[Bug] 内核版本大于 v1.19.13 时使用 ping 外网 IP 有大量 ICMP 请求包

[lwQin]

验证步骤

• 我已经阅读了 文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
• 我仔细看过 文档 并未解决问题
• 我已在 Issue Tracker 中寻找过我要提出的问题，并且没有找到
• 我是中文用户，而非其他语言用户
• 我已经使用最新的 Alpha 分支版本测试过，问题依旧存在
• 我提供了可以在本地重现该问题的服务器、客户端配置文件与流程，而不是一个脱敏的复杂客户端配置文件。
• 我提供了可用于重现我报告的错误的最简配置，而不是依赖远程服务器或者堆砌大量对于复现无用的配置等。
• 我提供了完整的日志，而不是出于对自身智力的自信而仅提供了部分认为有用的部分。
• 我直接使用 Mihomo 命令行程序重现了错误，而不是使用其他工具或脚本。

操作系统

Linux

系统版本

Debian 12

Mihomo 版本

Mihomo Meta v1.19.13 linux amd64 with go1.25.0 Wed Aug 27 09:35:09 UTC 2025
Use tags: with_gvisor

配置文件

mixed-port: 7890
allow-lan: true
unified-delay: false
disable-icmp-forwarding: false
tcp-concurrent: true
external-controller: :9090
external-ui: ui
external-ui-url: 'https://github.com/MetaCubeX/metacubexd/archive/refs/heads/gh-pages.zip'
ipv6: false
find-process-mode: off

geodata-mode: false
geodata-loader: standard
geo-auto-update: true
geo-update-interval: 6
geox-url:
  geosite: https://ghfast.top/https://github.com/v2fly/domain-list-community/releases/latest/download/dlc.dat
  mmdb: https://ghfast.top/https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-Country.mmdb
  geoip: https://ghfast.top/https://github.com/v2ray/geoip/raw/release/geoip.dat
  asn: https://ghfast.top/https://raw.githubusercontent.com/Loyalsoldier/geoip/release/GeoLite2-ASN.mmdb
global-client-fingerprint: chrome

profile:
  store-selected: true
  store-fake-ip: true

mode: rule
log-level: debug

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true

dns:
  enable: true
  listen: :5353
  ipv6: false
  prefer-h3: true
  enhanced-mode: redir-host
  nameserver-policy:
    "geosite:cn,private,apple":
      - https://223.5.5.5/dns-query
      - https://223.6.6.6/dns-query
      - https://101.101.101.101/dns-query
      - https://1.12.12.12/dns-query
      - https://120.53.53.53/dns-query
    "geosite:geolocation-!cn":
      - https://1.1.1.1/dns-query#Proxy
      - https://1.0.0.1/dns-query#Proxy
      - https://8.8.8.8/dns-query#Proxy
      - https://8.8.4.4/dns-query#Proxy
  nameserver:
    - https://223.5.5.5/dns-query
    - https://223.6.6.6/dns-query
  proxy-server-nameserver:
    - https://223.5.5.5/dns-query
    - https://223.6.6.6/dns-query

sniffer:
  enable: true
  force-dns-mapping: false
  parse-pure-ip: true
  override-destination: false
  sniff:
    HTTP:
      ports: [80, 8080-8880]
    TLS:
      ports: [443, 8443]
    QUIC:
      ports: [443, 8443]

proxies:

rules:
  - GEOIP,CN,DIRECT,no-resolve
  - MATCH,Proxy,no-resolve

描述

mihomo 内核版本大于 v1.19.13 时使用 ping 外网 IP 不可达且会有大量请求包，版本回退到 v1.19.13 后 ping 外网 IP 也不可达但不会产生大量请求包，重启核心后正常

重现方式

systemctl restart clash
ping 1.1.1.1

日志

7587	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7586	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7585	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7584	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7583	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7582	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7581	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7580	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7579	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7578	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7577	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7576	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7575	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7574	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7573	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7572	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7571	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7570	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7569	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7568	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7567	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7566	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7565	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7564	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7563	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7562	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7561	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7560	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7559	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7558	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7557	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7556	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7555	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7554	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7553	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7552	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7551	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7550	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7549	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7548	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7547	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7546	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7545	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7544	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7543	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7542	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7541	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7540	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7539	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7538	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1
7537	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 54710 seq 1
7536	[debug]	write ICMPv4 echo request from 198.18.0.1 to 1.1.1.1 id 10825 seq 1

[ReRokutosei]

问题居然还存在么...

试试临时办法，将disable-icmp-forwarding: true在tun下正确设置？你现在写错位置了

参考：

• [Bug] CPU占用过高，疑似ICMP回环 #2382 (comment)

• mihomo/docs/config.yaml

  Lines 135 to 148 in 6b40072

  	# Tun 配置
  	tun:
  	enable: false
  	stack: system # gvisor/mixed
  	dns-hijack:
  	- 0.0.0.0:53 # 需要劫持的 DNS
  	# auto-detect-interface: true # 自动识别出口网卡
  	# auto-route: true # 配置路由表
  	# mtu: 9000 # 最大传输单元
  	# gso: false # 启用通用分段卸载，仅支持 Linux
  	# gso-max-size: 65536 # 通用分段卸载包的最大大小
  	auto-redirect: false # 自动配置 iptables 以重定向 TCP 连接。仅支持 Linux。带有 auto-redirect 的 auto-route 现在可以在路由器上按预期工作，无需干预。
  	# strict-route: true # 将所有连接路由到 tun 来防止泄漏，但你的设备将无法其他设备被访问
  	# disable-icmp-forwarding: true # 禁用 ICMP 转发，防止某些情况下的 ICMP 环回问题，ping 将不会显示真实的延迟

[lwQin]

@ReRokutosei 配置改写在了 tun 下，测试了 v1.19.17 问题依然存在