对DNS配置的增强的讨论 #6457
Replies: 26 comments
-
|
当前DNS配置已有效防止DNS泄露，但仍存在几点不足： 方案一：使用Hosts功能，将广告域名解析至无效IP地址 {
"hosts": {
"cloudflare-dns.com": [
"104.16.249.249",
"104.16.248.249",
"2606:4700::6810:f9f9",
"2606:4700::6810:f8f9"
],
"dns.google": [
"8.8.8.8",
"8.8.4.4",
"2001:4860:4860::8888",
"2001:4860:4860::8844"
],
"dns.alidns.com": [
"223.5.5.5",
"223.6.6.6",
"2400:3200:baba::1",
"2400:3200::1"
],
"geosite:category-ads-all": "127.255.255.255"
},
"servers": [
{
"address": "https://cloudflare-dns.com/dns-query",
"skipFallback": false,
"domains": [
"geosite:geolocation-!cn"
],
"expectIPs": [
"geoip:!cn"
]
},
{
"address": "https://dns.google/dns-query",
"skipFallback": false
},
{
"address": "https://dns.alidns.com/dns-query",
"skipFallback": true,
"domains": [
"geosite:cn"
],
"expectIPs": [
"geoip:cn"
]
}
]
}方案二：使用AdGuard公共DNS进行广告拦截 {
"hosts": {
"cloudflare-dns.com": [
"104.16.249.249",
"104.16.248.249",
"2606:4700::6810:f9f9",
"2606:4700::6810:f8f9"
],
"dns.adguard-dns.com": [
"94.140.14.14",
"94.140.15.15",
"2a10:50c0::ad1:ff",
"2a10:50c0::ad2:ff"
],
"dns.alidns.com": [
"223.5.5.5",
"223.6.6.6",
"2400:3200:baba::1",
"2400:3200::1"
]
},
"servers": [
{
"address": "https://cloudflare-dns.com/dns-query",
"skipFallback": false,
"domains": [
"geosite:geolocation-!cn"
],
"expectIPs": [
"geoip:!cn"
]
},
{
"address": "https://dns.adguard-dns.com/dns-query",
"skipFallback": false,
"domains": [
"geosite:category-ads-all"
]
},
{
"address": "https://dns.alidns.com/dns-query",
"skipFallback": true,
"domains": [
"geosite:cn"
],
"expectIPs": [
"geoip:cn"
]
}
]
} |
Beta Was this translation helpful? Give feedback.
-
|
同时，sing-box中的DNS配置也有小小的缺陷，当路由规则设置为全局时，查询国内域名的IP时为直连状态。 {
"servers": [
{
"tag": "remote",
"address": "8.8.8.8",
"strategy": "prefer_ipv4",
"detour": "proxy"
},
{
"tag": "cn_direct",
"address": "223.5.5.5",
"strategy": "prefer_ipv4",
"detour": "direct"
},
{
"tag": "cn_proxy",
"address": "223.5.5.5",
"strategy": "prefer_ipv4",
"detour": "proxy"
},
{
"tag": "block",
"address": "rcode://success"
}
],
"rules": [
{
"rule_set": [
"geosite-cn"
],
"outbound": "direct",
"server": "cn_direct"
},
{
"rule_set": [
"geosite-cn"
],
"outbound": "proxy",
"server": "cn_proxy"
},
{
"rule_set": [
"geosite-category-ads-all"
],
"server": "block"
}
],
"final": "remote"
} |
Beta Was this translation helpful? Give feedback.
-
|
[Info] app/dns: failed to lookup ip for domain 459yy.ipv4.surfsharkdns.com at server UDP:1.1.1.1:53 > features/dns: empty response DNS泄露检测的原理是通过让客户端尝试连接临时生成的随机域名，监听哪些DNS来请求了这个特殊的域名。 |
Beta Was this translation helpful? Give feedback.
-
此参数设置为true，则会彻底关闭DNS回退查询机制，我认为这不是好的做法。 |
Beta Was this translation helpful? Give feedback.
-
|
方案一中category-ads-all导入到本地空地址，这个已经在路由规则中有配置block了 |
Beta Was this translation helpful? Give feedback.
-
|
刚才忘记看了， "skipFallback": true就会跳过国内查询，这挺符合预期的，有效避免了国内DNS泄露。 |
Beta Was this translation helpful? Give feedback.
-
好像是的，会先走CloudFlare DNS，查询失败就会接着走Google DNS。 |
Beta Was this translation helpful? Give feedback.
-
|
如果要让Google DNS先查询，得把它放在第一位。 |
Beta Was this translation helpful? Give feedback.
-
|
你们讨论的结果可用于自用，app中默认规则需要基础功能和适合大众； |
Beta Was this translation helpful? Give feedback.
-
|
还有就是，DNS地址其实只要是国外的，客户端就会默认proxy路由到VPS上。（不然当前客户端8.8.8.8的DNS解析早被污染了，打不开google了。） |
Beta Was this translation helpful? Give feedback.
-
|
去掉一个DNS服务器，并禁用DNS回退查询机制。 {
"hosts": {
"cloudflare-dns.com": [
"104.16.249.249",
"104.16.248.249",
"2606:4700::6810:f9f9",
"2606:4700::6810:f8f9"
],
"dns.alidns.com": [
"223.5.5.5",
"223.6.6.6",
"2400:3200:baba::1",
"2400:3200::1"
],
"geosite:category-ads-all": "127.255.255.255"
},
"servers": [
{
"address": "https://cloudflare-dns.com/dns-query"
},
{
"address": "https://dns.alidns.com/dns-query",
"domains": [
"geosite:cn"
],
"expectIPs": [
"geoip:cn"
]
}
],
"disableFallback": true
} |
Beta Was this translation helpful? Give feedback.
-
@2dust |
Beta Was this translation helpful? Give feedback.
-
|
我也是试了很久，安全和速度终究没法两全。
|
Beta Was this translation helpful? Give feedback.
-
|
关键问题是core没有把“查询失败”和“ip不匹配”分开做条件判断，如果能对“查询失败”做策略，对“ip不匹配”另外做策略，那就好办了：查询失败disableFallback，ip不匹配enableFallback |
Beta Was this translation helpful? Give feedback.
-
|
@minusmulticoloredper |
Beta Was this translation helpful? Give feedback.
-
你又回到了app默认的配置了；其实dns全部发给远程解析是最好的，就是可能慢点 |
Beta Was this translation helpful? Give feedback.
-
TA的这个也算是挺完美的了，只是小众国内域名的dns解析走proxy，流量不会被代理，但是我觉得vps这边再发出DOH请求有些复杂了
|
Beta Was this translation helpful? Give feedback.
-
|
请问在开启tun模式后可以使用xray的内部dns而不是singbox的dns设置吗，可以的话该怎么设置？ |
Beta Was this translation helpful? Give feedback.
-
不用DOH的话，可以把这行去掉。 "dns.google": "8.8.8.8" |
Beta Was this translation helpful? Give feedback.
-
|
要是全部交给远程解析的话，可以用FakeDNS，但是这样就没法把域名转成IP用于匹配IP路由规则，只能匹配纯IP访问。 |
Beta Was this translation helpful? Give feedback.
-
|
还是把谷歌DNS加上吧，增加点容错。 {
"hosts": {
"geosite:category-ads-all": "127.255.255.255"
},
"servers": [
{
"address": "1.1.1.1",
"skipFallback": false,
"domains": [
"geosite:geolocation-!cn"
],
"expectIPs": [
"geoip:!cn"
]
},
{
"address": "8.8.8.8",
"skipFallback": false
},
{
"address": "223.5.5.5",
"skipFallback": true,
"domains": [
"geosite:cn"
],
"expectIPs": [
"geoip:cn"
]
}
]
} |
Beta Was this translation helpful? Give feedback.
-
这个得要开启xray内部的dns入站，然后让singbox把dns请求传给xray。 |
Beta Was this translation helpful? Give feedback.
-
有具体的配置文件吗？ |
Beta Was this translation helpful? Give feedback.
-
刚才看了一下xray配置文档，只有dns出站，没有dns入站，可能得再加个dns转发器了。 |
Beta Was this translation helpful? Give feedback.
-
|
请教一下各位高手，以下V2Ray DNS配置，是否可以？ |
Beta Was this translation helpful? Give feedback.
-
相关问题
对 "#6416" 的DNS配置的补充
描述你希望的解决方案
在正文中
描述你所考虑的替代方案
在正文中
我确认已查询历史issues
Beta Was this translation helpful? Give feedback.
All reactions