 是 `direct` 出站的 L3 版本：它将 L3 连接（TCP、UDP 和 ICMP）直接从网络接口转发出去。
+通过[预匹配](/zh/configuration/shared/pre-match/)中的 `route` 动作，将 L3 流量从 TUN
+或其他 L3 endpoints 路由到它；L4 连接将被拒绝。
+
+### 结构
+
+```json
+{
+  "type": "bridge",
+  "tag": "bridge-out",
+
+  "interface": "",
+  "bridge_name": "",
+  "iproute2_table_index": 0,
+  "iproute2_rule_index": 0
+}
+```
+
+### 字段
+
+#### interface
+
+转发流量流出的网络接口名称。
+
+默认使用默认接口。
+
+接口不可用期间，转发流量将被丢弃。
+
+#### bridge_name
+
+自定义 bridge TUN 接口名前缀，默认使用 `bridge`。
+
+在 Apple 平台上无效。
+
+#### iproute2_table_index
+
+!!! quote ""
+
+    仅支持 Linux，且仅在设置了 `interface` 时生效。
+
+用于固定出口路由的 Linux iproute2 路由表索引。
+
+默认使用 `2200` + 实例索引。
+
+#### iproute2_rule_index
+
+!!! quote ""
+
+    仅支持 Linux。
+
+Linux iproute2 规则起始索引。
+
+默认使用 `100`。
@@ -18,6 +18,7 @@
 | Type           | Format                         |
 |----------------|--------------------------------|
 | `direct`       | [Direct](./direct/)             |
+| `bridge`       | [Bridge](./bridge/)             |
 | `block`        | [Block](./block/)               |
 | `socks`        | [SOCKS](./socks/)               |
 | `http`         | [HTTP](./http/)                 |
@@ -18,6 +18,7 @@
 | 类型             | 格式                             |
 |----------------|--------------------------------|
 | `direct`       | [Direct](./direct/)             |
+| `bridge`       | [Bridge](./bridge/)             |
 | `block`        | [Block](./block/)               |
 | `socks`        | [SOCKS](./socks/)               |
 | `http`         | [HTTP](./http/)                 |
@@ -43,8 +43,8 @@ without going through L3 to L4 translation.

 Supported targets:

- ICMP connections: Direct outbounds and WireGuard / Tailscale endpoints.
- TCP and UDP connections: WireGuard and Tailscale endpoints.
+- ICMP connections: Direct and Bridge outbounds, and WireGuard / Tailscale endpoints.
+- TCP and UDP connections: Bridge outbounds, and WireGuard / Tailscale endpoints.

 L3 forwarding also applies when no rule matches and the default outbound is a supported
 target; for outbound groups, the currently selected outbound is used.
@@ -39,8 +39,8 @@ icon: material/new-box

 支持的目标：

- ICMP 连接：direct 出站和 WireGuard / Tailscale 端点。
- TCP 和 UDP 连接：WireGuard 和 Tailscale 端点。
+- ICMP 连接：direct 和 bridge 出站以及 WireGuard / Tailscale 端点。
+- TCP 和 UDP 连接：bridge 出站以及 WireGuard / Tailscale 端点。

 当没有规则匹配且默认出站为受支持的目标时，L3 转发同样生效；对于出站组，使用当前选中的出站。