yeyin/tvbox_collect
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
10aad731eb66db50739daf99cfa364cf1c50c460
tvbox_collect/_posts/2024-08-22-dnsnoleaks-singboxr-ruleset.md
T
github-actions[bot] f53091d694 Sync all projects
2026-07-27 14:39:52 +00:00

9.5 KiB
Raw Blame History

title, description, date, categories, tags
title description date categories tags
搭载 sing-boxr 内核配置 DNS 不泄露教程-ruleset 方案 此教程搭载 sing-boxr 内核并使用其特性防止 DNS 泄露，即针对未知域名走国外 DNS 解析 2024-08-22 16:51:20 +0800
DNS 配置
DNS 防泄漏
sing-box
sing-boxr
ShellCrash
ruleset
rule_set
进阶
DNS
DNS 泄露

说明 {: .prompt-tip }

  1. 此方案彻底防止了 DNS 泄露（未知域名在匹配 rule_set:cnip 规则时会先由国外 DNS 解析且配置 client_subnet，解析出 IP 在国内则直接返回解析结果且走 国内 IP 规则，否则走 漏网之鱼 规则），兼容性高，可放心使用
  2. 本教程以 ShellCrash 为例，其它客户端亦可参考
  3. 本教程搭载 sing-box 内核 reF1nd-Testing 版（导入内核方法可参考《ShellCrash 和 AdGuard Home 快速安装教程/导入 mihomo 内核 或 sing-box 内核》）
  4. 可进入 https://ipleak.net 测试 DNS 是否泄露，“DNS Addresses” 栏目下没有中国国旗（因 ipleak.net 属未知域名，默认走 漏网之鱼 规则），即代表 DNS 没有发生泄露

一、 导入规则集合文件

route.rule_set 须添加 fakeip-filter、proxy、cn 和 cnip，如下：

{
  "route": {
    "rule_set": [
      {
        "tag": [ "fakeip-filter", "proxy", "cn", "cnip" ],
        "type": "remote",
        "format": "binary",
        "path": "./ruleset/{tag}.srs",
        "url": "https://github.com/DustinWin/ruleset_geodata/releases/download/sing-box-ruleset/{tag}.srs"
      }
    ]
  }
}

二、 ShellCrash 防泄漏配置

进入 ShellCrash 配置脚本 → 2) 功能设置 → 2) DNS 设置 → 9) 修改 DNS 服务器，将“DIRECT-DNS”、“PROXY-DNS”和“DEFAULT-DNS”都设置为 null
ShellCrash 设置

三、 DNS 防泄漏配置

1. DNS 模式为 mix（推荐）

  • ① 连接 SSH 后执行命令 vi $CRASHDIR/jsons/dns.json，按一下 Ins 键（Insert 键），修改为如下内容：

    推荐将 client_subnet 设置为当前宽带运营商分配的默认 DNS（可进入光猫或路由器拨号页面查看，或者前往公共 DNS 大全查询）的 IP 段，如默认 DNS 为 211.137.58.20，可设置为 211.137.58.0/24 {: .prompt-info }

    {
  "dns": {
    "servers": [
      {
        "tag": "hosts",
        "type": "hosts",
        "predefined": {
          "dns.alidns.com": [ "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1" ],
          "doh.pub": [ "1.12.12.12", "120.53.53.53" ],
          "dns.google": [ "8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844" ],
          "dns11.quad9.net": [ "9.9.9.11", "149.112.112.11", "2620:fe::11", "2620:fe::fe:11" ]
        }
      },
      { "tag": "dns_resolver", "type": "local" },
      { "tag": "dns_alidns", "type": "quic", "server": "dns.alidns.com", "domain_resolver": "hosts" },
      { "tag": "dns_dnspod", "type": "https", "server": "doh.pub", "domain_resolver": "hosts" },
      { "tag": "dns_google", "type": "https", "server": "dns.google", "domain_resolver": "hosts", "detour": "GLOBAL" },
      { "tag": "dns_quad9", "type": "quic", "server": "dns11.quad9.net", "domain_resolver": "hosts", "detour": "GLOBAL" },
      { "tag": "dns_direct", "type": "group", "servers": [ "dns_alidns", "dns_dnspod" ] },
      { "tag": "dns_proxy", "type": "group", "servers": [ "dns_google", "dns_quad9" ] },
      { "tag": "dns_fakeip", "type": "fakeip", "inet4_range": "198.18.0.0/15", "inet6_range": "fc00::/16" }
    ],
    "rules": [
      { "clash_mode": [ "Direct" ], "server": "dns_direct" },
      { "clash_mode": [ "Global" ], "server": "dns_proxy" },
      { "rule_set": [ "fakeip-filter" ], "server": "dns_direct" },
      { "rule_set": [ "proxy" ], "query_type": [ "A", "AAAA" ], "server": "dns_fakeip" },
      { "rule_set": [ "cn" ], "server": "dns_direct" },
      // 推荐将 `client_subnet` 设置为当前宽带运营商分配的默认 DNS 的 IP 段
      { "action": "evaluate", "server": "dns_proxy", "client_subnet": "211.137.58.0/24" },
      { "match_response": true, "rule_set": [ "cnip" ], "action": "respond" }
    ],
    "final": "dns_proxy",
    "strategy": "prefer_ipv4",
    "optimistic": true,
    "reverse_mapping": true
  }
}

  • ② 按一下 Esc 键（退出键），输入英文冒号 :，继续输入 wq 并回车

2. DNS 模式为 fakeip（不推荐）

  • ① 连接 SSH 后执行命令 vi $CRASHDIR/jsons/dns.json，按一下 Ins 键（Insert 键），修改为如下内容：

    推荐将 client_subnet 设置为当前宽带运营商分配的默认 DNS（可进入光猫或路由器拨号页面查看，或者前往公共 DNS 大全查询）的 IP 段，如默认 DNS 为 211.137.58.20，可设置为 211.137.58.0/24 {: .prompt-info }

    {
  "dns": {
    "servers": [
      {
        "tag": "hosts",
        "type": "hosts",
        "predefined": {
          "dns.alidns.com": [ "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1" ],
          "doh.pub": [ "1.12.12.12", "120.53.53.53" ],
          "dns.google": [ "8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844" ],
          "dns11.quad9.net": [ "9.9.9.11", "149.112.112.11", "2620:fe::11", "2620:fe::fe:11" ]
        }
      },
      { "tag": "dns_resolver", "type": "local" },
      { "tag": "dns_alidns", "type": "quic", "server": "dns.alidns.com", "domain_resolver": "hosts" },
      { "tag": "dns_dnspod", "type": "https", "server": "doh.pub", "domain_resolver": "hosts" },
      { "tag": "dns_google", "type": "https", "server": "dns.google", "domain_resolver": "hosts", "detour": "GLOBAL" },
      { "tag": "dns_quad9", "type": "quic", "server": "dns11.quad9.net", "domain_resolver": "hosts", "detour": "GLOBAL" },
      { "tag": "dns_direct", "type": "group", "servers": [ "dns_alidns", "dns_dnspod" ] },
      { "tag": "dns_proxy", "type": "group", "servers": [ "dns_google", "dns_quad9" ] },
      { "tag": "dns_fakeip", "type": "fakeip", "inet4_range": "198.18.0.0/15", "inet6_range": "fc00::/16" }
    ],
    "rules": [
      { "clash_mode": [ "Direct" ], "server": "dns_direct" },
      { "clash_mode": [ "Global" ], "server": "dns_proxy" },
      { "rule_set": [ "fakeip-filter" ], "server": "dns_direct" },
      { "query_type": [ "A", "AAAA" ], "server": "dns_fakeip" }
    ],
    "final": "dns_proxy",
    "strategy": "prefer_ipv4",
    "optimistic": true,
    "reverse_mapping": true
    // 推荐将 `client_subnet` 设置为当前宽带运营商分配的默认 DNS 的 IP 段
    "client_subnet": "211.137.58.0/24"
  }
}

  • ② 按一下 Esc 键（退出键），输入英文冒号 :，继续输入 wq 并回车

3. DNS 模式为 redirhost

  • ① 连接 SSH 后执行命令 vi $CRASHDIR/jsons/dns.json，按一下 Ins 键（Insert 键），修改为如下内容：

    推荐将 client_subnet 设置为当前宽带运营商分配的默认 DNS（可进入光猫或路由器拨号页面查看，或者前往公共 DNS 大全查询）的 IP 段，如默认 DNS 为 211.137.58.20，可设置为 211.137.58.0/24 {: .prompt-info }

    {
  "dns": {
    "servers": [
      {
        "tag": "hosts",
        "type": "hosts",
        "predefined": {
          "dns.alidns.com": [ "223.5.5.5", "223.6.6.6", "2400:3200::1", "2400:3200:baba::1" ],
          "doh.pub": [ "1.12.12.12", "120.53.53.53" ],
          "dns.google": [ "8.8.8.8", "8.8.4.4", "2001:4860:4860::8888", "2001:4860:4860::8844" ],
          "dns11.quad9.net": [ "9.9.9.11", "149.112.112.11", "2620:fe::11", "2620:fe::fe:11" ]
        }
      },
      { "tag": "dns_resolver", "type": "local" },
      { "tag": "dns_alidns", "type": "quic", "server": "dns.alidns.com", "domain_resolver": "hosts" },
      { "tag": "dns_dnspod", "type": "https", "server": "doh.pub", "domain_resolver": "hosts" },
      { "tag": "dns_google", "type": "https", "server": "dns.google", "domain_resolver": "hosts", "detour": "GLOBAL" },
      { "tag": "dns_quad9", "type": "quic", "server": "dns11.quad9.net", "domain_resolver": "hosts", "detour": "GLOBAL" },
      { "tag": "dns_direct", "type": "group", "servers": [ "dns_alidns", "dns_dnspod" ] },
      { "tag": "dns_proxy", "type": "group", "servers": [ "dns_google", "dns_quad9" ] }
    ],
    "rules": [
      { "clash_mode": [ "Direct" ], "server": "dns_direct" },
      { "clash_mode": [ "Global" ], "server": "dns_proxy" },
      { "rule_set": [ "proxy" ], "server": "dns_proxy" },
      { "rule_set": [ "cn" ], "server": "dns_direct" },
      // 推荐将 `client_subnet` 设置为当前宽带运营商分配的默认 DNS 的 IP 段
      { "action": "evaluate", "server": "dns_proxy", "client_subnet": "211.137.58.0/24" },
      { "match_response": true, "rule_set": [ "cnip" ], "action": "respond" }
    ],
    "final": "dns_proxy",
    "strategy": "prefer_ipv4",
    "optimistic": true,
    "reverse_mapping": true
  }
}

  • ② 按一下 Esc 键（退出键），输入英文冒号 :，继续输入 wq 并回车

Reference in New Issue View Git Blame Copy Permalink