Additional docs and config for Nekobox and Sing-box

nekobox-instruction.md

Nekobox can be downloaded here

You'll need to import your V2Ray nodes to use. If you followed my guide for importing nodes from V2RayNG on Android, the process is the same.

The V2Ray node do not need to be fast, low latency or have access to your home network. The node is simply being used to access controlplane.tailscale.com and nothing more. For this requirement, you can basically use any nodes, even random free ones you found on the internet. Or use an "airport" subscription service, commonly used in China to fulfill this. You can also try my project insta-v2ray which uses free tunnel providers to provide to let you host V2Ray nodes on your own home network even if you're behind CG-NAT.

For Nekobox configuration, you'll need to make sure the domain *.tailscale.com is proxied, for you can simply proxy everything. Here is the screenshot of my Nekobox routing setup which proxies everything.

• domain: domain:tailscale.com; the domain indicate the domain and all other subdomains
• outbound: proxy

Screenshot

Screencast video showing the process:

Nekobox.mp4

• force stop Tailscale because the state can be cached (this is for demo chowcase a clean connection only, you should not do this)
• native Tailscale connection not possible
• using Nekobox and connect to a insta-v2ray node
• switch back to Tailscale and the second attempt succeed
• mobile data is disabled for the duration

singbox-configuration.md

Sing-box iOS and Android app is simply a GUI wrapper for editing configuration json file.

Here is the full configuration file.

{
    "log": {
        "level": "info",
        "timestamp": true
    },
    "dns": {
        "servers": [
            {
                "type": "udp",
                "tag": "dns-remote",
                "server": "1.1.1.1",
                "server_port": 53
            }
        ],
        "final": "dns-remote",
        "strategy": "prefer_ipv4"
    },
    "inbounds": [
        {
            "type": "tun",
            "tag": "tun-in",
            "address": [
                "172.19.0.1/30"
            ],
            "auto_route": true,
            "mtu": 9000,
            "stack": "gvisor",
            "exclude_package": [
                "io.nekohasekai.sfa"
            ]
        }
    ],
    "outbounds": [
        {
            "type": "vless",
            "tag": "proxy",
            USE_YOUR_OWN_SERVER
        },
        {
            "type": "direct",
            "tag": "direct"
        },
        {
            "type": "block",
            "tag": "block"
        }
    ],
    "endpoints": [
        {
            "type": "tailscale",
            "tag": "tailscale",
            "state_directory": "tailscale",
            "auth_key": "tskey-auth-YOUR_AUTH_KEY",
            "hostname": "sing-box2",
            "accept_routes": true,
            "detour": "proxy"
        }
    ],
    "route": {
        "rules": [
            {
                "action": "sniff"
            },
            {
                "protocol": "dns",
                "action": "hijack-dns"
            },
            {
                "domain_suffix": "tailscale.com",
                "action": "route",
                "outbound": "proxy"
            },
            {
                "ip_cidr": "ADD_YOUR_IP_CIDR",
                "action": "route",
                "outbound": "tailscale"
            }
        ],
        "final": "direct"
    }
}

The above configuration work for Android, for iOS/iPadOS you can remove the excluded_packages

-            "exclude_package": [
-                "io.nekohasekai.sfa"
-            ]

The configuration uses placeholder values, please update accordingly.

-             USE_YOUR_OWN_SERVER
+             // you can use ChatGPT to convert typical URLencoded links
+             // like vless://username@host to valid sing-box JSON and
+             // also merge it to this specific config file
-            "auth_key": "tskey-auth-YOUR_AUTH_KEY",
+             // get your auth key from Tailscale
+             // https://console.tailscale.com/admin/settings/keys
+             // make sure to check Reusable and uncheck Ephmeral
-                "ip_cidr": "ADD_YOUR_IP_CIDR",
+                "ip_cidr": "100.64.0.0/8", // example
+                 // subnet router need to be enabled for non-Tailscale CIDRs

Sing-box offers Local and Remote files for configuration. For local files, you edit the file locally on your device and select the file when prompted. For remote files, you can place the file in another computer or VPS and use a HTTP server to distribute the file. This allows you to edit to use VSCode, Codex and desktop computer to edit instead of mobile device.

What's Included

This config file routes everything as direct/bypass so it egress through your normal Wi-Fi connection, except for Tailscale related domains. DNS is intentionally not proxied so it uses your network's DNS resolver, if you face DNS poisoning, you can proxy only the Tailscale related domain resolution.

Tailscale endpoint uses the proxy as detour for connecting to controlplane.

Sing-box official documentation

• DNS Rules
• Routing Rules - useful for only proxying blocked sites
• Tailscale