分享个v5国内国外域名分流的配置

[PHCSJC]

首先感谢大佬的付出，从v3就开始用，真的非常不错，感谢！

这个配置可以实现：
1.国内域名（已知和未知）用国内DNS解析，直连
2.国外域名（已经和未知）用国外DNS解析，走代理访问（ipset方式）
未知域名的处理方式：先用国内和国外DNS并行解析出ip，再用ip判断，如果是国内ip则直连，如果是国外ip则走代理

log:
  level: info

plugins:
  # 缓存
  - tag: cache
    type: cache
    args:
      size: 10240
      lazy_cache_ttl: 86400

  # 重定向域名
  - tag: redirect
    type: redirect
    args:
      rules:
        - www.cnbeta.com www.cnbeta.com.cdn.cloudflare.net

  # 转发至国内DNS, 并发查询
  - tag: forward_local
    type: forward
    args:
      concurrent: 2
      upstreams:
        - addr: udp://119.29.29.29
        - addr: udp://223.5.5.5

  # 转发至国外DNS, 并发查询
  - tag: forward_remote
    type: forward
    args:
      concurrent: 2
      upstreams:
        - addr: tcp://8.8.8.8
        - addr: tcp://1.1.1.1

  # 自定义hosts
  - tag: hosts
    type: hosts
    args:
      files:
        - "/etc/mosdns/hosts"

  # china ip和自己的vps ip、国内dns ip、内网ip，避免这些ip被加到ipset
  - tag: local_ip
    type: ip_set
    args:
      files:
        - /etc/mosdns/china_ip_list.txt
        - /etc/mosdns/myvpsip.txt

  # fallback的primary服务器, 返回国内ip则accept, 返回非国内ip则drop
  - tag: local_sequence
    type: sequence
    args:
      - exec: $forward_local
      - matches: resp_ip $local_ip
        exec: accept
      - exec: drop_resp

  # fallback的secondary服务器, 返回非国内ip则添加至ipset, 返回国内ip只接受不会添加ipset
  - tag: remote_sequence
    type: sequence
    args:
      - exec: $forward_remote
      - matches: "!resp_ip $local_ip"
        exec: ipset gfwlist,inet,32
      - exec: accept

  # fallback sequence
  - tag: fallback
    type: fallback
    args:
      primary: local_sequence
      secondary: remote_sequence
      threshold: 500
      always_standby: true

  # gfwlist解析出的ip添加至ipset，添加前先判断是否为国内ip或内网ip
  - tag: gfw-list
    type: sequence
    args:
      - exec: ttl 300-3600
      - matches: "!resp_ip $local_ip"
        exec: ipset gfwlist,inet,24
      - exec: accept

  # 主运行序列
  - tag: main_sequence
    type: sequence
    args:
      - exec: $hosts
      - matches: has_resp
        exec: accept

      # 屏蔽PTR和DNSSEC，解决ios系统的一些问题
      - matches: qtype 12 65
        exec: reject 0

      # 屏蔽广告
      - matches: qname &/etc/mosdns/reject-list.txt &/etc/mosdns/my-reject-list.txt
        exec: black_hole 127.0.0.1

      - exec: prefer_ipv4

      - exec: $redirect

      # 动态域名跳过缓存
      - matches: "!qname 00006801.com"
        exec: $cache
      - matches: has_resp
        exec: accept

      # 国内域名
      - matches: qname &/etc/mosdns/direct-list.txt
        exec: $forward_local
      - matches: has_resp
        exec: accept

      # 国外域名
      - matches: qname &/etc/mosdns/proxy-list.txt
        exec: $forward_remote
      - matches: has_resp
        exec: goto gfw-list

      # 其他未知域名
      - exec: $fallback


  # 启动监听服务
  - tag: udp_server
    type: udp_server
    args:
      entry: main_sequence
      listen: :53

  - tag: tcp_server
    type: tcp_server
    args:
      entry: main_sequence
      listen: :53

[PHCSJC]

一些解释：
1.myvpsip.txt包含所有内网ip段、自己的vps地址、国内的dns，避免这些ip被添加至ipset
2.goto gfw-list是因为要执行多个exec，所以放到一个单独的序列中
3.gfw-list序列中添加了ip判断，是因为之前出现过某个gfw域名解析出的ip竟然是127.0.0.1这种奇葩事件
4.此配置已最优化访问所有网站，不过有2个缺点，缺点1是：有些直接通过ip访问（国外ip）的网站不会走代理，如果常用可以手动添加至ipset来解决，缺点2是：不能防DNS泄漏，可以把所有未知域名只交给国外DNS解析，避免一定的泄漏，但也不能完全避免，比如正常app故意内置了探测域名，且解析出的ip也在国外
5.文件来源
域名和ip均来自：https://github.com/Loyalsoldier/v2ray-rules-dat
china_ip_list：https://raw.githubusercontent.com/Loyalsoldier/geoip/release/text/cn.txt
广告域名：https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/reject-list.txt
直连域名：https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/direct-list.txt
代理域名：https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/proxy-list.txt

[nil-ca]

一些解释： 1.myvpsip.txt包含所有内网ip段和自己的vps地址，避免这些ip被添加至ipset 2.goto gfw-list是因为要执行多个exec，所以放到一个单独的序列中 3.gfw-list序列中添加了ip判断，是因为之前出现过某个gfw域名解析出的ip竟然是127.0.0.1这种奇葩事件 4.此配置已最优化访问所有网站，唯一的缺点是：有些直接通过ip访问（国外ip）的网站不会走代理，如果常用可以手动添加至ipset来解决 5.域名和ip来自：https://github.com/Loyalsoldier/v2ray-rules-dat

IP好像可以用https://github.com/Loyalsoldier/geoip/tree/release/text
Loyalsoldier大佬好像每次更新都会把新的txt文件传到release 有这个应该可以配合!感叹号做取反吧

[PHCSJC]

看了是一样的，可以取反的，感谢！

[Swiftfrog]

这是V5的配置吗？看起来好像比V4翻到简洁了。

不过逻辑似乎都没变。

[yyysuo]

您好，请问加入ipset有什么好处呢，我看您加入的ipset的名字是gfwlist，是和ssrp配合的吗？我用套娃把dns方案独立出来了，用ipset list gfwlist命令看并没有条目，也没有影响我科学上网。

[jayolim]

个人感觉很漂亮，谢谢分享

[yyysuo]

关于IPSET，最近学习了一下ssrp和passwall关于ipset的部分，发现都向op的防火墙添加了match-set相关的规则，我觉得可以利用blacklist和whitelist，这2个ipset在ssrp和passwall中都被使用了，gfwlist这个ipset反而没有被添加到防火墙规则当中，楼主是自己添加了iptables规则吗？

[PHCSJC]

我用的软路由，直接debian10做网关，ipset和iptables都是自己配置的，所以配置起来很自由

[w22gb8]

继续坚守v3

[zqp561022]

感谢分享~

[hkwpc]

这个自定义规则V5版本使用不了。

[PHCSJC]

那就不清楚了，我已经用了几个月了

[hkwpc]

折腾了半天，V5版本用上了这个自定义配置，终于能启动了，问题就出在安装V5版本插件之前，要将所有的mosdns老版本残留文件全部删掉，方可正常，而不是简单的卸载老版本插件，特此提示一下。

[cslp0701]

我的op带的就是5.13的，直接粘贴进自定义的对话框， 运行不起来啊

[xiaoyigg]

不知道咋个用，直接复制配置文件到自定义配置里就可以了嘛？

[GD2021]

log:
level: info

plugins:

缓存

• tag: cache
  type: cache
  args:
  size: 10240
  lazy_cache_ttl: 86400

重定向域名

• tag: redirect
  type: redirect
  args:
  rules:
  - www.cnbeta.com www.cnbeta.com.cdn.cloudflare.net

转发至国内DNS，并发查询

• tag: forward_local
  type: forward
  args:
  upstreams:
  concurrent: 2
  - addr: udp://119.29.29.29
  - addr: udp://223.5.5.5

转发至国外DNS，并发查询

• tag: forward_remote
  type: forward
  args:
  upstreams:
  concurrent: 2
  - addr: tcp://8.8.8.8
  - addr: tcp://1.1.1.1

自定义hosts

• tag: hosts
  type: hosts
  args:
  files:
  - "/etc/mosdns/hosts"

china ip和自己的vps ip

• tag: local_ip
  type: ip_set
  args:
  files:
  - /etc/mosdns/rule/china_ip_list.txt
  - /etc/mosdns/rule/myvpsip.txt

fallback的primary服务器,返回非国内ip则drop_resp

• tag: local_sequence
  type: sequence
  args:
  • exec: $forward_local
  • matches: "!resp_ip $local_ip"
    exec: accept
  • exec: drop_resp

fallback的secondary服务器,返回非国内ip则添加至ipset,返回国内ip只接受不会添加ipset

• tag: remote_sequence
  type: sequence
  args:
  • exec: $forward_remote
  • matches: "!resp_ip $local_ip"
    exec: ipset gfwlist,inet,24
  • exec: accept

fallback sequence

• tag: fallback
  type: fallback
  args:
  primary: local_sequence
  secondary: remote_sequence
  threshold: 500
  always_standby: true

gfwlist解析出的ip添加至ipset，添加前先判断是否为国内ip或内网ip

• tag: gfw-list
  type: sequence
  args:
  • exec: ttl 300-3600
  • matches: "!resp_ip $local_ip"
    exec: ipset gfwlist,inet,24
  • exec: accept

主运行序列

• tag: main_sequence
  type: sequence
  args:

  • exec: $hosts

  • matches: has_resp
    exec: accept

  • matches: qtype 65
    exec: reject 3

  • matches: qname &/etc/mosdns/rule/reject-list.txt &/etc/mosdns/my-reject-list.txt
    exec: reject

  • exec: prefer_ipv4

  • exec: $redirect

  动态域名跳过缓存

  • matches: "!qname 00006801.com"
    exec: $cache

  • matches: has_resp
    exec: accept

  • matches: qname &/etc/mosdns/rule/direct-list.txt
    exec: $forward_local

  • matches: has_resp
    exec: accept

  • matches: qname &//etc/mosdns/rule/proxy-list.txt
    exec: $forward_remote

  • matches: has_resp
    exec: goto gfw-list

  • exec: $fallback

启动监听服务

• tag: udp_server
  type: udp_server
  args:
  entry: main_sequence
  listen: :53

• tag: tcp_server
  type: tcp_server
  args:
  entry: main_sequence
  listen: :53

我下载了需要的配置文件，并且修改了配置的路径，为何运行不起来呢

[GD2021]

我是在N1旁路由上使用的

[tlze]

找个搞技术的帮你一把先，就你上面的问题，很难有人能帮到你。

[GD2021]

我是装的luci版5.1.1

[ziyeqf]

挖个坟, 可以用一下命令手动运行mosdns来查看报错信息 , 其中{config_file}是你配置文件的路径

mosdns start -c {config_file}

[AlphaAnother]

首先感谢大佬的付出，从v3就开始用，真的非常不错，感谢！

这个配置可以实现： 1.国内域名（已知和未知）用国内DNS解析，直连 2.国外域名（已经和未知）用国外DNS解析，走代理访问（ipset方式）

log:
  level: info

plugins:
  # 缓存
  - tag: cache
    type: cache
    args:
      size: 10240
      lazy_cache_ttl: 86400

  # 重定向域名
  - tag: redirect
    type: redirect
    args:
      rules:
        - www.cnbeta.com www.cnbeta.com.cdn.cloudflare.net

  # 转发至国内DNS，并发查询
  - tag: forward_local
    type: forward
    args:
      upstreams:
      concurrent: 2
        - addr: udp://119.29.29.29
        - addr: udp://223.5.5.5

  # 转发至国外DNS，并发查询
  - tag: forward_remote
    type: forward
    args:
      upstreams:
      concurrent: 2
        - addr: tcp://8.8.8.8
        - addr: tcp://1.1.1.1

  # 自定义hosts
  - tag: hosts
    type: hosts
    args:
      files:
        - "/etc/mosdns/hosts"

  # china ip和自己的vps ip
  - tag: local_ip
    type: ip_set
    args:
      files:
        - /etc/mosdns/china_ip_list.txt
        - /etc/mosdns/myvpsip.txt

  # fallback的primary服务器,返回非国内ip则drop_resp
  - tag: local_sequence
    type: sequence
    args:
      - exec: $forward_local
      - matches: "!resp_ip $local_ip"
        exec: accept
      - exec: drop_resp

  # fallback的secondary服务器,返回非国内ip则添加至ipset,返回国内ip只接受不会添加ipset
  - tag: remote_sequence
    type: sequence
    args:
      - exec: $forward_remote
      - matches: "!resp_ip $local_ip"
        exec: ipset gfwlist,inet,24
      - exec: accept

  # fallback sequence
  - tag: fallback
    type: fallback
    args:
      primary: local_sequence
      secondary: remote_sequence
      threshold: 500
      always_standby: true

  # gfwlist解析出的ip添加至ipset，添加前先判断是否为国内ip或内网ip
  - tag: gfw-list
    type: sequence
    args:
      - exec: ttl 300-3600
      - matches: "!resp_ip $local_ip"
        exec: ipset gfwlist,inet,24
      - exec: accept

  # 主运行序列
  - tag: main_sequence
    type: sequence
    args:
      - exec: $hosts
      - matches: has_resp
        exec: accept
      
      - matches: qtype 65
        exec: reject 3

      - matches: qname &/etc/mosdns/reject-list.txt &/etc/mosdns/my-reject-list.txt
        exec: reject

      - exec: prefer_ipv4

      - exec: $redirect

      # 动态域名跳过缓存
      - matches: "!qname 00006801.com"
        exec: $cache
      - matches: has_resp
        exec: accept

      - matches: qname &/etc/mosdns/direct-list.txt
        exec: $forward_local
      - matches: has_resp
        exec: accept

      - matches: qname &/etc/mosdns/proxy-list.txt
        exec: $forward_remote
      - matches: has_resp
        exec: goto gfw-list

      - exec: $fallback


  # 启动监听服务
  - tag: udp_server
    type: udp_server
    args:
      entry: main_sequence
      listen: :53

  - tag: tcp_server
    type: tcp_server
    args:
      entry: main_sequence
      listen: :53

local_sequence这段的执行是不是搞反了？和注释的逻辑不一样吧？

[bovbo]

顺手复制粘贴不能起动 用内置运行有时间再研究修改下

[CyEilo]

同感

  # fallback的primary服务器,返回非国内ip则drop_resp
  - tag: local_sequence
    type: sequence
    args:
      - exec: $forward_local
      - matches: "!resp_ip $local_ip"
        exec: accept
      - exec: drop_resp

  # fallback的secondary服务器,返回非国内ip则添加至ipset,返回国内ip只接受不会添加ipset
  - tag: remote_sequence
    type: sequence
    args:
      - exec: $forward_remote
      - matches: "!resp_ip $local_ip"
        exec: ipset gfwlist,inet,24
      - exec: accept

按照注释的理解 第一段最后两行似乎写反了?
应该是?

  # fallback的primary服务器,返回非国内ip则drop_resp
  - tag: local_sequence
    type: sequence
    args:
      - exec: $forward_local
      - matches: "!resp_ip $local_ip"
        exec: drop_resp
      - exec: accept

不是很确定, 或者是注释写错了?希望有大佬解惑

[PHCSJC]

@AlphaAnother @CyEilo 确实不对，已修正，感谢！

[czp744]

请问下我想
mosdns ip 设为10.0.0.4
Clash. Ip 设为10.0.0.3
Aikuai. Ip 设为10.0.0.1

可以直接用这个配置吗。如果不行应该怎么设置 都是debian 系统 谢谢🙏

[mulder125]

"concurrent: 2" 要放在 "upstreams:" 上面，不然会运行不起来

[PHCSJC]

感谢，已修改

[crazzzzzysnail]

openwrt里5.1.3,把相应文件放到\etc\mosdns后直接复制粘贴到自定义配置里运行不起来

[Sinclair19]

请查看 #605 (comment)

[kinist]

- matches: "!qname 00006801.com" exec: $cache - matches: has_resp exec: accept
请教下，这段代码的意思是:
如果请求域名不等于00006801.com结尾的话，先到缓存里面找，如果缓存里面找到了，直接accept并且不执行后面代码。那后面解析的域名什么时候会加到缓存里面呢？

[PHCSJC]

这个域名跳过缓存，直接去上游查询

[Sinclair19]

openwrt 的 luci mosdns 要想用这个需要将几个文件下载放到 /etc/mosdns

需要的文件有

• china_ip_list.txt
• direct-list.txt
• proxy-list.txt
• reject-list.txt
• my-reject-list.txt 自行新建
• myvpsip.txt 自行新建
• hosts 自行新建

同时，需要修改配置文件，加入一行日志文件目录，否则无法启动

log:
  level: info
  file: "/var/log/mosdns.log" #加入此行

[asnon]

奇怪了，已经都放到 /etc/mosdns，也添加了日志文件了但是还是无法启动，

[Sinclair19]

请先尝试命令行里启动，那个会报具体的错误内容，以及使用luci mosdns默认配置文件启动

[hanxin1997]

视乎还要geosite_apple.txt 放到/var/mosdns/geosite_apple.txt 然后我就成功启动了 但是理解不能 配置好像都没有需要这个文件

[ali2liu]

这个配置要修改哪里才能够支持IPv6？

[Sinclair19]

默认已支持ipv6，只是在双栈时偏向使用ipv4
可参考 https://irine-sistiana.gitbook.io/mosdns-wiki/mosdns-v5/ru-he-pei-zhi-mosdns/sequence-cha-jian#prefer_ipv4-6

可以删除或修改 - exec: prefer_ipv4

[slfzicker]

这些iplist一定要下载到本地吗？能不能设置成随在线版本更新？

[gavinliuisme]

写个脚本自动更新就好

[smdx]

大佬，请问可以提供一下自动更新的脚本吗？谢谢

[langoyb]

版本5.3，按照大佬们的教程配置成功，效果还待进一步测试。
不懂就问，这个配置里是不是没有防DNS泄漏的语句，如果需要这个功能应该怎么开启？

[abigchopstick]

这个配置远程用的是公共的DNS，分配不到离远程IP属地最快的IP吧

[PHCSJC]

大厂DNS都是给最近最快的IP，这点完全不用担心

[abigchopstick]

可是这远程DNS用的是本地IP查的啊。。。有没办法把这些国外的IP扔给CLASH叫他全部走代理？
但我发现如果把127.0.0.1:7874设置成唯一远程DNS，clash在碰到match, proxy这样的规则还是会质询所有的DNS导致泄漏

[blueinkgz]

wiki中有范例，可以在下面加socks5代理

[xrxfu]

我是openclash劫持Dnsmasq，上游dns只添加127.0.0.1:5335, clash规则里添加Mosdns的远程dns，然后mosdns端口设5335,fallback只要不是国内域名全部转远程解析。这样就没有DNS泄漏

[PHCSJC]

@abigchopstick 远程DNS也走代理就可以了

[xieguozhong]

感谢，用上了

[hu2846]

仔细的看了几遍说明，已经用起来了，感谢分享

[jameqq]

怎么设置的 我好像一直启动失败

[hu2846]

仔细看说明，多看几遍。应该是文件不对。按要求自己添加和新建，有文件要自己新建的

[wzy105]

感觉多次一举，未知的域名依然会用国内dns解析。按你们说法照样泄露。还不如单用clash效率高

[PHCSJC]

@whosa 有道理，确实没考虑到这点，那怎么改一下这个has_resp呢？在代理挂了的情况下，也不会走fallback呢

[PHCSJC]

@whosa 更新：我抓包试了下，如果代理挂了，不会走到fallback，说明mosdns作者在设计时的辑就是这样的

[whosa]

@PHCSJC 嗯，我也正在测试，好像服务器访问不到就不会继续往下走了。不过这么设计总感觉怪怪的，有点不符合直觉，文档上没有显式说明，我还以为只有accept、reject、goto和return会结束当前动作序列。不过考虑到专门给了fallback插件，可能确实就是这么设计的。

[PHCSJC]

@whosa 作者已经更新好几个大版本了，这样设计，肯定是有他的道理的，我记得以前他好像还解释过，咱也不懂，会用就行

[goodffd]

goto要改成jump，否则最后一条fallback永远不会执行。

[CareyQ]

@PHCSJC 大佬，iptables 的配置可以分享一下吗，我用的是 v2ray 做的代理，我感觉所有流量都到上面去了，翻了一夜，总感觉怪怪的。

还有一个问题，mosdns 有好多 connection reset by peer 和 context deadline exceeded

2024-05-30T01:24:48.154+0800    WARN    forward_remote  upstream error  {"uqid": 5879, "qname": "play.google.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:24:48.834+0800    WARN    forward_remote  upstream error  {"uqid": 5897, "qname": "www.youtube.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://8.8.8.8", "error": "read tcp 192.168.10.15:33232->8.8.8.8:53: read: connection reset by peer"}
2024-05-30T01:24:53.726+0800    WARN    forward_remote  upstream error  {"uqid": 5897, "qname": "www.youtube.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:24:53.726+0800    WARN    udp_server      entry err       {"query": {"uqid": 5897, "client": "::ffff:127.0.0.1", "qname": "www.youtube.com.", "qtype": 1, "qclass": 1, "elapsed": "5.001293645s"}, "error": "context deadline exceeded"}
2024-05-30T01:26:18.371+0800    WARN    forward_remote  upstream error  {"uqid": 5941, "qname": "displaycatalog.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:21.569+0800    WARN    forward_remote  upstream error  {"uqid": 5944, "qname": "fe3cr.delivery.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:21.595+0800    WARN    forward_remote  upstream error  {"uqid": 5945, "qname": "fe3cr.delivery.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:52.700+0800    WARN    fallback        secondary error {"query": {"uqid": 5952, "client": "::ffff:127.0.0.1", "qname": "path2.xtracloud.net.", "qtype": 1, "qclass": 1, "elapsed": "5.000200667s"}, "error": "context deadline exceeded"}
2024-05-30T01:26:52.702+0800    WARN    forward_remote  upstream error  {"uqid": 5952, "qname": "path2.xtracloud.net.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:52.702+0800    WARN    forward_remote  upstream error  {"uqid": 5952, "qname": "path2.xtracloud.net.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:10.085+0800    WARN    forward_remote  upstream error  {"uqid": 5961, "qname": "tsfe.trafficshaping.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:10.404+0800    WARN    forward_remote  upstream error  {"uqid": 5962, "qname": "settings-win.data.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:13.567+0800    WARN    forward_remote  upstream error  {"uqid": 5966, "qname": "geo.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:13.581+0800    WARN    udp_server      entry err       {"query": {"uqid": 5967, "client": "::ffff:127.0.0.1", "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qtype": 1, "qclass": 1, "elapsed": "5.000662322s"}, "error": "context deadline exceeded"}
2024-05-30T01:27:13.581+0800    WARN    forward_remote  upstream error  {"uqid": 5967, "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:13.581+0800    WARN    forward_remote  upstream error  {"uqid": 5967, "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:13.609+0800    WARN    forward_remote  upstream error  {"uqid": 5968, "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:17.374+0800    WARN    forward_remote  upstream error  {"uqid": 5973, "qname": "cp601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:18.887+0800    WARN    forward_remote  upstream error  {"uqid": 5974, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:18.887+0800    WARN    forward_remote  upstream error  {"uqid": 5974, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:18.887+0800    WARN    udp_server      entry err       {"query": {"uqid": 5974, "client": "::ffff:127.0.0.1", "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qtype": 1, "qclass": 1, "elapsed": "5.000295575s"}, "error": "all upstream servers failed"}
2024-05-30T01:27:18.913+0800    WARN    forward_remote  upstream error  {"uqid": 5975, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:18.914+0800    WARN    forward_remote  upstream error  {"uqid": 5975, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:18.914+0800    WARN    udp_server      entry err       {"query": {"uqid": 5975, "client": "::ffff:127.0.0.1", "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qtype": 1, "qclass": 1, "elapsed": "5.000895049s"}, "error": "all upstream servers failed"}
2024-05-30T01:27:20.880+0800    WARN    forward_remote  upstream error  {"uqid": 5977, "qname": "array614.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:41.324+0800    WARN    forward_remote  upstream error  {"uqid": 6004, "qname": "github.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}

[yyysuo]

@PHCSJC 大佬，iptables 的配置可以分享一下吗，我用的是 v2ray 做的代理，我感觉所有流量都到上面去了，翻了一夜，总感觉怪怪的。

还有一个问题，mosdns 有好多 connection reset by peer 和 context deadline exceeded

2024-05-30T01:24:48.154+0800    WARN    forward_remote  upstream error  {"uqid": 5879, "qname": "play.google.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:24:48.834+0800    WARN    forward_remote  upstream error  {"uqid": 5897, "qname": "www.youtube.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://8.8.8.8", "error": "read tcp 192.168.10.15:33232->8.8.8.8:53: read: connection reset by peer"}
2024-05-30T01:24:53.726+0800    WARN    forward_remote  upstream error  {"uqid": 5897, "qname": "www.youtube.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:24:53.726+0800    WARN    udp_server      entry err       {"query": {"uqid": 5897, "client": "::ffff:127.0.0.1", "qname": "www.youtube.com.", "qtype": 1, "qclass": 1, "elapsed": "5.001293645s"}, "error": "context deadline exceeded"}
2024-05-30T01:26:18.371+0800    WARN    forward_remote  upstream error  {"uqid": 5941, "qname": "displaycatalog.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:21.569+0800    WARN    forward_remote  upstream error  {"uqid": 5944, "qname": "fe3cr.delivery.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:21.595+0800    WARN    forward_remote  upstream error  {"uqid": 5945, "qname": "fe3cr.delivery.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:52.700+0800    WARN    fallback        secondary error {"query": {"uqid": 5952, "client": "::ffff:127.0.0.1", "qname": "path2.xtracloud.net.", "qtype": 1, "qclass": 1, "elapsed": "5.000200667s"}, "error": "context deadline exceeded"}
2024-05-30T01:26:52.702+0800    WARN    forward_remote  upstream error  {"uqid": 5952, "qname": "path2.xtracloud.net.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:26:52.702+0800    WARN    forward_remote  upstream error  {"uqid": 5952, "qname": "path2.xtracloud.net.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:10.085+0800    WARN    forward_remote  upstream error  {"uqid": 5961, "qname": "tsfe.trafficshaping.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:10.404+0800    WARN    forward_remote  upstream error  {"uqid": 5962, "qname": "settings-win.data.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:13.567+0800    WARN    forward_remote  upstream error  {"uqid": 5966, "qname": "geo.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:13.581+0800    WARN    udp_server      entry err       {"query": {"uqid": 5967, "client": "::ffff:127.0.0.1", "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qtype": 1, "qclass": 1, "elapsed": "5.000662322s"}, "error": "context deadline exceeded"}
2024-05-30T01:27:13.581+0800    WARN    forward_remote  upstream error  {"uqid": 5967, "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:13.581+0800    WARN    forward_remote  upstream error  {"uqid": 5967, "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:13.609+0800    WARN    forward_remote  upstream error  {"uqid": 5968, "qname": "cp801.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:17.374+0800    WARN    forward_remote  upstream error  {"uqid": 5973, "qname": "cp601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:18.887+0800    WARN    forward_remote  upstream error  {"uqid": 5974, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:18.887+0800    WARN    forward_remote  upstream error  {"uqid": 5974, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:18.887+0800    WARN    udp_server      entry err       {"query": {"uqid": 5974, "client": "::ffff:127.0.0.1", "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qtype": 1, "qclass": 1, "elapsed": "5.000295575s"}, "error": "all upstream servers failed"}
2024-05-30T01:27:18.913+0800    WARN    forward_remote  upstream error  {"uqid": 5975, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:18.914+0800    WARN    forward_remote  upstream error  {"uqid": 5975, "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "dial tcp 1.1.1.1:53: i/o timeout"}
2024-05-30T01:27:18.914+0800    WARN    udp_server      entry err       {"query": {"uqid": 5975, "client": "::ffff:127.0.0.1", "qname": "disc601.prod.do.dsp.mp.microsoft.com.", "qtype": 1, "qclass": 1, "elapsed": "5.000895049s"}, "error": "all upstream servers failed"}
2024-05-30T01:27:20.880+0800    WARN    forward_remote  upstream error  {"uqid": 5977, "qname": "array614.prod.do.dsp.mp.microsoft.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}
2024-05-30T01:27:41.324+0800    WARN    forward_remote  upstream error  {"uqid": 6004, "qname": "github.com.", "qclass": 1, "qtype": 1, "upstream": "tcp://1.1.1.1", "error": "context deadline exceeded"}

#837

[facebook20146]

老哥们，这个配置咋放进去，哪位老哥给详细说说

[yeohreet]

完全使用了这个配置，为什么DNS渗漏检测还是不通过

[EarSum]

楼上提到过，这个配置不是为了防泄漏而是防污染的，运行逻辑是拿到域名先请求国内dns如果返回国内ip认为可信并接受，如果返回国外ip则认为不可信，接着将返回国外ip的域名发到境外可信上游进行解析。你要防泄漏，只能将goesite:cn的域名发送给国内dns，其余都要转发给境外解析。

[yyysuo]

时隔一年多，再看楼主的配置，有些建议，供参考。

1：用8888等国外dns做上游，如果mosdns运行的环境网关对8888没做代理，需要加socks5，要不然得到的结果是被劫持的。
2：local_sequence中，已经有accept逻辑，此时整个查询立即结束，main_sequence没必要再判断一次。
3：remote_sequence中，accept是无条件的，意味着查询立即结束，gfw-list永远不会被执行。
4：prefer_ipv4其实不太好用，会导致v6查询的时候多一次v4查询，并且会等待v4的结果，响应慢很多，不如把本地环境的v6搞好。

[phenixcxz]

老哥，能分享下你的配置吗

[yyysuo]

老哥，能分享下你的配置吗

#837

[yorks]

建议国内的上游换成 dot 或者doh

  - tag: forward_local
    type: forward
    args:
      concurrent: 3
      upstreams:
        - addr: tls://120.53.53.53:853
        - addr: tls://223.6.6.6:853
        - addr: https://223.5.5.5/dns-query

[timmylu1980]

你好 请问下配置文件能用 日志级别也是info 但是除了缓存保存有提示 再就没有任何日志信息 换别的配置文件都可以显示请求信息什么的 这是哪里出问题了呢

[Victor2333]

首先感谢大佬的付出，从v3就开始用，真的非常不错，感谢！

这个配置可以实现： 1.国内域名（已知和未知）用国内DNS解析，直连 2.国外域名（已经和未知）用国外DNS解析，走代理访问（ipset方式） 未知域名的处理方式：先用国内和国外DNS并行解析出ip，再用ip判断，如果是国内ip则直连，如果是国外ip则走代理

log:
  level: info

plugins:
  # 缓存
  - tag: cache
    type: cache
    args:
      size: 10240
      lazy_cache_ttl: 86400

  # 重定向域名
  - tag: redirect
    type: redirect
    args:
      rules:
        - www.cnbeta.com www.cnbeta.com.cdn.cloudflare.net

  # 转发至国内DNS, 并发查询
  - tag: forward_local
    type: forward
    args:
      concurrent: 2
      upstreams:
        - addr: udp://119.29.29.29
        - addr: udp://223.5.5.5

  # 转发至国外DNS, 并发查询
  - tag: forward_remote
    type: forward
    args:
      concurrent: 2
      upstreams:
        - addr: tcp://8.8.8.8
        - addr: tcp://1.1.1.1

  # 自定义hosts
  - tag: hosts
    type: hosts
    args:
      files:
        - "/etc/mosdns/hosts"

  # china ip和自己的vps ip、国内dns ip、内网ip，避免这些ip被加到ipset
  - tag: local_ip
    type: ip_set
    args:
      files:
        - /etc/mosdns/china_ip_list.txt
        - /etc/mosdns/myvpsip.txt

  # fallback的primary服务器, 返回国内ip则accept, 返回非国内ip则drop
  - tag: local_sequence
    type: sequence
    args:
      - exec: $forward_local
      - matches: resp_ip $local_ip
        exec: accept
      - exec: drop_resp

  # fallback的secondary服务器, 返回非国内ip则添加至ipset, 返回国内ip只接受不会添加ipset
  - tag: remote_sequence
    type: sequence
    args:
      - exec: $forward_remote
      - matches: "!resp_ip $local_ip"
        exec: ipset gfwlist,inet,32
      - exec: accept

  # fallback sequence
  - tag: fallback
    type: fallback
    args:
      primary: local_sequence
      secondary: remote_sequence
      threshold: 500
      always_standby: true

  # gfwlist解析出的ip添加至ipset，添加前先判断是否为国内ip或内网ip
  - tag: gfw-list
    type: sequence
    args:
      - exec: ttl 300-3600
      - matches: "!resp_ip $local_ip"
        exec: ipset gfwlist,inet,24
      - exec: accept

  # 主运行序列
  - tag: main_sequence
    type: sequence
    args:
      - exec: $hosts
      - matches: has_resp
        exec: accept
      
      - matches: qtype 65
        exec: reject 3

      - matches: qname &/etc/mosdns/reject-list.txt &/etc/mosdns/my-reject-list.txt
        exec: reject

      - exec: prefer_ipv4

      - exec: $redirect

      # 动态域名跳过缓存
      - matches: "!qname 00006801.com"
        exec: $cache
      - matches: has_resp
        exec: accept

      - matches: qname &/etc/mosdns/direct-list.txt
        exec: $forward_local
      - matches: has_resp
        exec: accept

      - matches: qname &/etc/mosdns/proxy-list.txt
        exec: $forward_remote
      - matches: has_resp
        exec: goto gfw-list

      - exec: $fallback


  # 启动监听服务
  - tag: udp_server
    type: udp_server
    args:
      entry: main_sequence
      listen: :53

  - tag: tcp_server
    type: tcp_server
    args:
      entry: main_sequence
      listen: :53

感谢，看完让人茅塞顿开 文档没有足够丰富的例子 这个例子感觉可以加到文档里