在openwrt里的docker用第二种求解 #54

Sereinfy · 2023-10-16T05:57:36Z

Sereinfy
Oct 16, 2023

用openwrt 里的docker
第一种，5366：53映射，然后所有流量都走了代理，国内也走。
第二种 nslookup www.taobao.com 192.168.10.8 是成功返回信息的
然后dnsmasq--openclash---nameserver填192.168.10.8全部断网。
是回环了吗，还是说根本就没成功，小白求帮忙，谢谢大哥

Answered by kkkgo

Oct 16, 2023

正常是正常，但你被劫持的话，境内域名的DNS结果不是PaoPaoDNS提供的，是劫持的程序提供的。如果你单纯想要无污染的境外DNS结果提供给openclash用，你可以直接映射5304端口的。

View full answer

kkkgo · 2023-10-16T06:27:21Z

kkkgo
Oct 16, 2023
Maintainer

你说的第一种第二种是指什么？流量走代理又是指什么？DNS只负责解析。

0 replies

Sereinfy · 2023-10-16T06:36:34Z

Sereinfy
Oct 16, 2023
Author

1是映射端口方式-p 53:53/tcp -p 53:53/udp
我改成了5366：53,网络是通的，但是我用的是分流，结果全走了漏网之鱼策略，就是MATCH，可能还是没成功
正常应该发起dns请求再判断是不是走代理，结果是全都走了代理，本来应该直连的也走了代理
按道理来讲，dns没成功，网络应该是不通的。
2是macvlan网络。地址是192.168.10.8

0 replies

kkkgo · 2023-10-16T07:15:49Z

kkkgo
Oct 16, 2023
Maintainer

你所描述的走不走代理并非PaoPaoDNS控制，因此也无法解答你的问题，只能根据你的具体解析结果来判断DNS结果是否正确，PaoPaoDNS是否正常工作。
macvlan网络的话宿主默认和容器是不互通的，这方面你可以网上搜一下“macvlan模式容器与宿主机通信”。

1 reply

kkkgo Oct 16, 2023
Maintainer

至于容器是否工作正常可以在容器内执行debug.sh贴出调试日志(docker exec -it paopaodns sh进入容器内)，以及容器的启动日志(docker logs paopaodns )。

Sereinfy · 2023-10-16T07:39:23Z

Sereinfy
Oct 16, 2023
Author

=====PaoPaoDNS` docker debug=====
[info] images build time : 2023-10-05 16:10:05 UTC
[info] ========== env info ==========
====ENV TEST====
MEM:50m 100m 200 100mb
prefPC:9
CORES:-1-
POWCORES:-1-
ulimit :-1048576-
FDLIM :-1-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-no-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-no-
PLATFORM:-Linux 20fbabadaaf2 6.1.57 #0 SMP Sun Oct 15 06:38:41 2023 armv7l Linux                                                                                                                                                             -
====ENV TEST====
[info] ========== process info ==========
PID   USER     TIME  COMMAND
    1 root      0:00 {init.sh} /bin/sh /usr/sbin/init.sh
   20 root      0:00 crond
   99 root      0:19 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.t
  124 root      0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
  128 root      0:00 unbound -c /tmp/unbound_forward.conf -p
  136 root      0:01 redis-server unixsocket:/tmp/redis.sock
  140 root      0:02 unbound -c /tmp/unbound_raw.conf -p
  266 root      0:02 mosdns start -d /tmp -c mosdns.yaml
  377 root      0:00 inotifywait -e modify,delete /etc/unbound/named.cache /dat
  387 root      0:00 sh
  393 root      0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
  398 root      0:00 ps -ef
[info] ========== cn list info ==========
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
[info] ========== reids info ==========
used_memory_human:778.53K
used_memory_rss_human:5.23M
used_memory_peak_human:799.07K
total_system_memory_human:1001.05M
used_memory_lua_human:22.00K
used_memory_vm_total_human:45.00K
used_memory_scripts_human:105B
maxmemory_human:100.00M
(integer) 133
[test] IP test, you will see that all the following IPs are your public network                                                                                                                                                              exit IP !
[test] ========== IP TEST START ==========
CN IP URL:
112.32.224.191
------------------
Non-CN IP URL:
37.123.193.156
37.123.193.156
37.123.193.156
37.123.193.156
37.123.193.156
------------------
IP INFO:
37.123.193.156
US,San Jose,California
ASN41378/KIRINO
HTTP/1.1
curl/8.4.0
America/Los_Angeles Time: 10/16/2023, 12:28:58 AM
------------------
----mosdns whoami aka dig:
"ns" "2607:f8b0:4004:100b::105"
"ecs" "172.71.154.0/24/24"
"ip" "172.71.154.54"
------------------
----local-unbound whoami aka dig:
------------------
----mosdns whoami 03k dig:
------------------
----local-unbound whoami 03k dig:
[test] ========== IP TEST END ==========

[test] The DNS hijacking test, you will see timed out message !
[test] ========== DNS HIJACK START ==========
Server:         9.8.7.6
Address:        9.8.7.6#53

www.qq.com      canonical name = news.qq.com.edgekey.net.
news.qq.com.edgekey.net canonical name = e6156.dscf.akamaiedge.net.
Name:   e6156.dscf.akamaiedge.net
Address: 23.214.100.106

[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
8.38.121.234
8.38.121.233
------------------
----local-unbound CN dig:
[test] ========== CN DOMAIN TEST END ==========
[test] Non-CN domain test, you will see that the DNS resolution result is correc                                                                                                                                                             t IP !
[test] ========== Non-CN DOMAIN TEST START ==========
----mosdns Non-CN dig:
youtube-ui.l.google.com.
142.251.214.142
142.250.188.14
------------------
----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
142.250.189.238
142.250.189.174
------------------
----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
142.251.214.142
142.250.188.14
------------------
----dnscrypt-socks5 Non-CN dig:
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
[test] ========== Non-CN DOMAIN TEST END ==========
[test] IPv6 Dual CN test: you will see that IPv6 is OK !
[test] ========== IPV6 CN DOMAIN TEST START ==========
[test] ========== IPV6 CN DOMAIN TEST END ==========
[test] IPv6 Dual Non-CN test: you will see that IPv6 is empty !
[test] ========== IPV6 Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 Non-CN DOMAIN TEST END ==========
[test] IPv6 only Non-CN test: you will see that IPv6 is ok !
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST END ==========

又试了下请问是不是正常工作了？分流正常了。网络也通了。
软路由本身肯定有DNS服务会占用53端口，你可以用macvlan的网络模式我想用的是这种一个独立的ip 而不是加上端口。parent=eth0 这里我是旁路由配置不成功，改成parent=br-lan 成功运行网络不通。再学习吧不理解这里。感谢作者。

1 reply

kkkgo Oct 16, 2023
Maintainer

如果是旁路由建议用主路由静态路由+FAKEIP的方案来分流，使用PaoPaoDNS的AUTO_FORWARD和CUSTOM_FORWARD转发到你的openclash，这样更高效整洁。可以参考PaoPaoGateway的介绍。

kkkgo · 2023-10-16T07:51:11Z

kkkgo
Oct 16, 2023
Maintainer

[test] The DNS hijacking test, you will see timed out message !
[test] ========== DNS HIJACK START ==========
Server:         9.8.7.6
Address:        9.8.7.6#53

www.qq.com      canonical name = news.qq.com.edgekey.net.
news.qq.com.edgekey.net canonical name = e6156.dscf.akamaiedge.net.
Name:   e6156.dscf.akamaiedge.net
Address: 23.214.100.106

这个测试说明你的DNS被劫持了，你需要排查你的iptables规则。

1 reply

kkkgo Oct 16, 2023
Maintainer

#2 (comment)

Sereinfy · 2023-10-16T08:00:59Z

Sereinfy
Oct 16, 2023
Author

root@ImmortalWrt:~# iptables -t nat -S|grep " 53"
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 53 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p udp -m udp --dport 53 -j MASQUERADE
-A DOCKER ! -i docker0 -p tcp -m tcp --dport 5366 -j DNAT --to-destination 172.17.0.2:53
-A DOCKER ! -i docker0 -p udp -m udp --dport 5366 -j DNAT --to-destination 172.17.0.2:53

现在是
dnsmasq 53--openclash 7874(劫持dnsmasq)---nameserver 127.0.0.1:5366
网络是正常的

1 reply

kkkgo Oct 16, 2023
Maintainer

正常是正常，但你被劫持的话，境内域名的DNS结果不是PaoPaoDNS提供的，是劫持的程序提供的。如果你单纯想要无污染的境外DNS结果提供给openclash用，你可以直接映射5304端口的。

Answer selected by Sereinfy

Sereinfy · 2023-10-16T13:46:58Z

Sereinfy
Oct 16, 2023
Author

我又在我的windows 上虚拟机里，装了一个，大哥帮我看看能不能这样正常没。
112.32.224.191 是我宽带ip

=====PaoPaoDNS docker debug=====
[info] images build time : 2023-10-05 16:09:23 UTC
[info] ========== env info ==========
====ENV TEST====
MEM:50m 100m 200 100mb
prefPC:9
CORES:-1-
POWCORES:-1-
ulimit :-1048576-
FDLIM :-1-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-no-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-no-
PLATFORM:-Linux a1e2a7d05e29 5.15.108-0-virt #1-Alpine SMP Fri, 21 Apr 2023 05:5                                                                                                                                                             5:14 +0000 x86_64 Linux-
====ENV TEST====
[info] ========== process info ==========
PID   USER     TIME  COMMAND
    1 root      0:00 {init.sh} /bin/sh /usr/sbin/init.sh
   22 root      0:00 crond
  111 root      0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.t
  117 root      0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
  138 root      0:01 redis-server unixsocket:/tmp/redis.sock
  146 root      0:00 unbound -c /tmp/unbound_forward.conf -p
  147 root      0:00 unbound -c /tmp/unbound_raw.conf -p
  173 root      0:00 sh
  476 root      0:00 mosdns start -d /tmp -c mosdns.yaml
  511 root      0:00 inotifywait -e modify,delete /etc/unbound/named.cache /dat
  514 root      0:00 sh
  519 root      0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
  524 root      0:00 ps -ef
[info] ========== cn list info ==========
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
[info] ========== reids info ==========
used_memory_human:983.02K
used_memory_rss_human:6.88M
used_memory_peak_human:1011.90K
total_system_memory_human:983.96M
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:100.00M
(integer) 111
[test] IP test, you will see that all the following IPs are your public network                                                                                                                                                              exit IP !
[test] ========== IP TEST START ==========
CN IP URL:
112.32.224.191
112.32.224.191
------------------
Non-CN IP URL:
112.32.224.191
112.32.224.191
112.32.224.191
112.32.224.191
112.32.224.191
------------------
IP INFO:
112.32.224.191
CN,Fuyang,Anhui
ASN9808/China Mobile
HTTP/1.1
curl/8.4.0
Asia/Shanghai Time: 10/16/2023, 9:45:40 PM
------------------
----mosdns whoami aka dig:
"ns" "112.32.224.191"
------------------
----local-unbound whoami aka dig:
"ns" "112.32.224.191"
------------------
----mosdns whoami 03k dig:
112.32.224.191
------------------
----local-unbound whoami 03k dig:
112.32.224.191
[test] ========== IP TEST END ==========

[test] The DNS hijacking test, you will see timed out message !
[test] ========== DNS HIJACK START ==========
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; no servers could be reached


[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
223.111.230.174
223.111.230.173
------------------
----local-unbound CN dig:
www.taobao.com.danuoyi.tbcache.com.
223.111.230.174
223.111.230.173
[test] ========== CN DOMAIN TEST END ==========
[test] Non-CN domain test, you will see that the DNS resolution result is correc                                                                                                                                                             t IP !
[test] ========== Non-CN DOMAIN TEST START ==========
----mosdns Non-CN dig:
youtube-ui.l.google.com.
216.58.209.174
216.58.210.142
------------------
----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
172.217.160.110
172.217.163.46
------------------
----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
172.217.161.78
142.250.207.46
------------------
----dnscrypt-socks5 Non-CN dig:
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
[test] ========== Non-CN DOMAIN TEST END ==========
[test] IPv6 Dual CN test: you will see that IPv6 is OK !
[test] ========== IPV6 CN DOMAIN TEST START ==========
[test] ========== IPV6 CN DOMAIN TEST END ==========
[test] IPv6 Dual Non-CN test: you will see that IPv6 is empty !
[test] ========== IPV6 Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 Non-CN DOMAIN TEST END ==========
[test] IPv6 only Non-CN test: you will see that IPv6 is ok !
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST END ==========

1 reply

kkkgo Oct 16, 2023
Maintainer

看上去没什么问题。

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

在openwrt里的docker用第二种求解 #54

{{title}}

Replies: 7 comments 5 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

在openwrt里的docker用 第二种求解 #54

Sereinfy Oct 16, 2023

Replies: 7 comments · 5 replies

kkkgo Oct 16, 2023 Maintainer

Sereinfy Oct 16, 2023 Author

kkkgo Oct 16, 2023 Maintainer

kkkgo Oct 16, 2023 Maintainer

Sereinfy Oct 16, 2023 Author

kkkgo Oct 16, 2023 Maintainer

kkkgo Oct 16, 2023 Maintainer

kkkgo Oct 16, 2023 Maintainer

Sereinfy Oct 16, 2023 Author

kkkgo Oct 16, 2023 Maintainer

Sereinfy Oct 16, 2023 Author

kkkgo Oct 16, 2023 Maintainer

在openwrt里的docker用第二种求解 #54

Sereinfy
Oct 16, 2023

Replies: 7 comments 5 replies

kkkgo
Oct 16, 2023
Maintainer

Sereinfy
Oct 16, 2023
Author

kkkgo
Oct 16, 2023
Maintainer

kkkgo Oct 16, 2023
Maintainer

Sereinfy
Oct 16, 2023
Author

kkkgo Oct 16, 2023
Maintainer

kkkgo
Oct 16, 2023
Maintainer

kkkgo Oct 16, 2023
Maintainer

Sereinfy
Oct 16, 2023
Author

kkkgo Oct 16, 2023
Maintainer

Sereinfy
Oct 16, 2023
Author

kkkgo Oct 16, 2023
Maintainer