Windows 上的 SRSP：已连接但没有流量
本指南汇总真实 SRSP 问题：应用显示已连接，但浏览器直连、DNS/API 无响应、切换模式后流量停止，或服务器日志出现 upstream 错误。
快速答案
如果 curl -x http://127.0.0.1:1080 有效，说明 srsp-client 正在工作。问题通常在 Windows 系统代理状态：启用了 PAC/AutoConfigURL，而不是 ProxyEnable=1 和 ProxyServer=127.0.0.1:1080。
先看症状表
本指南汇总真实 SRSP 问题：应用显示已连接，但浏览器直连、DNS/API 无响应、切换模式后流量停止，或服务器日志出现 upstream 错误。
不要只根据绿色的已连接状态判断。需要同时确认本地代理、Windows 系统代理、Wintun/routes 与服务器出口是否正常。
| 症状 | 可能原因 | 如何检查 | 如何修复 |
|---|---|---|---|
| 应用显示已连接，但浏览器仍使用本地 IP | 系统代理未生效，或仍启用了 PAC | 检查 ProxyEnable、ProxyServer、ProxyOverride 和 AutoConfigURL | 使用最新版本重新连接，恢复 127.0.0.1:1080 |
| curl -x 127.0.0.1:1080 有效，浏览器无效 | 浏览器仍使用旧的 Windows proxy/PAC 状态 | 对比带 -x 和不带 -x 的 curl | 删除 AutoConfigURL 或更新 GhostMesh |
| 1080 端口关闭 | srsp-client 未运行或凭据失败 | 检查 srsp-client 进程和本地端口 | 重新连接、重新登录或发送日志 |
| 日志显示 IPv6 Network is unreachable | 服务器没有 IPv6 出口路由 | 检查服务器路由和目标主机 | 使用 IPv4 出口或过滤不可用 IPv6 的版本 |
检查 Windows 代理
如果 curl -x http://127.0.0.1:1080 有效，说明 srsp-client 正在工作。问题通常在 Windows 系统代理状态：启用了 PAC/AutoConfigURL，而不是 ProxyEnable=1 和 ProxyServer=127.0.0.1:1080。
Working state: ProxyEnable=1, ProxyServer=127.0.0.1:1080, ProxyOverride=<local>, AutoConfigURL empty.
检查清单
- ✓Test-NetConnection 127.0.0.1 -Port 1080
- ✓curl.exe -x http://127.0.0.1:1080 https://api.ipify.org
- ✓curl.exe https://api.ipify.org
- ✓Check ProxyEnable, ProxyServer, ProxyOverride, AutoConfigURL after reconnect
安装包和内置资产
Users should not install .NET, Rust, srsp-client, or Wintun manually. The Windows installer must include them.
A partial install can show successful login and connected state while no traffic flows.
检查清单
- ✓GhostMesh.exe exists in the install directory
- ✓srsp-client.exe exists next to GhostMesh.exe
- ✓wintun.dll exists next to GhostMesh.exe
- ✓Install version 1.0.323 or later
- ✓Allow administrator elevation when Windows asks
Firewall, Wintun, routes
Windows Defender Firewall can block a new app if the first prompt was denied. TUN mode also needs Wintun routes.
If Wintun appears as a Public unidentified network, stricter firewall rules can block traffic.
- Allow inbound and outbound rules for GhostMesh.exe and srsp-client.exe.
- Check that the GhostMesh/Wintun adapter appears in VPN or Smart routing mode.
- In TUN mode, check routes such as 0.0.0.0/1 and 128.0.0.0/1.
- Reconnect after installing the latest build.
DNS, API, server logs
Separate local proxy/DNS problems from server egress problems. Local failures often send no traffic to the SRSP server; egress failures appear in srsp-server logs.
tls handshake eof, Broken pipe, and connection reset are not always outages. Correlate them with the user's exact timestamp.
| 日志 | 含义 | 操作 |
|---|---|---|
| failed to lookup address information | DNS could not resolve the host | Check host name and server DNS |
| Network is unreachable for IPv6 | No IPv6 egress route | Use IPv4 egress or filter unavailable IPv6 |
| tls handshake eof | Client or scanner closed early | Usually informational |
| Broken pipe / connection reset | Remote side or client closed | Compare with exact user timestamp |
发给支持的信息
A useful report shows which layer failed: local proxy, Windows proxy registry, Wintun route, firewall, DNS, or server egress.
Do not send passwords, tokens, private account pages, or credential files.
检查清单
- ✓Windows version and GhostMesh version
- ✓Selected server and mode
- ✓Forced proxy IP test and direct IP test
- ✓ProxyEnable, ProxyServer, ProxyOverride, AutoConfigURL values
- ✓Whether srsp-client.exe is running and port 1080 is open
- ✓Exact timestamp of the failed test
常见问题
为什么手动代理能修复，重新连接后又坏了？
Older builds could re-apply PAC/AutoConfigURL with ProxyEnable=0. The fixed build restores manual proxy 127.0.0.1:1080 after switching.
Does every Network is unreachable log mean SRSP is broken?
No. It is often one target route, especially IPv6 on a server without IPv6 egress. Confirm forced proxy and normal IPv4 tests first.