最新版本的paopaodns会导致raw.githubusercontent.com解析为0.0.0.0 #83

exp4sky · 2023-12-11T12:27:40Z

exp4sky
Dec 11, 2023

最新版本的paopaodns会导致raw.githubusercontent.com解析为0.0.0.0
用泡泡dns会解析出0.0.0.0
root@Debian12:# q raw.githubusercontent.com @192.168.100.1
raw.githubusercontent.com. 48m46s A 0.0.0.0
raw.githubusercontent.com. 58m22s AAAA ::
root@Debian12:#
更换adgdns正常
root@Debian12:# q raw.githubusercontent.com @192.168.100.246
raw.githubusercontent.com. 1m9s A 185.199.109.133
raw.githubusercontent.com. 1m9s A 185.199.111.133
raw.githubusercontent.com. 1m9s A 185.199.108.133
raw.githubusercontent.com. 1m9s A 185.199.110.133
root@Debian12:#

docker exec paopaodns debug.sh
ping: bad address 'whoami.03k.org'

== debug.sh : docker exec -it paopaodns sh ==

-> debug start 1702297508

[INFO] images build time : 2023-12-11 06:19:55 UTC
[OK]DATA_writeable
[OK]DATA_readable
[INFO] NETWORK
*********************************************************************************

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
8: eth0@if9: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
default via 172.17.0.1 dev eth0 
172.17.0.0/16 dev eth0 scope link  src 172.17.0.2 
PING 223.5.5.5 (223.5.5.5): 56 data bytes
64 bytes from 223.5.5.5: seq=0 ttl=114 time=41.501 ms

--- 223.5.5.5 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 41.501/41.501/41.501 ms
PING 119.29.29.29 (119.29.29.29): 56 data bytes
64 bytes from 119.29.29.29: seq=0 ttl=49 time=68.773 ms

--- 119.29.29.29 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 68.773/68.773/68.773 ms
Server:         223.5.5.5
Address:        223.5.5.5#53

Non-authoritative answer:
www.taobao.com  canonical name = www.taobao.com.danuoyi.tbcache.com.
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 110.157.250.109
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 110.157.250.110
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 240e:935:a00:20b:3::3a7
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 240e:935:a00:20b:3::3a8

Server:         119.29.29.29
Address:        119.29.29.29#53

Non-authoritative answer:
www.qq.com      canonical name = ins-r23tsuuf.ias.tencent-cloud.net.
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 101.91.22.57
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 101.91.42.232
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 240e:e1:a800:120::36
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 240e:e1:a800:120::76

*********************************************************************************

[INFO] ENV
*********************************************************************************

====ENV TEST====
[OK]DATA_writeable-
[OK]DATA_readable-
MEM:1500m 3000m 10000000 4500mb
prefPC:100
CORES:-12-
POWCORES:-8-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-yes-
CNFALL:-yes-
CUSTOM_FORWARD:-192.168.100.248:53-
AUTO_FORWARD:-yes-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-604800-
CUSTOM_FORWARD_TTL:-0-
SHUFFLE:-yes-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux 14b34e23e9ec 6.2.16-5-pve #1 SMP PREEMPT_DYNAMIC PVE 6.2.16-6 (2023-07-25T15:33Z) x86_64 Linux-
====ENV TEST====
mosdns kkkgo/mosdns:231210.1
*********************************************************************************

[INFO] PS
*********************************************************************************

PID   USER     TIME  COMMAND
    1 root      0:00 {init.sh} /bin/sh /usr/sbin/init.sh
   23 root      0:00 crond
   55 root      0:00 redis-server unixsocket:/tmp/redis.sock
  249 root      0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
  274 root      0:00 mosdns start -d /tmp -c /tmp/mosdns.yaml
  278 root      0:00 unbound -c /tmp/unbound_forward.conf -p
  286 root      0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
  287 root      0:00 {data_update.sh} /bin/sh /usr/sbin/data_update.sh
  291 root      0:00 tail -f /dev/null
  292 root      0:00 sleep 179
  294 root      0:02 unbound -c /tmp/unbound_raw.conf -p
  322 root      0:00 inotifywait -e modify,delete /etc/unbound/named.cache /data/Country-only-cn-private.mmdb /data/force_cn_list.txt /data/force_nocn_list.txt /data/custom_env.ini /data/global_mark.dat /data/trackerslist.txt /data/force_forward_list.txt /data/force_ttl_rules.txt
  422 root      0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
  442 root      0:00 ps -ef
*********************************************************************************

[INFO] TOP
*********************************************************************************

CPU:   5% usr   0% sys   0% nic  86% idle   7% io   0% irq   0% sirq
  PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
  294     1 root     S    7277m  18%   7   0% unbound -c /tmp/unbound_raw.conf -
  274     1 root     S    1211m   3%   7   0% mosdns start -d /tmp -c /tmp/mosdn
  249     1 root     S    1211m   3%   2   0% dnscrypt-proxy -config /data/dnscr
   55     1 root     S    22824   0%  10   0% redis-server unixsocket:/tmp/redis
  278     1 root     S    20252   0%  10   0% unbound -c /tmp/unbound_forward.co
  286     1 root     S     1708   0%   2   0% {watch_list.sh} /bin/sh /usr/sbin/
  287     1 root     S     1636   0%  11   0% {data_update.sh} /bin/sh /usr/sbin
    1     0 root     S     1632   0%  10   0% {init.sh} /bin/sh /usr/sbin/init.s
  422     0 root     S     1628   0%  11   0% {debug.sh} /bin/sh /usr/sbin/debug
  443   422 root     R     1624   0%   2   0% top -n1
  291     1 root     S     1616   0%  11   0% tail -f /dev/null
  444   422 root     S     1612   0%  10   0% grep %
  292   287 root     S     1612   0%   2   0% sleep 179
  322   286 root     S     1072   0%   2   0% inotifywait -e modify,delete /etc/
   23     1 root     S      860   0%   2   0% crond
*********************************************************************************

[INFO] REDIS
*********************************************************************************

used_memory_human:1.44M
used_memory_rss_human:4.59M
used_memory_peak_human:1.55M
total_system_memory_human:38.91G
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:4.39G
0
*********************************************************************************

[TEST] IP ROUTE
*********************************************************************************

CN IP URL:
110.xxx.xxx.xxx
CN RAW-IP URL:
110.xxx.xxx.xxx
------------------
Non-CN IP URL:
8x.xxx.xxx.xxx
8x.xxx.xxx.xxx
Non-CN RAW-IP URL:
8x.xxx.xxx.xxx
8x.xxx.xxx.xxx
8x.xxx.xxx.xxx
------------------
IP INFO:
8x.xxx.xxx.xxx
US,Los Angeles,California
ASN25820/IT7 Networks
HTTP/1.1 
Mozilla/5.0 Gecko/20100101 Firefox/120.0 https://github.com/kkkgo/PaoPaoDNS
America/Los_Angeles Time: 12/11/2023, 4:25:16 AM
[INFO] force_cn_list
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
MOSDNS WHOAMI :
akahelp: "ip" "110.152.38.232"
"ns" "2a04:e4c0:63::66"
"ecs" "110.152.38.0/24/24"
03k: UNBOUND WHOAMI:
akahelp: 03k: *********************************************************************************

[TEST] HIJACK
*********************************************************************************

ins-r23tsuuf.ias.tencent-cloud.net.
101.91.22.57
101.91.42.232
"ns" "240e:51:c800:37::2"
HIJACK 127.0.0.1 = 127.0.0.1
*********************************************************************************

[TEST] DIG-CN [taobao]
*********************************************************************************

MOSDNS CN:
www.taobao.com.danuoyi.tbcache.com.
110.157.250.109
110.157.250.110
UNBOUND CN:
[TEST] DIG-NOCN [youtube]
MOSDNS NOCN:
69.63.186.30
DNSCRYPT-UNBOUND NOCN:
youtube-ui.l.google.com.
142.250.201.142
172.217.18.142
DNSCRYPT NOCN:
youtube-ui.l.google.com.
172.217.26.238
172.217.175.238
DNSCRYPT-SOCKS5 NOCN:
;; communications error to 127.0.0.1#5303: connection refused
;; no servers could be reached

*********************************************************************************

[TEST] DUAL CN [IPv6=YES will have aaaa,taobao]
*********************************************************************************

www.taobao.com.danuoyi.tbcache.com.
240e:935:a00:20b:3::3a8
240e:935:a00:20b:3::3a7
[TEST] DUAL NOCN [IPv6=YES will block aaaa,youtube]
2a03:2880:f11c:8183:face:b00c:0:25de
[TEST] ONLY6 [IPv6=only6 will block aaaa if a ok]
checkipv6.synology.com : ddns-checkipv6.quickconnect.to.
checkipv6.digitalocean.synology.com.
2604:a880:2:d0::2049:2001
2604:a880:2:d0::2252:d001
2604:a880:2:d0::1700:7001
2604:a880:2:d0::230f:1
2604:a880:2:d0::22b5:d001
2604:a880:2:d0::4c0:2001
2604:a880:2:d0::2245:7001
2604:a880:2:d0::17e8:4001
2604:a880:2:d0::220d:b001
2604:a880:2:d0::2076:5001
2604:a880:2:d0::2206:5001
2604:a880:2:d0::209a:c001
ip6.03k.org : 6.ipw.cn : 2402:4e00:1013:e500:0:9671:f018:4947

*********************************************************************************

[info] ALL TEST FINISH.

-> debug end 1702297520

Answered by exp4sky

Dec 12, 2023

是的现在解析正常了。感谢

View full answer

kkkgo · 2023-12-11T12:30:36Z

kkkgo
Dec 11, 2023
Maintainer

你的网络存在劫持，在[TEST] HIJACK测试中不通过。

[TEST] HIJACK
*********************************************************************************

ins-r23tsuuf.ias.tencent-cloud.net.
101.91.22.57
101.91.42.232
"ns" "240e:51:c800:37::2"
HIJACK 127.0.0.1 = 127.0.0.1

参考 #56 (comment)

0 replies

exp4sky · 2023-12-11T18:09:39Z

exp4sky
Dec 11, 2023
Author

帮我看下这会还有问题吗
docker exec paopaodns debug.sh
ping: bad address 'whoami.03k.org'

== debug.sh : docker exec -it paopaodns sh ==

-> debug start 1702320124

[INFO] images build time : 2023-12-11 06:19:55 UTC
[OK]DATA_writeable
[OK]DATA_readable
[INFO] NETWORK
*********************************************************************************

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
4: eth0@if5: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
default via 172.17.0.1 dev eth0 
172.17.0.0/16 dev eth0 scope link  src 172.17.0.2 
PING 223.5.5.5 (223.5.5.5): 56 data bytes
64 bytes from 223.5.5.5: seq=0 ttl=114 time=42.351 ms

--- 223.5.5.5 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 42.351/42.351/42.351 ms
PING 119.29.29.29 (119.29.29.29): 56 data bytes
64 bytes from 119.29.29.29: seq=0 ttl=49 time=69.266 ms

--- 119.29.29.29 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 69.266/69.266/69.266 ms
Server:         223.5.5.5
Address:        223.5.5.5#53

Non-authoritative answer:
www.taobao.com  canonical name = www.taobao.com.danuoyi.tbcache.com.
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 110.157.250.109
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 110.157.250.110
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 240e:935:a00:20b:3::3a7
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 240e:935:a00:20b:3::3a8

Server:         119.29.29.29
Address:        119.29.29.29#53

Non-authoritative answer:
www.qq.com      canonical name = ins-r23tsuuf.ias.tencent-cloud.net.
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 101.91.22.57
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 101.91.42.232
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 240e:e1:a800:120::76
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 240e:e1:a800:120::36

*********************************************************************************

[INFO] ENV
*********************************************************************************

====ENV TEST====
[OK]DATA_writeable-
[OK]DATA_readable-
MEM:1500m 3000m 10000000 4500mb
prefPC:100
CORES:-12-
POWCORES:-8-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-yes-
CNFALL:-yes-
CUSTOM_FORWARD:-192.168.100.248:53-
AUTO_FORWARD:-yes-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-604800-
CUSTOM_FORWARD_TTL:-0-
SHUFFLE:-yes-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux 14b34e23e9ec 6.2.16-5-pve #1 SMP PREEMPT_DYNAMIC PVE 6.2.16-6 (2023-07-25T15:33Z) x86_64 Linux-
====ENV TEST====
mosdns kkkgo/mosdns:231210.1
*********************************************************************************

[INFO] PS
*********************************************************************************

PID   USER     TIME  COMMAND
    1 root      0:00 {init.sh} /bin/sh /usr/sbin/init.sh
   13 root      0:00 crond
   45 root      0:01 redis-server unixsocket:/tmp/redis.sock
  232 root      0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
  244 root      0:00 mosdns start -d /tmp -c /tmp/mosdns.yaml
  259 root      0:00 unbound -c /tmp/unbound_forward.conf -p
  265 root      0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
  268 root      0:00 tail -f /dev/null
  273 root      0:02 unbound -c /tmp/unbound_raw.conf -p
  306 root      0:00 inotifywait -e modify,delete /etc/unbound/named.cache /data/Country-only-cn-private.mmdb /data/force_cn_list.txt /data/force_nocn_list.txt /data/custom_env.ini /data/global_mark.dat /data/trackerslist.txt /data/force_forward_list.txt /data/force_ttl_rules.txt
 1547 root      0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
 1567 root      0:00 ps -ef
*********************************************************************************

[INFO] TOP
*********************************************************************************

CPU:   6% usr   4% sys   0% nic  88% idle   0% io   0% irq   0% sirq
  PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
  273     1 root     S    7277m  18%   3   0% unbound -c /tmp/unbound_raw.conf -
  244     1 root     S    1211m   3%   4   0% mosdns start -d /tmp -c /tmp/mosdn
  232     1 root     S    1211m   3%   0   0% dnscrypt-proxy -config /data/dnscr
   45     1 root     S    22912   0%   4   0% redis-server unixsocket:/tmp/redis
  259     1 root     S    20264   0%  11   0% unbound -c /tmp/unbound_forward.co
  265     1 root     S     1708   0%   0   0% {watch_list.sh} /bin/sh /usr/sbin/
    1     0 root     S     1632   0%  11   0% {init.sh} /bin/sh /usr/sbin/init.s
 1547     0 root     S     1628   0%   4   0% {debug.sh} /bin/sh /usr/sbin/debug
 1568  1547 root     R     1624   0%   0   0% top -n1
  268     1 root     S     1616   0%   3   0% tail -f /dev/null
 1569  1547 root     S     1612   0%  11   0% grep %
  306   265 root     S     1072   0%   3   0% inotifywait -e modify,delete /etc/
   13     1 root     S      860   0%   3   0% crond
*********************************************************************************

[INFO] REDIS
*********************************************************************************

used_memory_human:1.50M
used_memory_rss_human:4.59M
used_memory_peak_human:1.56M
total_system_memory_human:38.91G
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:4.39G
0
*********************************************************************************

[TEST] IP ROUTE
*********************************************************************************

CN IP URL:
110.xxx.xxx.xxx
110.xxx.xxx.xxx
110.xxx.xxx.xxx
CN RAW-IP URL:
110.xxx.xxx.xxx
------------------
CN IP URL:
110.xxx.xxx.xxx
CN RAW-IP URL:
110.xxx.xxx.xxx
------------------
Non-CN IP URL:
8x.xxx.xxx.xxx
8x.xxx.xxx.xxx
Non-CN RAW-IP URL:
8x.xxx.xxx.xxx
8x.xxx.xxx.xxx
8x.xxx.xxx.xxx
------------------
IP INFO:
8x.xxx.xxx.xxx
US,Los Angeles,California
ASN25820/IT7 Networks
HTTP/1.1 
Mozilla/5.0 Gecko/20100101 Firefox/120.0 https://github.com/kkkgo/PaoPaoDNS
America/Los_Angeles Time: 12/11/2023, 10:42:12 AM
[INFO] force_cn_list
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
MOSDNS WHOAMI :
akahelp: "ns" "133.130.98.250"
03k: UNBOUND WHOAMI:
akahelp: 03k: *********************************************************************************

[TEST] HIJACK
*********************************************************************************

;; communications error to 9.8.7.5#53: timed out
;; no servers could be reached

;; communications error to 9.8.7.6#53: timed out
;; no servers could be reached

HIJACK 127.0.0.1 = 58.217.249.177
*********************************************************************************

[TEST] DIG-CN [taobao]
*********************************************************************************

MOSDNS CN:
www.taobao.com.danuoyi.tbcache.com.
110.157.250.109
110.157.250.110
UNBOUND CN:
[TEST] DIG-NOCN [youtube]
MOSDNS NOCN:
142.251.220.78
142.250.66.78
216.58.200.238
DNSCRYPT-UNBOUND NOCN:
youtube-ui.l.google.com.
172.217.175.14
142.250.207.46
DNSCRYPT NOCN:
youtube-ui.l.google.com.
142.251.33.78
142.250.217.78
DNSCRYPT-SOCKS5 NOCN:
;; communications error to 127.0.0.1#5303: connection refused
;; no servers could be reached

*********************************************************************************

[TEST] DUAL CN [IPv6=YES will have aaaa,taobao]
*********************************************************************************

www.taobao.com.danuoyi.tbcache.com.
240e:935:a00:20b:3::3a8
240e:935:a00:20b:3::3a7
[TEST] DUAL NOCN [IPv6=YES will block aaaa,youtube]
[TEST] ONLY6 [IPv6=only6 will block aaaa if a ok]
checkipv6.synology.com : 2604:a880:2:d0::2049:2001
2604:a880:2:d0::2076:5001
2604:a880:2:d0::209a:c001
2604:a880:2:d0::22b5:d001
2604:a880:2:d0::2245:7001
2604:a880:2:d0::2206:5001
2604:a880:2:d0::17e8:4001
2604:a880:2:d0::1700:7001
2604:a880:2:d0::4c0:2001
2604:a880:2:d0::230f:1
2604:a880:2:d0::220d:b001
2604:a880:2:d0::2252:d001
ip6.03k.org : 2606:4700:3037::ac43:c96c
2606:4700:3034::6815:15ef
6.ipw.cn : 2402:4e00:1013:e500:0:9671:f018:4947

*********************************************************************************

[info] ALL TEST FINISH.

-> debug end 1702320136

9 replies

kkkgo Dec 12, 2023
Maintainer

从Non-CN RAW-IP URL可以看到被IP分流了（如果正常的话，Non-CN RAW-IP URL只能是你的宽带的IP）。
从结果来看，你容器的上一层应该是挂了个透明代理。透明代理把境外IP的流量分流到代理。

如果你的网络有“自动分流IP”的功能，请把容器的IP加入不分流的名单，因为权威DNS需要准确的IP去判断，IP分流会影响权威DNS的判断。

exp4sky Dec 12, 2023
Author

是的现在解析正常了。感谢

Answer selected by kkkgo

kkkgo Dec 12, 2023
Maintainer

正常的话Non-CN RAW-IP URL和IP INFO是你的宽带IP信息。分流会导致递归错误。

exp4sky Dec 12, 2023
Author

我已经把容器分流去掉了，解析都是我宽带的ip

TOPGUUN Dec 13, 2023

我现在Non-CN RAW-IP URL和IP INFO是代理的IP信息，PAOPAODNS后面接的OPENCLASH FAKEIP，用的自定义防火墙规则是

#!/bin/sh
. /usr/share/openclash/log.sh
. /lib/functions.sh

This script is called by /etc/init.d/openclash

Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

ipset -! flush china_ip_route
ipset -! restore </etc/openclash/china_ip_route.ipset 2>/dev/null

避免来自中国的流量经过代理，需要走代理的都保留了 Fake IP

iptables -t nat -D openclash -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 -j REDIRECT --to-ports 7892

避免宿主机自身的出口流量全部走代理

iptables -t nat -D openclash_output -p tcp -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892

避免来自中国的 UDP 流量经过代理

iptables -t mangle -D openclash -p udp -j TPROXY --tproxy-mark 0x162/0xffffffff --on-port 7895

除 Fake IP 外，非中国 IP 的流量也重定向到代理

iptables -t nat -A openclash -p tcp -m set ! --match-set china_ip_route dst -j REDIRECT --to-ports 7892

重定向非中国的 UDP 流量到代理

iptables -t mangle -A openclash -p udp -m set ! --match-set china_ip_route dst -j TPROXY --tproxy-mark 0x162/0xffffffff --on-port 7895

对于宿主机自身的 TCP 流量除了 Fake IP 外，对于非中国 IP 的流量且非 OpenClash 的出口流量也重定向到代理

iptables -t nat -A openclash_output -p tcp -m set ! --match-set china_ip_route dst -m owner ! --uid-owner 65534 -j REDIRECT --to-ports 7892

exit 0

请问怎么修改把DOKER的IP:172.17.0.2加入不分流，谢谢大大

kkkgo Dec 13, 2023
Maintainer

你可以尝试用macvlan网络模式让容器获取独立的IP，然后把这个IP加入不分流；
有条件的话建议docker和代理网关分开部署，拓扑可以参考 https://github.com/kkkgo/PaoPaoGateWay

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

最新版本的paopaodns会导致raw.githubusercontent.com解析为0.0.0.0 #83

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 9 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

最新版本的paopaodns会导致raw.githubusercontent.com解析为0.0.0.0 #83

exp4sky Dec 11, 2023

== debug.sh : docker exec -it paopaodns sh ==

Replies: 2 comments · 9 replies

kkkgo Dec 11, 2023 Maintainer

exp4sky Dec 11, 2023 Author

== debug.sh : docker exec -it paopaodns sh ==

kkkgo Dec 12, 2023 Maintainer

exp4sky Dec 12, 2023 Author

kkkgo Dec 12, 2023 Maintainer

exp4sky Dec 12, 2023 Author

TOPGUUN Dec 13, 2023

This script is called by /etc/init.d/openclash

Add your custom firewall rules here, they will be added after the end of the OpenClash iptables rules

避免来自中国的流量经过代理，需要走代理的都保留了 Fake IP

避免宿主机自身的出口流量全部走代理

避免来自中国的 UDP 流量经过代理

除 Fake IP 外，非中国 IP 的流量也重定向到代理

重定向非中国的 UDP 流量到代理

对于宿主机自身的 TCP 流量除了 Fake IP 外，对于非中国 IP 的流量且非 OpenClash 的出口流量也重定向到代理

kkkgo Dec 13, 2023 Maintainer

exp4sky
Dec 11, 2023

Replies: 2 comments 9 replies

kkkgo
Dec 11, 2023
Maintainer

exp4sky
Dec 11, 2023
Author

kkkgo Dec 12, 2023
Maintainer

exp4sky Dec 12, 2023
Author

kkkgo Dec 12, 2023
Maintainer

exp4sky Dec 12, 2023
Author

kkkgo Dec 13, 2023
Maintainer