Regarding nonIPQuery

[PoneyClairDeLune]

Xray added nonIPQuery in the latest 1.8.3 release, but the changes didn't reflect in the docs. How should I disable this behaviour?

[RPRX]

#2131 (comment) xiaorouji/openwrt-passwall2#209 (comment) @yuhan6665

PS：我个人认为默认 "drop" 最好，不建议改成 "skip"，除非你遇到了问题

[PoneyClairDeLune]

Xray transparently redirects DNS requests to CoreDNS, where it gets some further processing in the current configuration. drop interferes with the configuration however, so I tend to use the option which restores the behaviour from previous versions.

[RPRX]

不会影响，你交给外部程序处理是 Freedom 出站而不是 DNS 出站，v1.8.3 改的是 DNS 出站的行为

[chika0801]

{
    "log": {
        "loglevel": "info"
    },
    "dns": {
        "servers": [
            "1.1.1.1"
        ]
    },
    "routing": {
        "rules": [
            {
                "type": "field",
                "inboundTag": [
                    "dns-in"
                ],
                "outboundTag": "dns-out"
            }
        ]
    },
    "inbounds": [
        {
            "listen": "0.0.0.0",
            "port": 80,
            "protocol": "shadowsocks",
            "settings": {
                "method": "2022-blake3-aes-128-gcm",
                "password": "password",
                "network": "tcp,udp"
            }
        },
        {
            "listen": "127.0.0.1",
            "port": 53,
            "protocol": "dokodemo-door",
            "settings": {
                "address": "1.1.1.1",
                "port": 53,
                "network": "udp"
            },
            "tag": "dns-in"
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom"
        },
        {
            "protocol": "dns",
            "settings": {
                "nonIPQuery": "drop"
            },
            "tag": "dns-out"
        }
    ]
}

I'm on the server side, using the configuration shown below, you'll want to set the DNS address on the VPS to 127.0.0.1 (i.e. locally). Then the domain request from freedom, using the system DNS for domain name resolution, the DNS used for the domain name is 127.0.0.1 UDP protocol, port 53, and after these conditions are met, it is blocked by Xray's inbound Freedom Gateway protocol put. Through the routing rules, the outbound DNS module. Then due to Xray's 1.8.3 version of the newly added "nonIPQuery" parameter non-A AAAA query is filtered out after. Use 1.1.1.1 in the DNS module for DNS queries. This is my understanding and usage.

[chika0801]

Note that the DNS used is the one in the DNS module, not what is filled in at the location below.

            "settings": {
                "address": "1.1.1.1",
                "port": 53,
                "network": "udp"
            },

As to why this is the principle, there is no single article that comprehensively summarizes it. You refer to it in the link below

https://tachyondevel.medium.com/%E6%BC%AB%E8%B0%88%E5%90%84%E7%A7%8D%E9%BB%91%E7%A7%91%E6%8A%80%E5%BC%8F-dns-%E6%8A%80%E6%9C%AF%E5%9C%A8%E4%BB%A3%E7%90%86%E7%8E%AF%E5%A2%83%E4%B8%AD%E7%9A%84%E5%BA%94%E7%94%A8-62c50e58cbd0

V2Ray DNS Outbound This paragraph starts, although this post is very early, it talks about the principles of the original V2ray configuration, which are mostly applicable even now.

[PoneyClairDeLune]

Another question: Is there a way to let a specific outbound handle non-IP DNS queries? Like when I'm sending A/AAAA queries, the Xray server can just use its internal DNS module as usual, but if other queries like TXT or even other protocols reaches the server, the DNS outbound can specify exactly which outbound or target to fall back to.

[chika0801]

I also use sing-box to provide TUN as a client and I also like to use FakeIP. i don't understand what is wrong with FakeIP for the sing-box you have. I currently use it myself and it works fine. Here's a sample configuration I use.

https://github.com/chika0801/sing-box-examples/blob/main/Tun/config_client_windows_fakeip.json

[PoneyClairDeLune]

I also use sing-box to provide TUN as a client and I also like to use FakeIP. i don't understand what is wrong with FakeIP for the sing-box you have. I currently use it myself and it works fine. Here's a sample configuration I use.

https://github.com/chika0801/sing-box-examples/blob/main/Tun/config_client_windows_fakeip.json

I don't need to apply FakeDNS/FakeIP to every domain, just need it to provide seamless support for Onion Services and Eepsites if the clients utilize TUN/TAP for connection (e.g. Android, iOS). Besides, applying FakeDNS/FakeIP to all domains messes up the internal DNS infra. Sing Box cannot do that, only Xray (and V2Ray) can.

[chika0801]

I can't help you in the situation you describe, as I don't understand them.

[PoneyClairDeLune]

I can't help you in the situation you describe, as I don't understand them.

Here's what I expect Xray (and V2Ray) to do.

"dns": {
	"servers": [
		"127.0.2.1",
		{
			"address": "fakedns",
			"domains": [
				"domain:onion",
				"domain:i2p"
			]
		}
	]
}

Which cannot be achieved in Sing Box.

I do not wish any other domain to go through FakeDNS, only domain:onion and domain:i2p so that clients connecting via TUN can directly access Onion Services (Tor) and Eepsites (I2P).

The Tor outbound in Sing Box does not help either - Tor isn't the only mixnet.

[chika0801]

I'm going by what you've expressed, it's a sing-boxr configuration, the DNS part, the 1st (default) one is 127.0.0.1 which you set, the 2nd one is Fakeip. then the DNS part of the routing rules, you can set which domains use the 2nd (2nd group of DNS) fakeip for this. See if that means what you want?

Domains with no hit rules use the 1st (Group 1) DNS, which is 127.0.0.1

    "dns": {
        "servers": [
            {
                "tag": "dns_proxy",
                "address": "127.0.0.1",
                "address_resolver": "dns_direct",
                "strategy": "ipv4_only",
                "detour": "direct"
            },
            {
                "tag": "dns_fakeip",
                "address": "fakeip",
                "strategy": "ipv4_only"
            }
        ],
        "rules": [
            {
                "domain_keyword": [
                    "onion",
                    "i2p"
                ],
                "server": "dns_fakeip"
            }
        ],
        "independent_cache": true,
        "fakeip": {
            "enabled": true,
            "inet4_range": "198.18.0.0/15",
            "inet6_range": "fc00::/18"
        }
    },