DNS 100%无侧漏☂️ 配置示例📜

最近把规则都转到了mrs格式上，顺便把DNS 侧漏也修复了，测试了一下，100%无侧漏

食用方法：

mihomo

扔给AI，让它帮你补齐你所需要的分流，策略组，最后你自己再手动完成敏感的

proxies/proxy-providers

# Mihomo DNS / Leak-Guard Minimal Example



...



dns:

  enable: true

  listen: :53

  ipv6: false

  cache-algorithm: arc

  respect-rules: true

  use-hosts: false

  use-system-hosts: false

  prefer-h3: false



  # Bootstrap DNS

  default-nameserver:

    - 223.5.5.5

    - 114.114.114.114



  # 国内域名使用国内 DNS

  nameserver-policy:

    rule-set:CN_Domain:

      - https://223.5.5.5/dns-query

      - https://1.12.12.12/dns-query



  # 其他域名使用海外 DoH，并通过 Proxy 发出

  nameserver:

    - https://cloudflare-dns.com/dns-query#Proxy

    - https://dns.google/dns-query#Proxy



  # 代理节点域名解析

  proxy-server-nameserver:

    - 223.5.5.5

    - 119.29.29.29



  # DIRECT 流量使用国内 DNS

  direct-nameserver:

    - https://223.5.5.5/dns-query

    - https://1.12.12.12/dns-query



  direct-nameserver-follow-policy: false



  enhanced-mode: fake-ip

  fake-ip-range: 198.18.0.1/16

  fake-ip-filter-mode: rule



  # Fake-IP 例外尽量少

  fake-ip-filter:

    - DOMAIN-SUFFIX,lan,real-ip

    - DOMAIN-SUFFIX,local,real-ip

    - DOMAIN-SUFFIX,arpa,real-ip

    - DOMAIN-SUFFIX,ntp.org,real-ip

    - RULE-SET,Private_Domain,real-ip

    - MATCH,fake-ip



tun:

  enable: true

  stack: mips

  auto-route: true

  auto-detect-interface: true

  disable-icmp-forwarding: true



  dns-hijack:

    - any:53

    - tcp://any:53



  strict-route: true



sniffer:

  enable: true

  parse-pure-ip: false

  override-destination: false



  sniff:

    TLS:

      ports:

        - 443

        - 8443

    HTTP:

      ports:

        - 80

        - 8080-8880

      override-destination: true



...



rule-providers:

  Private_Domain:

    type: http

    behavior: domain

    format: mrs

    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/private.mrs

    interval: 86400



  CN_Domain:

    type: http

    behavior: domain

    format: mrs

    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geosite/cn.mrs

    interval: 86400



  CN_IP:

    type: http

    behavior: ipcidr

    format: mrs

    url: https://raw.githubusercontent.com/MetaCubeX/meta-rules-dat/meta/geo/geoip/cn.mrs

    interval: 86400



rules:

  # 私有域名与明确私网地址直连

  - RULE-SET,Private_Domain,DIRECT

  - IP-CIDR,10.0.0.0/8,DIRECT,no-resolve

  - IP-CIDR,100.64.0.0/10,DIRECT,no-resolve

  - IP-CIDR,127.0.0.0/8,DIRECT,no-resolve

  - IP-CIDR,169.254.0.0/16,DIRECT,no-resolve

  - IP-CIDR,172.16.0.0/12,DIRECT,no-resolve

  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve



  # 禁止 QUIC，减少 UDP/443 旁路

  - AND,((NETWORK,udp),(DST-PORT,443)),REJECT



  # 自定义强制代理规则应放在 CN 规则之前



  # 大陆明确直连

  - RULE-SET,CN_Domain,DIRECT

  - RULE-SET,CN_IP,DIRECT,no-resolve



  # 其他未命中流量默认代理

  - MATCH,Final