分享V5 FakeIP/FakeDNS 分流方案

[eykfnu]

参照https://blog.openwrtcn.eu.org/dnsling-wu-ran/ 改动，因原文未知域名用国内DNS会泄漏，故改进。

log:
  level: warn
  file: "./mosdns.log"

plugins:
  # 缓存插件
  - tag: cache
    type: cache
    args:
      size: 20480
      lazy_cache_ttl: 86400
      
  # 国内域名
  - tag: geosite_cn
    type: domain_set
    args:
      exps:
        - "lan"
        - "local"
        - "arpa"
      files:
        - "./chinalist.txt"

  # 国内 IP
  - tag: geoip_cn
    type: ip_set
    args:
      files:
        - "./cnip.txt"
        
  # 国外域名
  - tag: geosite_no_cn
    type: domain_set
    args:
      files:
        - "./proxylist.txt"
        
  # 国内DNS
  - tag: forward_local
    type: forward
    args:
      upstreams:
        - addr: "quic://223.5.5.5"      
        - addr: "tls://1.12.12.12"
          enable_pipeline: true      
        - addr: "tls://120.53.53.53"
          enable_pipeline: true
   
  # 国外DNS
  # 自己查找低延迟DNS
  - tag: forward_remote
    type: forward
    args:
      upstreams:
        # 101DNS
        - addr: "tls://101.101.101.101"
          enable_pipeline: true
        # NextDNS HK节点
        - addr: "https://45.11.104.186"
          insecure_skip_verify: true
        # OpenDNS SANDNOX
        - addr: "tls://208.67.222.2"
          enable_pipeline: true
        # OpenDNS 
        - addr: "tls://208.67.222.222"
          enable_pipeline: true                    

  # 私人分流dns         
  - tag: forward_private
    type: forward
    args:
      upstreams: 
        - addr: "https://doh.apad.pro/dns-query"
          bootstrap: "223.5.5.5" 

          
  # 国内解析
  - tag: local_sequence
    type: sequence
    args:
      - exec: $forward_local
        
  # 国外解析
  - tag: remote_sequence
    type: sequence
    args:
      - exec: prefer_ipv4
      - exec: $forward_remote
      
  # 分流解析    
  - tag: private_sequence
    type: sequence
    args:
      - exec: $forward_private
      
  # clash解析
  - tag: clash_sequence
    type: sequence
    args:
      - exec: forward 127.0.0.1:1053
      - exec: ttl 0

  # 有响应终止返回
  - tag: has_resp_sequence
    type: sequence
    args:
      - matches: has_resp
        exec: accept

  # fallback 用分流 sequence
  # 返回国外IP则用clash解析得出fakeip
  - tag: fallback_sequence
    type: sequence
    args:
      - exec: $private_sequence
      - matches: "!resp_ip $geoip_cn"
        exec: goto clash_sequence
      - exec: accept
      
  # 国外sequence
  - tag: fallback2_sequence
    type: sequence
    args:
      - exec: $remote_sequence
      - matches: "resp_ip $geoip_cn"
        exec: goto local_sequence
      - exec: goto clash_sequence      

  # fallback 用分流DNS，超时后用国外DNS解析    
  - tag: fallback
    type: fallback
    args:
      primary: fallback_sequence
      secondary: fallback2_sequence
      threshold: 2000
      always_standby: true

  # 主要的运行逻辑插件
  # sequence 插件中调用的插件 tag 必须在 sequence 前定义，
  # 否则 sequence 找不到对应插件。
  - tag: main_sequence
    type: sequence
    args:
      # drop https query type
      - matches:
        - qtype 65
        exec: reject 3

      # handle local ptr
      - matches:
        - qtype 12
        exec: $local_sequence
      - exec: jump has_resp_sequence

      #FakeIP不缓存
      - matches:
        - qname $geosite_no_cn
        exec: $clash_sequence
      - exec: jump has_resp_sequence
      
      # 缓存
      - exec: $cache
      - exec: jump has_resp_sequence

      - matches:
        - qname $geosite_cn
        exec: $local_sequence
      - exec: jump has_resp_sequence

      - exec: $fallback

  - tag: udp_server
    type: udp_server
    args:
      entry: main_sequence
      listen: ":53" #mosdns监听端口

[yyysuo]

我也分享一个，适用于fakeip网关方案。

mosdns监听5454，在5454端口提供服务
forward_cf 发送带ecs信息的dns请求到8.8.4.4，根据返回的结果判断是否存在cn ip
forward_xinfeng_udp 专门给apple域名服务的dns，为本地dns，优化ios访问速度
forward_local 给cn域名提供服务的dns
forward_remote sing-box或者clash的dns服务端口，国外的域名和没有cn ip返回的域名，都发给此dns

dns处理逻辑
1：geosite_cn域名列表中的，发送到forward_local
2：geosite_apple域名列表中的，发送到forward_xinfeng_udp
3：geosite_no_cn域名列表中的，发送到forward_remote
4：其它域名的逻辑在如下代码中实现，先发送带ecs信息的dns请求至forward_cf，判断结果是否为rcode 2（无返回结果），如果没有结果，
就回落到forward_local解析；然后判断是否有中国ip（在geoip_cn中），如果有结果，就回落到forward_local解析；如果不是以上2种情况，
则发到remote_sequence进行解析。

• tag: fallback_sequence
  type: sequence
  args:
  • exec: $forward_cf_upstream
  • matches: "rcode 2"
    exec: goto local_sequence
  • matches: "resp_ip $geoip_cn"
    exec: goto local_sequence
  • exec: $remote_sequence

具体的配置
log:
level: error
file: "/etc/mosdns/mosdns.log"

api:
http: "0.0.0.0:9091"

include: []

plugins:

• tag: geosite_cn
  type: domain_set
  args:
  files:
  - "/var/mosdns/geosite_cn.txt"

• tag: geoip_cn
  type: ip_set
  args:
  files:
  - "/etc/mosdns/unpack/geoip_cn.txt"

• tag: geosite_apple
  type: domain_set
  args:
  files:
  - "/var/mosdns/geosite_apple.txt"

• tag: geosite_no_cn
  type: domain_set
  args:
  files:
  - "/var/mosdns/geosite_geolocation-!cn.txt"

• tag: whitelist
  type: domain_set
  args:
  files:
  - "/etc/mosdns/rule/whitelist.txt"

• tag: blocklist
  type: domain_set
  args:
  files:
  - "/etc/mosdns/rule/blocklist.txt"

• tag: greylist
  type: domain_set
  args:
  files:
  - "/etc/mosdns/rule/greylist.txt"

• tag: ddnslist
  type: domain_set
  args:
  files:
  - "/etc/mosdns/rule/ddnslist.txt"

• tag: hosts
  type: hosts
  args:
  files:
  - "/etc/mosdns/rule/hosts.txt"

• tag: redirect
  type: redirect
  args:
  files:
  - "/etc/mosdns/rule/redirect.txt"

• tag: adlist
  type: domain_set
  args:
  files:
  - "/etc/mosdns/unpack/disable-ads.txt"

• tag: local_ptr
  type: domain_set
  args:
  files:
  - "/etc/mosdns/rule/local-ptr.txt"

• tag: lazy_cache
  type: cache
  args:
  size: 20000000
  lazy_cache_ttl: 259200000
  dump_file: /etc/mosdns/cache.dump
  dump_interval: 3600

• tag: reject_3
  type: sequence
  args:

  • exec: reject 3

• tag: reject_blocklist
  type: sequence
  args:

  • exec: query_summary reject_blocklist
  • exec: $reject_3

• tag: reject_adlist
  type: sequence
  args:

  • exec: query_summary reject_adlist
  • exec: $reject_3

• tag: reject_ptrlist
  type: sequence
  args:

  • exec: query_summary reject_ptrlist
  • exec: $reject_3

• tag: reject_qtype65
  type: sequence
  args:

  • exec: query_summary reject_qtype65
  • exec: $reject_3

• tag: forward_cf
  type: forward
  args:
  concurrent: 3
  upstreams:
  - addr: "tls://8.8.4.4:853"
  socks5: "10.10.10.4:7891"
  enable_pipeline: false
  insecure_skip_verify: false
  idle_timeout: 30
  enable_http3: false

• tag: forward_xinfeng_udp
  type: forward
  args:
  concurrent: 2
  upstreams:
  - addr: "127.0.0.1:8055"

• tag: forward_local
  type: forward
  args:
  concurrent: 1
  upstreams:
  - addr: "127.0.0.1:8055"
  enable_pipeline: false
  insecure_skip_verify: false
  idle_timeout: 10

• tag: forward_remote
  type: forward
  args:
  concurrent: 1
  upstreams:
  - addr: "10.10.10.4:7874"
  enable_pipeline: false
  insecure_skip_verify: false
  idle_timeout: 10
  enable_http3: false

• tag: modify_ttl
  type: sequence
  args:

  • exec: ttl 0-0

• tag: modify_ddns_ttl
  type: sequence
  args:

  • exec: ttl 5-5

• tag: local_sequence
  type: sequence
  args:

  • exec: $forward_local

• tag: remote_sequence
  type: sequence
  args:

  • exec: prefer_ipv4
  • exec: $forward_remote

• tag: forward_cf_upstream
  type: sequence
  args:

  • exec: prefer_ipv4
  • exec: ecs 119.167.219.177
  • exec: $forward_cf

• tag: has_resp_sequence
  type: sequence
  args:

  • matches: qname $ddnslist
    exec: $modify_ddns_ttl
  • matches: "!qname $ddnslist"
    exec: $modify_ttl
  • matches: has_resp
    exec: accept

• tag: query_is_ddns_domain
  type: sequence
  args:

  • matches: qname $ddnslist
    exec: $local_sequence

• tag: query_is_local_domain
  type: sequence
  args:

  • matches: qname $geosite_cn
    exec: $local_sequence

• tag: query_is_no_local_domain
  type: sequence
  args:

  • matches: qname $geosite_no_cn
    exec: $remote_sequence

• tag: query_is_whitelist_domain
  type: sequence
  args:

  • matches: qname $whitelist
    exec: $local_sequence

• tag: query_is_greylist_domain
  type: sequence
  args:

  • matches: qname $greylist
    exec: $remote_sequence

• tag: query_is_reject_domain
  type: sequence
  args:

  • matches: qname $blocklist
    exec: $reject_blocklist
  • matches: qname $adlist
    exec: $reject_adlist
  • matches:
    • qtype 12
    • qname $local_ptr
      exec: $reject_ptrlist
  • matches: qtype 65
    exec: $reject_qtype65

• tag: query_is_non_local_ip
  type: sequence
  args:

  • exec: $forward_local
  • matches: "!resp_ip $geoip_cn"
    exec: drop_resp

• tag: apple_domain_fallback
  type: fallback
  args:
  primary: query_is_non_local_ip
  secondary: forward_xinfeng_udp
  threshold: 100
  always_standby: true

• tag: query_is_apple_domain
  type: sequence
  args:

  • matches: "!qname $geosite_apple"
    exec: return
  • exec: $apple_domain_fallback

• tag: fallback_sequence
  type: sequence
  args:

  • exec: $forward_cf_upstream
  • matches: "rcode 2"
    exec: goto local_sequence
  • matches: "resp_ip $geoip_cn"
    exec: goto local_sequence
  • exec: $remote_sequence

• tag: main_sequence
  type: sequence
  args:

  • exec: $hosts
  • exec: jump has_resp_sequence
  • matches:
    • "!qname $ddnslist"
    • "!qname $blocklist"
    • "!qname $adlist"
    • "!qname $local_ptr"
      exec: $lazy_cache
  • exec: $redirect
  • exec: jump has_resp_sequence
  • exec: $query_is_apple_domain
  • exec: jump has_resp_sequence
  • exec: $query_is_ddns_domain
  • exec: jump has_resp_sequence
  • exec: $query_is_whitelist_domain
  • exec: jump has_resp_sequence
  • exec: $query_is_reject_domain
  • exec: jump has_resp_sequence
  • exec: $query_is_greylist_domain
  • exec: jump has_resp_sequence
  • exec: $query_is_local_domain
  • exec: jump has_resp_sequence
  • exec: $query_is_no_local_domain
  • exec: jump has_resp_sequence
  • exec: $fallback_sequence

• tag: udp_server
  type: udp_server
  args:
  entry: main_sequence
  listen: ":5454"

• tag: tcp_server
  type: tcp_server
  args:
  entry: main_sequence
  listen: ":5454"

[yyysuo]

mosdns.zip

收到，谢谢，精简这么多了吗？效果一样吧

逻辑一样，但是我把sing-box vm跟主路由openwrt合并了，你得看得懂逻辑自己改，要不然要整套照搬我的方案才行。

[llity]

逻辑一样，但是我把sing-box vm跟主路由openwrt合并了，你得看得懂逻辑自己改，要不然要整套照搬我的方案才行。

帮看看是否正确，还有需要使用缓存吗？谢谢

[yyysuo]

8844和223的idle time不要搞这么长，干脆去掉得了，我写那么长，是因为套娃了，上游是内网地址。

[yyysuo]

可以用代码格式分享一下吗？谢谢

#837

[llity]

@yyysuo 好呢，谢谢

[Sereinfy]

fallback策略，primary不是国内就去clash，这个已经知道不是了，如果需要用到secondary，说明clash返回错误，才会用到secondary，
- matches: "resp_ip $geoip_cn"
resp_ip 等于 国外 这句不就是 查询国外ip 是不是国内ip，如果是去local_sequence。那肯定不是呀。。所以又去了clash。
（个人理解，不是指错，交流一下）

[Sereinfy]

感谢，念头通达了。我忽略分流dns超时了。我现在就是超时的400，准备弃用

[000320LUCKY]

把文档一看就懂了

[smdx]

你好，如果不用clash的话fallback应该怎么修改才合适？谢谢

[Sereinfy]

  # clash解析
  - tag: clash_sequence
    type: sequence
    args:
      - exec: forward 1.1.1.1 # 改成国外dns

或者这样 clash_sequence放着不动然后

  - tag: fallback_sequence
    type: sequence
    args:
      - exec: $private_sequence
      - matches: "resp_ip $geoip_cn"
        exec: goto local_sequence # 这句也可以不要
      # 好像应该把- exec: accept 这一行改成下面的，意思是，如果返回国内ip就去local_sequence ，不是就丢弃，触发secondary
      - exec: drop_resp
或者这样直接点
      - exec: $local_sequence
      - matches: "!resp_ip $geoip_cn" # 取反，不是国内，直接丢弃
        exec: drop_resp

  # fallback   
  - tag: fallback
    type: fallback
    args:
      primary: fallback_sequence
      secondary: remote_sequence
      threshold: 2000
      always_standby: true

[smdx]

感谢解答

[llity]

谢谢分享。这配置后 DNS修改为mosdns的ip吗？谢谢

[Nanqian]

感谢分享，拿来自己改了改用用看