iOS has nowhere to put a proxy setting, so the proxy moves into the network

Longest-prefix match is the whole steering language in this design, and it does more work than the config files suggest. A /32 in the connector's route list beats the same address learned from another subnet router advertising 10.20.0.0/16, so one host gets carved out of an existing network without renumbering anything ^[10]. The author is straight about the other side of that: delete the /32 and traffic reverts to the old path with no error anywhere ^[11]. Connections still complete. They just stop going through the corporate proxy, and no client sees a difference.

The destination list also exists twice. Once in the tailnet policy file, where 10.10.0.0/24, 10.20.0.50/32 and 192.0.2.7/32 are nominated for the connector ^[9], and once in /usr/local/etc/singbox-routes.conf on the node, carrying the same three entries under a comment telling you to keep them in sync ^[13]. One copy decides what arrives at the connector, the other decides what the connector does with it, and neither validates the other ^[17].

The rule that does the steering matches on input interface tailscale0 ^[14], which means packets the connector node originates itself never match it ^[19]. That is load-bearing in two directions. The SOCKS5 session sing-box opens to 10.0.0.10:1080 is pinned to tailscale0 by explicit bind_interface ^[2] and cannot be recaptured by the node's own rules, and in any case 10.0.0.10 falls outside all three steered prefixes ^[18]. It also means a curl from a shell on the connector exercises none of the path you just built.

The ordering bug is the part of the writeup worth keeping. sing-box's unit is Type=simple, so systemd fires ExecStartPost the moment the process forks, before singtun0 exists, and every route add fails with Cannot find device ^[3]. The ip rule entries install regardless, because rules are not device-bound, so the node ends up with rules present and table 100 empty ^[4]. Half the configuration lands, which is worse than none of it landing, and the shape of that failure comes directly from Type=simple giving systemd nothing to wait for. The mitigation is a poll loop in the script, checking for the interface in 100ms steps for up to ten seconds and logging how late it showed up ^[16].

What this buys is a proxy for devices that have no place to configure one, since iOS offers no per-app proxy setting and most apps ignore the system proxy anyway ^[5]. What it costs is that the translation now lives in a routing table on one Linux box, with auto_route deliberately switched off so sing-box does not manage that table either ^[12]. Every question a client might ask about whether its traffic went through the proxy has to be answered somewhere else.