[GH-ISSUE #3153] Windows XRay selects disconnected adapter with stale default gateway #1464

New issue

Open

opened 2026-10-13 20:42:57 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:42:57 +00:00

Owner

Originally created by @mmodrive on GitHub (Sep 11, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3153

Environment:

AmneziaVPN 5.0.1.5
Windows 11 build 26200
XRay core 26.7.28
Active Ethernet connection
Disconnected Wi-Fi adapter retaining an IPv4 address and default route

Problem:
XRay appears connected, but DNS resolution and web browsing fail. An Android client using the same server works correctly.

Observed diagnostics:

The tun2 adapter is created successfully at 10.33.0.2.
DNS servers 1.1.1.1 and 1.0.0.1 are assigned to tun2.
TCP/443 connections through tun2 succeed.
UDP/53 requests through tun2 time out.
TCP/53 requests through tun2 fail or are closed.
tun2 reports traffic with no adapter packet errors or discarded packets.
Authenticated requests directly through Amnezia's embedded SOCKS/XRay endpoint fail after successful SOCKS authentication.
A server-side packet capture receives the Windows XRay connection but sees no corresponding outbound DNS or web traffic.
Server-side TCP and UDP DNS tests through the same VLESS/Reality configuration succeed.
The Windows and server XRay core versions are both 26.7.28.

Root-cause indication:
NetworkUtilities::getGatewayAndIface() enumerates adapters returned by GetAdaptersAddresses() and retains the last adapter containing an IPv4 gateway. It does not check OperStatus and does not select the best route.

Xray::startXray() then uses that interface index with IP_UNICAST_IF for every outbound XRay socket.

The disconnected Wi-Fi adapter still had an IPv4 address and an active default route. Disabling Wi-Fi at the adapter level removed that route and immediately made XRay work.

Steps to reproduce:

Connect Windows to the internet through Ethernet.
Leave a Wi-Fi adapter disconnected but retaining an IPv4 address and default route.
Connect an XRay Reality profile in AmneziaVPN.
Observe that Amnezia reports a connection, but DNS and web browsing fail.
Disable the Wi-Fi adapter with Disable-NetAdapter.
Reconnect AmneziaVPN.
Observe that DNS and web browsing now work.

Expected behavior:
Amnezia should select the active adapter used by the best route to the VPN server.

Suggested fix:
Use GetBestRoute/GetBestRoute2 for the VPN server address, or ignore adapters whose OperStatus is not IfOperStatusUp. Do not select the last adapter returned by GetAdaptersAddresses().

Workaround:
Disable disconnected adapters that retain default gateways.

Originally created by @mmodrive on GitHub (Sep 11, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/3153 Environment: - AmneziaVPN 5.0.1.5 - Windows 11 build 26200 - XRay core 26.7.28 - Active Ethernet connection - Disconnected Wi-Fi adapter retaining an IPv4 address and default route Problem: XRay appears connected, but DNS resolution and web browsing fail. An Android client using the same server works correctly. Observed diagnostics: - The tun2 adapter is created successfully at 10.33.0.2. - DNS servers 1.1.1.1 and 1.0.0.1 are assigned to tun2. - TCP/443 connections through tun2 succeed. - UDP/53 requests through tun2 time out. - TCP/53 requests through tun2 fail or are closed. - tun2 reports traffic with no adapter packet errors or discarded packets. - Authenticated requests directly through Amnezia's embedded SOCKS/XRay endpoint fail after successful SOCKS authentication. - A server-side packet capture receives the Windows XRay connection but sees no corresponding outbound DNS or web traffic. - Server-side TCP and UDP DNS tests through the same VLESS/Reality configuration succeed. - The Windows and server XRay core versions are both 26.7.28. Root-cause indication: NetworkUtilities::getGatewayAndIface() enumerates adapters returned by GetAdaptersAddresses() and retains the last adapter containing an IPv4 gateway. It does not check OperStatus and does not select the best route. Xray::startXray() then uses that interface index with IP_UNICAST_IF for every outbound XRay socket. The disconnected Wi-Fi adapter still had an IPv4 address and an active default route. Disabling Wi-Fi at the adapter level removed that route and immediately made XRay work. Steps to reproduce: 1. Connect Windows to the internet through Ethernet. 2. Leave a Wi-Fi adapter disconnected but retaining an IPv4 address and default route. 3. Connect an XRay Reality profile in AmneziaVPN. 4. Observe that Amnezia reports a connection, but DNS and web browsing fail. 5. Disable the Wi-Fi adapter with Disable-NetAdapter. 6. Reconnect AmneziaVPN. 7. Observe that DNS and web browsing now work. Expected behavior: Amnezia should select the active adapter used by the best route to the VPN server. Suggested fix: Use GetBestRoute/GetBestRoute2 for the VPN server address, or ignore adapters whose OperStatus is not IfOperStatusUp. Do not select the last adapter returned by GetAdaptersAddresses(). Workaround: Disable disconnected adapters that retain default gateways.

bsakaguchi referenced this issue

2026-10-13 21:21:25 +00:00

[PR #1464] [MERGED] Focus Control fixes #2371