Xray leaks DNS requests with invalid domain names

[soft2046]

I have this following config:
{
"inbounds": [
{
"listen": "127.0.0.1",
"port": 8122,
"protocol": "socks",
"settings": {
"udp": true
}
}
],
"outbounds": [
{
"sendThrough": "10.202.0.2",
"protocol": "freedom",
"settings": {
"domainStrategy": "useIP"
}
}
],
"dns": {
"servers": [
{
"address": "10.202.0.1", # my VPN DNS
"queryStrategy": "UseIPv4"
}
]
},
"log": {
"loglevel": "debug",
"dnsLog": true
}
}

In the config, only my VPN DNS server 10.202.0.1 is specified in the dns servers settings. In my PC, the system DNS has been set to 192.168.1.1 and it recognizes this private hostname this_unknown_host.com but my VPN DNS does not recognize this_unknown_host.com. In the Xray debug log, Xray attempted to resolve this_unknown_host.com by 10.202.0.1 and correctly got an unknown hostname response. However, Xray proceeded to fetch the page at this_unknown_host.com and got its page anyway after looking up from my system DNS server 192.168.1.1. I expect that Xray should see the unknown hostname response from 10.202.0.1 and abort the request without querying 192.168.1.1.

[chika0801]

{
"inbounds": [
{
"listen": "127.0.0.1",
"port": 8122,
"protocol": "socks",
"settings": {
"udp": true
}
}
],
"outbounds": [
{
"sendThrough": "10.202.0.2",
"protocol": "freedom",
"settings": {
"domainStrategy": "useIP" -- Unified use of UseIPv4
}
}
],
"dns": {
"servers": [
{
"address": "10.202.0.1", # my VPN DNS
"queryStrategy": "UseIPv4"
}
]
},
"log": {
"loglevel": "debug",
"dnsLog": true
}
}

test it

[soft2046]

Same issue after this change:
"domainStrategy": "useIPv4"

[Fangliding]

try ForceIPv4 or ForceIPv4v6?
there is too many strange issues in these things...

[soft2046]

Thanks. Xray is no longer leaking after the ForceIPv4 change.

On a side note though, to my http request:
curl -x socks5h://127.0.0.1:8122 http://this_unknown_host.com
there appeared to be 4 lines of "failed to lookup ip for domain this_unknown_host.com at server" in the log so it seems there is some retry logic happening. The log ends in "io: read/write on closed pipe". I hope it all makes sense to you.

Here's my debug log:
2024/01/10 19:44:48 [Info] [1039730705] proxy/socks: TCP Connect request to tcp:this_unknown_host.com:80
2024/01/10 19:44:48 [Info] [1039730705] app/dispatcher: default route for tcp:this_unknown_host.com:80
2024/01/10 19:44:48 tcp:127.0.0.1:41827 accepted tcp:this_unknown_host.com:80
2024/01/10 19:44:48 [Debug] app/dns: domain this_unknown_host.com will use DNS in order: [UDP:10.202.0.1:53]
2024/01/10 19:44:48 [Debug] app/dns: UDP:10.202.0.1:53 querying DNS for: this_unknown_host.com.
2024/01/10 19:44:48 [Debug] transport/internet/udp: dispatch request to: udp:10.202.0.1:53
2024/01/10 19:44:48 [Info] transport/internet/udp: establishing new connection for udp:10.202.0.1:53
2024/01/10 19:44:48 [Info] app/dispatcher: default route for udp:10.202.0.1:53
2024/01/10 19:44:48 DNS accepted udp:10.202.0.1:53
2024/01/10 19:44:48 [Debug] transport/internet: dialing to udp:10.202.0.1:53
2024/01/10 19:44:48 [Info] proxy/freedom: connection opened to udp:10.202.0.1:53, local endpoint 10.202.0.2:57913, remote endpoint 10.202.0.1:53
2024/01/10 19:44:48 UDP:10.202.0.1:53 got answer: this_unknown_host.com -> [] 257.2384ms <rcode: 3>
2024/01/10 19:44:48 UDP:10.202.0.1:53 cache HIT: this_unknown_host.com -> [] <rcode: 3>
2024/01/10 19:44:48 [Info] app/dns: UDP:10.202.0.1:53 got answer: this_unknown_host.com. TypeA -> [] 257.7427ms
2024/01/10 19:44:48 [Debug] app/dns: UDP:10.202.0.1:53 updating IP records for domain:this_unknown_host.com.
2024/01/10 19:44:48 [Info] app/dns: failed to lookup ip for domain this_unknown_host.com at server UDP:10.202.0.1:53 > rcode: 3
2024/01/10 19:44:48 [Info] [1039730705] proxy/freedom: failed to get IP address for domain this_unknown_host.com > rcode: 3
2024/01/10 19:44:48 [Debug] app/dns: domain this_unknown_host.com will use DNS in order: [UDP:10.202.0.1:53]
2024/01/10 19:44:48 [Debug] app/dns: UDP:10.202.0.1:53 cache HIT this_unknown_host.com -> [] > rcode: 3
2024/01/10 19:44:48 [Info] app/dns: failed to lookup ip for domain this_unknown_host.com at server UDP:10.202.0.1:53 > rcode: 3
2024/01/10 19:44:48 [Info] [1039730705] proxy/freedom: failed to get IP address for domain this_unknown_host.com > rcode: 3
2024/01/10 19:44:48 [Debug] app/dns: domain this_unknown_host.com will use DNS in order: [UDP:10.202.0.1:53]
2024/01/10 19:44:48 [Debug] app/dns: UDP:10.202.0.1:53 cache HIT this_unknown_host.com -> [] > rcode: 3
2024/01/10 19:44:48 [Info] app/dns: failed to lookup ip for domain this_unknown_host.com at server UDP:10.202.0.1:53 > rcode: 3
2024/01/10 19:44:48 [Info] [1039730705] proxy/freedom: failed to get IP address for domain this_unknown_host.com > rcode: 3
2024/01/10 19:44:48 UDP:10.202.0.1:53 cache HIT: this_unknown_host.com -> [] <rcode: 3>
2024/01/10 19:44:48 UDP:10.202.0.1:53 cache HIT: this_unknown_host.com -> [] <rcode: 3>
2024/01/10 19:44:48 [Debug] app/dns: domain this_unknown_host.com will use DNS in order: [UDP:10.202.0.1:53]
2024/01/10 19:44:48 [Debug] app/dns: UDP:10.202.0.1:53 cache HIT this_unknown_host.com -> [] > rcode: 3
2024/01/10 19:44:48 [Info] app/dns: failed to lookup ip for domain this_unknown_host.com at server UDP:10.202.0.1:53 > rcode: 3
2024/01/10 19:44:48 [Info] [1039730705] proxy/freedom: failed to get IP address for domain this_unknown_host.com > rcode: 3
2024/01/10 19:44:49 UDP:10.202.0.1:53 cache HIT: this_unknown_host.com -> [] <rcode: 3>
2024/01/10 19:44:49 [Debug] app/dns: domain this_unknown_host.com will use DNS in order: [UDP:10.202.0.1:53]
2024/01/10 19:44:49 [Debug] app/dns: UDP:10.202.0.1:53 cache HIT this_unknown_host.com -> [] > rcode: 3
2024/01/10 19:44:49 [Info] app/dns: failed to lookup ip for domain this_unknown_host.com at server UDP:10.202.0.1:53 > rcode: 3
2024/01/10 19:44:49 [Info] [1039730705] proxy/freedom: failed to get IP address for domain this_unknown_host.com > rcode: 3
2024/01/10 19:44:49 [Info] [1039730705] app/proxyman/outbound: failed to process outbound traffic > proxy/freedom: failed to open connection to tcp:this_unknown_host.com:80 > common/retry: [empty response] > common/retry: all retry attempts failed
2024/01/10 19:44:49 [Info] [1039730705] app/proxyman/inbound: connection ends > proxy/socks: connection ends > proxy/socks: failed to transport all TCP response > io: read/write on closed pipe

[soft2046]

In firefox, if I go to http://fdadfsdasfassf.com directly, I get "Hmm. We’re having trouble finding that site." relatively quickly. If I do the same through Xray with the above config, firefox takes a bit time to timeout and I get back "The connection was reset". I am not sure if Xray can send back an accurate error in socks5 immediately on finding an unknown host.

[us254]

{
  "log": {
    "loglevel": "debug",
    "dnsLog": true
  },
  "dns": {
    "servers": [
      {
        "address": "10.202.0.1", // The VPN's DNS server
        "queryStrategy": "UseIPv4",
        "expectIPs": ["geoip:private"] // Expecting only private IPs to prevent leaks
      }
    ],
    "queryStrategy": "UseIPv4",
    "disableCache": true, // Disable caching to prevent leaks from cache
    "disableFallback": true // Prevents falling back to system DNS
  },
  "routing": {
    "rules": [
      {
        "type": "field",
        "inboundTag": ["socks_in"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": ["geosite:private"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "ip": ["geoip:private"],
        "outboundTag": "direct"
      },
      {
        "type": "field",
        "domain": ["geosite:geolocation-!cn"],
        "outboundTag": "vpn"
      },
      {
        "type": "field",
        "ip": ["geoip:cn"],
        "outboundTag": "vpn"
      },
      {
        "type": "field",
        "domainStrategy": "UseIPv4",
        "network": "tcp,udp",
        "outboundTag": "vpn"
      }
    ]
  },
  "inbounds": [
    {
      "tag": "socks_in",
      "listen": "127.0.0.1",
      "port": 8122,
      "protocol": "socks",
      "settings": {
        "udp": true
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls"]
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "UseIPv4" // Ensures only IPv4 is used
      }
    },
    {
      "tag": "vpn",
      "sendThrough": "10.202.0.2", // The VPN's local IP
      "protocol":freedom",
      "settings": {
        "domainStrategy": "UseIPv4" // Ensures only IPv4 is used
      },
      "streamSettings": {
        "sockopt": {
          "domainStrategy": "UseIPv4" // Ensures only IPv4 is used
        }
      }
    },
    {
      "tag": "dns_out",
      "protocol": "dns",
      "streamSettings": {
        "sockopt": {
          "domainStrategy": "UseIPv4" // Ensures only IPv4 is used
        }
      }
    }
  ]
}

[us254]

1. Sets the VPN's DNS server as the only DNS resolver.
2. Disables DNS caching and fallback to system DNS to prevent leaks.
3. Routes all traffic through the VPN by default, using the "vpn" outbound.
4. Ensures that DNS queries that cannot be resolved by the VPN's DNS server do not fall back to the system DNS, by setting disableFallback to true.
5. Configures routing rules to direct traffic based on the domain and IP, prioritizing private networks and handling geolocation tags.
6. Utilizes the domain strategy UseIPv4 consistently across the configuration to prevent any IPv6 leaks and ensure that DNS queries are made only via IPv4

[soft2046]

Except with the ForceIPv4 change (which caused other problem), I could not get Xray not to leak a non-existing hostname to my default dns server (at a higher priority than my vpn dns server) on my Windows PC, despite many internet searches related to xray/v2ray socks5, and the many and varied things I have tried. For now, I am happy with the configuration at the end of this message. I did try (and undo) many of the suggested changes in my config for they did not solve the problem. And this is the simplest configuration good enough for now. I just make sure my default dns server has DNS over TLS enabled.

Note(1): One peculiar thing is that if I removed <"domainStrategy": "UseIPv4"> below, I would expect ipv4 OR ipv6 and xray should still do DNS lookups from 10.202.0.1. But 10.202.0.1 was never used. With the line though, xray at least tries
10.202.0.1 first so no valid DNS lookups are leaked.

Note(2): From what I was seeing in the log, <"disableFallback": true> was not functional. In the log, there was obviously a DNS lookup error from the vpn dns server, but vray sends the http request to the outbound anyway.

Note(3): It seems the socks inbound (supporting socks5 dns proxying) should also expose a dns_out tag besides the socks_out tag so that it is easier to route this specific dns_out to selected dns outbounds. There could be different dns search routes in the same configuration.

That's it for now.

{
"inbounds": [
{
"protocol": "socks",
"listen": "127.0.0.1",
"port": 8122,
"settings": {
"udp": true
}
}
],
"outbounds": [
{
"sendThrough": "10.202.0.2",
"protocol": "freedom",
"settings": {
"domainStrategy": "UseIPv4"
}
}
],
"dns": {
"servers": [
{
"address": "10.202.0.1"
}
],
"disableFallback": true
},
"log": {
"loglevel": "debug",
"dnsLog": true
}
}

[soft2046]

Why I am serious about this issue? Let's say I often visit https://extraterrestrial-alien-friends.com through the socks5 server in the above config. Day in and day out, traffic including all dns queries in the web site goes through VPN. But one day, a link https://broken-link.extraterrestrial-alien-friends.com/images/unimportant.jpg may leak a DNS query to an internet upstream operator. If a GFW operator one day decides that whoever too close to aliens should be tracked and reprimanded, it's too bad if it's from the leak.

[Fangliding]

Personally, I don't think DNS leak is a serious issue, so I haven't taken the time to solve it

[Fangliding]

The configuration about this has been changed recently, so you cannot find useful information by searching

[soft2046]

No worries. I am looking forward to new releases to come.

[yuhan6665]

solved