Wireguard inbound sniffing doesn't work?

[Prototik]

I couldn't get enable to sniff domains using wireguard inbound, did I do something wrong?

My config (generated by 3x)

{
  "log": {
    "access": "./access.log",
    "dnsLog": true,
    "error": "./error.log",
    "loglevel": "debug",
    "maskAddress": ""
  },
  "routing": {
    "domainStrategy": "IPIfNonMatch",
    "rules": [
      {
        "type": "field",
        "inboundTag": [
          "api"
        ],
        "outboundTag": "api"
      },
      {
        "type": "field",
        "protocol": [
          "bittorrent"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "network": "UDP",
        "inboundTag": [
          "dns_inbound"
        ],
        "outboundTag": "dns_outbound_udp"
      },
      {
        "type": "field",
        "network": "TCP",
        "inboundTag": [
          "dns_inbound"
        ],
        "outboundTag": "dns_outbound_tcp"
      },
      {
        "type": "field",
        "domain": [
          "dns.quad9.net",
          "dns.google",
          "dns.cloudflare.com",
          "one.one.one.one"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "outboundTag": "direct",
        "ip": [
          "ext:geoip_RU.dat:ru"
        ]
      },
      {
        "type": "field",
        "domain": [
          "ext:geosite_RU.dat:ru-available-only-inside",
          "regexp:.*\\.ru$",
          "regexp:.*\\.su$",
          "regexp:.*\\.xn--p1ai$"
        ],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": [
          "ext:lists/refilter_geoip.dat:refilter"
        ],
        "balancerTag": "proxy"
      },
      {
        "type": "field",
        "domain": [
          "ext:lists/refilter_geosite.dat:refilter"
        ],
        "balancerTag": "proxy"
      },
      {
        "type": "field",
        "network": "TCP,UDP",
        "balancerTag": "proxy"
      }
    ],
    "balancers": [
      {
        "tag": "proxy",
        "selector": [
          "upstream_proxy"
        ],
        "strategy": {
          "type": "roundRobin"
        }
      }
    ]
  },
  "dns": {
    "servers": [
      "10.240.0.53",
      {
        "address": "seed1.emercoin.com",
        "domains": [
          "bazar",
          "coin",
          "emc",
          "lib"
        ],
        "expectIPs": [],
        "queryStrategy": "UseIP",
        "skipFallback": true
      }
    ],
    "queryStrategy": "UseIP",
    "tag": "dns_inbound"
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 62789,
      "protocol": "dokodemo-door",
      "settings": {
        "address": "127.0.0.1"
      },
      "streamSettings": null,
      "tag": "api",
      "sniffing": null,
      "allocate": null
    },
    {
      "listen": null,
      "port": 8080,
      "protocol": "wireguard",
      "settings": {
        "mtu": 1420,
        "secretKey": "...",
        "peers": [
          {
            "privateKey": "...",
            "publicKey": "...",
            "preSharedKey": "...",
            "allowedIPs": [
              "0.0.0.0/0",
              "::/0"
            ],
            "keepAlive": 0
          }
        ],
        "noKernelTun": false
      },
      "streamSettings": null,
      "tag": "inbound-8080",
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "metadataOnly": false,
        "routeOnly": false
      },
      "allocate": {
        "strategy": "always",
        "refresh": 5,
        "concurrency": 3
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIP",
        "fragment": {
          "packets": "tlshello",
          "length": "5-30",
          "interval": "10-20"
        },
        "noises": [
          {
            "type": "rand",
            "packet": "10-20",
            "delay": "10-16"
          }
        ]
      }
    },
    {
      "tag": "blocked",
      "protocol": "blackhole",
      "settings": {}
    },
    {
      "tag": "upstream_proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "...",
            "port": 12345,
            "users": [
              {
                "id": "b77d8fd8-988c-4a1b-b488-75dd78f35c0d",
                "flow": "",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "reality",
        "realitySettings": {
          "publicKey": "...",
          "fingerprint": "chrome",
          "serverName": "yahoo.com",
          "shortId": "2220d8",
          "spiderX": "/"
        },
        "xhttpSettings": {
          "path": "/",
          "host": "...",
          "mode": "auto",
          "noGRPCHeader": false,
          "scMinPostsIntervalMs": "30",
          "xmux": {
            "maxConcurrency": "16-32",
            "maxConnections": 0,
            "cMaxReuseTimes": 0,
            "hMaxRequestTimes": "600-900",
            "hMaxReusableSecs": "1800-3000",
            "hKeepAlivePeriod": 0
          }
        }
      },
      "mux": {
        "enabled": true,
        "concurrency": 8,
        "xudpConcurrency": 16,
        "xudpProxyUDP443": "allow"
      }
    },
    {
      "tag": "dns_outbound_udp",
      "protocol": "dns",
      "settings": {
        "network": "udp",
        "address": "10.240.0.53",
        "port": 53,
        "nonIPQuery": "skip",
        "blockTypes": []
      }
    },
    {
      "tag": "dns_outbound_tcp",
      "protocol": "dns",
      "settings": {
        "network": "tcp",
        "address": "10.240.0.53",
        "port": 53,
        "nonIPQuery": "skip",
        "blockTypes": []
      }
    }
  ],
  "transport": null,
  "policy": {
    "levels": {
      "0": {
        "statsUserDownlink": true,
        "statsUserUplink": true
      }
    },
    "system": {
      "statsInboundDownlink": true,
      "statsInboundUplink": true,
      "statsOutboundDownlink": true,
      "statsOutboundUplink": true
    }
  },
  "api": {
    "tag": "api",
    "services": [
      "HandlerService",
      "LoggerService",
      "StatsService"
    ]
  },
  "stats": {},
  "reverse": null,
  "fakedns": null,
  "burstObservatory": null
}

No matter how I play with sniffing settings and routing rules, nothing works for domain rules, only ip rules does work.

2025/02/28 06:29:49.254729 from tcp:0.0.0.0:0 accepted tcp:18.245.60.17:443 [inbound-8080 >> direct]
2025/02/28 06:29:49.254736 from tcp:0.0.0.0:0 accepted tcp:18.245.60.17:443 [inbound-8080 >> direct]
2025/02/28 06:29:49.254742 from tcp:0.0.0.0:0 accepted tcp:18.245.60.17:443 [inbound-8080 >> direct]
2025/02/28 06:29:49.254748 from tcp:0.0.0.0:0 accepted tcp:18.245.60.17:443 [inbound-8080 >> direct]
2025/02/28 06:29:49.254754 from tcp:0.0.0.0:0 accepted tcp:18.245.60.17:443 [inbound-8080 >> direct]
2025/02/28 06:29:52.001395 from 127.0.0.1:49170 accepted tcp:127.0.0.1:0 [api -> api]
2025/02/28 06:30:00.319745 from tcp:0.0.0.0:0 accepted tcp:18.165.122.87:443 [inbound-8080 >> direct]
2025/02/28 06:30:00.393990 from tcp:0.0.0.0:0 accepted tcp:99.86.4.122:443 [inbound-8080 >> direct]
2025/02/28 06:30:00.549842 from tcp:0.0.0.0:0 accepted tcp:[2a06:98c1:3122:e000::]:443 [inbound-8080 >> direct]
2025/02/28 06:30:02.002048 from 127.0.0.1:46412 accepted tcp:127.0.0.1:0 [api -> api]
2025/02/28 06:30:03.460515 from tcp:0.0.0.0:0 accepted tcp:[2a02:6b8::1f4]:443 [inbound-8080 -> direct]
2025/02/28 06:30:10.406513 from tcp:0.0.0.0:0 accepted tcp:[2606:4700:3031::6815:4475]:443 [inbound-8080 >> direct]
2025/02/28 06:30:11.565405 from tcp:0.0.0.0:0 accepted tcp:[2a01:620:ca25:e600:2cf8:a0ff:fea9:5953]:443 [inbound-8080 -> direct]
2025/02/28 06:30:12.001994 from 127.0.0.1:49104 accepted tcp:127.0.0.1:0 [api -> api]
2025/02/28 06:30:15.622853 from tcp:0.0.0.0:0 accepted tcp:[2606:4700:20::ac43:6136]:443 [inbound-8080 >> direct]
2025/02/28 06:30:22.001600 from 127.0.0.1:52716 accepted tcp:127.0.0.1:0 [api -> api]
2025/02/28 06:30:23.420334 from tcp:0.0.0.0:0 accepted tcp:104.21.32.1:80 [inbound-8080 -> upstream_proxy]
2025/02/28 06:30:32.001947 from 127.0.0.1:50648 accepted tcp:127.0.0.1:0 [api -> api]
2025/02/28 06:30:32.213776 from tcp:0.0.0.0:0 accepted tcp:[2a02:6b8::c8]:80 [inbound-8080 -> direct]
2025/02/28 06:30:32.674273 from tcp:0.0.0.0:0 accepted tcp:[2a01:620:ca25:e600:2cf8:a0ff:fea9:5953]:443 [inbound-8080 -> direct]
2025/02/28 06:30:32.674616 from tcp:0.0.0.0:0 accepted tcp:[2a01:620:ca25:e600:2cf8:a0ff:fea9:5953]:443 [inbound-8080 -> direct]
2025/02/28 06:30:34.556738 from tcp:0.0.0.0:0 accepted tcp:140.82.121.3:443 [inbound-8080 >> direct]
2025/02/28 06:30:41.563098 from tcp:0.0.0.0:0 accepted tcp:[2a01:620:ca25:e600:2cf8:a0ff:fea9:5953]:443 [inbound-8080 -> direct]
2025/02/28 06:30:42.001110 from 127.0.0.1:47660 accepted tcp:127.0.0.1:0 [api -> api]
2025/02/28 06:30:42.339778 from tcp:0.0.0.0:0 accepted tcp:185.199.108.154:443 [inbound-8080 >> direct]
2025/02/28 06:30:52.001986 from 127.0.0.1:44508 accepted tcp:127.0.0.1:0 [api -> api]

I tried switching to different versions of xray-core (within 25 release branch) and all have the same behavior.

[itsmepetrov]

It’s broken by #4760