书接上回： https://v2ex.com/t/1091065
上回只讲了 dns ，没有讲流量的劫持。
既然 dns 已经分好了代理的域名 fakeip ，其它域名 realip ，那不管是在 openwrt 、linux 上用 nft 、ebpf ，还是 ios 、Windows 上用 tun ，只需要将 fakeip 段和特殊的 telegram ip 、国外 dns ip 、gv ip 劫持到 sing-box 就可以了。
这样做有如下好处：
- 减少进入核心的流量，减轻系统负担
- 直连流量在路由上完全透明，与无代理时一致，不影响速度
- sing-box 的路由规则极简
- 需要劫持的 IP 段只有 20 条+
- 无须手动维护域名表
下面分享一个不依赖 mosdns 的 Windows 端的 sing-box 裸核配置，dns 分流逻辑与前帖中 mosdns 的分流逻辑基本一致，版本是 sing-box 1.11 ，最新的 1.13 也可以用，需要设置一下环境变量
1.13 启动方法
set ENABLE_DEPRECATED_LEGACY_DNS_FAKEIP_OPTIONS=true
set ENABLE_DEPRECATED_LEGACY_DNS_SERVERS=true
set ENABLE_DEPRECATED_OUTBOUND_DNS_RULE_ITEM=true
set ENABLE_DEPRECATED_MISSING_DOMAIN_RESOLVER=true
P:\sing-box\sing-box.exe run -c P:\sing-box\configwin.json
下面是配置
##搜索改为这 2 个字查找需要修改的地方，共 8 处，只有 vps 节点是必须要改的
{
"log": {
"level": "error",
"timestamp": true
},
"dns": {
"servers": [
{
"tag": "homedns", #此处改为家中 dns
"address": "tcp://10.10.10.1:53",
"detour": "direct"
},
{
"tag": "fakedns",
"address": "fakeip"
},
{
"tag": "localdns",
"address": "quic://223.5.5.5",
"detour": "direct"
}
],
"rules": [ #规则从上往下执行
{
"outbound": "any", #解析节点域名
"server": "localdns"
},
{
"query_type": [ #干掉无用类型解析
"AAAA",
"HTTPS",
"SVCB",
"PTR"
],
"action": "reject"
},
{
"domain_suffix": [
"jddebug.com"
],
"action": "reject"
},
{ #在家时不使用 sb dns 规则，后续规则都不执行
"wifi_bssid": "68:dd:b7:1a:0c:9e", #此处改为家中 ap 的 mac 地址
"server": "homedns" #在 debug 模式下迅速开关 sb 后在日志中查询
},
{
"domain_suffix": [ #极特殊域名发 fakeip
"c.mi.com"
],
"server": "fakedns"
},
{ #直连域名 A 记录使用当前 dns 解析 realip
"rule_set": [
"geosite-cn",
"geosite-apple"
],
"server": "localdns"
},
{
"rule_set": "geosite-geolocation-!cn", #代理域名发 fakeip
"server": "fakedns"
},
{ #列表外域名如果有 cnip 或者 apple ip 接受 real ip
"type": "logical",
"mode": "or",
"rules": [
{
"rule_set": "geoip-cn"
},
{
"ip_cidr": [
"17.0.0.0/8"
]
}
],
"server": "localdns"
},
{
"server": "fakedns"
}
],
"fakeip": {
"enabled": true,
"inet4_range": "7.0.0.0/8",
"inet6_range": "2002::/16"
},
"independent_cache": true,
"disable_expire": false,
"final": "localdns"
},
"route": {
"rules": [
{
"port": 53,
"action": "hijack-dns"
},
{ #在家中时默认家中全局科学，直连，后续规则都不执行
"wifi_bssid": "68:dd:b7:1a:0c:9e", #改为自己的 ap mac
"outbound": "direct"
},
{ #不在家中时，家中内网段走家中节点回家
"ip_cidr": [
"10.10.10.0/24" #改为自己的内网 ip 段
],
"outbound": "home"
},
{ #telegram ip 段走代理
"ip_cidr": [
"2001:b28:f23d::/48",
"2001:b28:f23f::/48",
"2001:67c:4e8::/48",
"2001:b28:f23c::/48",
"2001:4860:4860::8888/128",
"2001:4860:4860::8844/128",
"2a0a:f280::/32"
],
"outbound": "proxy"
},
{
"ip_cidr": [
"::/0"
],
"action": "reject"
}
],"final": "proxy", #默认都走代理
"auto_detect_interface": true,
"rule_set": [
{
"tag": "geosite-apple",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-apple.srs",
"download_detour": "proxy"
},
{
"tag": "geosite-cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
"download_detour": "proxy"
},
{
"tag": "geosite-geolocation-!cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs",
"download_detour": "proxy"
},
{
"tag": "geoip-cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
"download_detour": "proxy"
}
]
},
"inbounds": [
{
"type": "tun",
"tag": "tunin",
"address": [
"172.18.0.1/30",
"fdfe:dcba:9876::1/126"
],
"mtu": 9000,
"auto_route": true,
"route_address": [ #只劫持 fakeip 、telegram ip 、gv ip 、tun ip 段、公网 ipv6 段（用于指定国内 ipv6 是否走手机数据）
"7.0.0.0/8",
"2002::/16",
"10.10.10.0/24", #改为自己的内网 ip 段
"194.221.250.50/32",
"5.28.195.0/24",
"216.239.36.0/24",
"91.108.56.0/22",
"91.108.4.0/22",
"91.108.8.0/22",
"91.108.16.0/22",
"91.108.12.0/22",
"149.154.160.0/20",
"91.105.192.0/23",
"91.108.20.0/22",
"95.161.64.0/20",
"185.76.151.0/24",
"8.8.8.8/32",
"8.8.4.4/32",
"9.9.9.9/32",
"1.1.1.1/32",
"2001:4860:4860::8888/128",
"2001:4860:4860::8844/128",
"2000::/3"
],
"strict_route": true
}
],
"outbounds": [
{
"type": "tuic", #改为自己家中节点
},
{
"type": "tuic", #改为自己的 vps 节点
},
{
"type": "direct",
"tag": "direct"
}
],
"experimental": {
"clash_api": {
"external_ui": "zash",
"external_ui_download_url": "https://github.com/Zephyruso/zashboard/releases/latest/download/dist.zip",
"external_ui_download_detour": "proxy",
"secret": "password", #改为自己的密码
"external_controller": "0.0.0.0:9987",
"access_control_allow_origin": [
"http://board.zash.run.place"
],
"access_control_allow_private_network": true
},
"cache_file": {
"enabled": true,
"path": "cachewin.db"
}
}
}
下面分享一下 ios 端 sing-box 1.11 的配置，dns 分流逻辑与 mosdns 基本一致，sing-box 1.11 版本以上不可用，原因未知，感兴趣的可自行排查解决
##搜索改为这 2 个字查找需要修改的地方，共 8 处，只有 1 个出站节点处是必须要改的，其它非必须
{
"log": {
"level": "debug",
"timestamp": true
},
"dns": {
"servers": [
{
"tag": "homedns", #此处改为家中 dns
"address": "tcp://10.10.10.1:53",
"detour": "direct"
},
{
"tag": "mobiledns",
"address": "223.5.5.5",
"detour": "directm"
},
{
"tag": "fakedns",
"address": "fakeip"
},
{
"tag": "nodedns",
"address": "local",
"detour": "direct"
}
],
"rules": [ #规则从上往下执行
{
"outbound": "any", #解析节点域名
"server": "nodedns"
},
{
"query_type": [ #干掉无用类型解析
"HTTPS",
"SVCB",
"PTR"
],
"action": "reject"
},
{
"domain_suffix": [
"jddebug.com"
],
"action": "reject"
},
{ #在家时不使用 sb dns 规则，后续规则都不执行
"wifi_bssid": "68:dd:b7:1a:0c:9e", #此处改为家中 ap 的 mac 地址
"server": "homedns" #在 debug 模式下迅速开关 sb 后在日志中查询
},
{
"domain_suffix": [ #极特殊域名发 fakeip
"c.mi.com"
],
"server": "fakedns"
},
{ #直连域名 A 记录使用当前 dns 解析 realip
"rule_set": [
"geosite-cn",
"geosite-apple"
],
"query_type": [
"A"
],
"server": "nodedns"
},
{ #直连域名 AAAA 记录使用手机数据解析 realip
"type": "logical",
"mode": "and",
"rules": [
{
"rule_set": [
"geosite-cn",
"geosite-apple"
]
},
{
"query_type": "AAAA"
}
],
"server": "mobiledns"
},
{
"rule_set": "geosite-geolocation-!cn", #代理域名发 fakeip
"server": "fakedns"
},
{ #列表外域名 A 记录如果有 cnip 或者 apple ip 接受 real ip
"type": "logical",
"mode": "and",
"rules": [
{
"query_type": "A"
},
{
"type": "logical",
"mode": "or",
"rules": [
{
"rule_set": "geoip-cn"
},
{
"ip_cidr": [
"17.0.0.0/8"
]
}
]
}
],
"server": "nodedns"
},
{ #列表外域名 AAAA 记录如果有 cnip 或者 apple ip 接受 realip （使用手机数据解析）
"type": "logical",
"mode": "and",
"rules": [
{
"query_type": "AAAA"
},
{
"rule_set": "geoip-cn"
}
],
"server": "mobiledns"
},
{
"query_type": [ #干掉无用类型解析
"AAAA"
],
"action": "reject"
},
{ #上述规则都未命中，只对 A 发 fakeip ，一些列表外域名无 AAAA 记录但 A 有 cnip ，发 fakeip 不合适
"query_type": [
"A"
],
"server": "fakedns"
}
],
"fakeip": {
"enabled": true,
"inet4_range": "7.0.0.0/8",
"inet6_range": "2002::/16"
},
"independent_cache": true,
"disable_expire": false,
"final": "nodedns"
},
"route": {
"rules": [
{
"port": 53,
"action": "hijack-dns"
},
{ #在家中时默认家中全局科学，直连，后续规则都不执行
"wifi_bssid": "68:dd:b7:1a:0c:9e", #改为自己的 ap mac
"outbound": "direct"
},
{ #不在家中时，家中内网段走家中节点回家
"ip_cidr": [
"10.10.10.0/24" #改为自己的内网 ip 段
],
"outbound": "home"
},
{ #telegram ip 段走代理
"ip_cidr": [
"2001:b28:f23d::/48",
"2001:b28:f23f::/48",
"2001:67c:4e8::/48",
"2001:b28:f23c::/48",
"2a0a:f280::/32"
],
"outbound": "proxy"
},
{ #国内 ipv6 走手机数据
"ip_cidr": [
"::/0"
],
"outbound": "directm"
}
],
"final": "proxy", #默认都走代理
"auto_detect_interface": true,
"rule_set": [
{
"tag": "geosite-apple",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-apple.srs",
"download_detour": "proxy"
},
{
"tag": "geosite-cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-cn.srs",
"download_detour": "proxy"
},
{
"tag": "geosite-geolocation-!cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geosite/rule-set/geosite-geolocation-!cn.srs",
"download_detour": "proxy"
},
{
"tag": "geoip-cn",
"type": "remote",
"format": "binary",
"url": "https://raw.githubusercontent.com/SagerNet/sing-geoip/rule-set/geoip-cn.srs",
"download_detour": "proxy"
}
]
},
"inbounds": [
{
"type": "tun",
"tag": "tun-in",
"address": [
"172.18.0.1/30",
"fdfe:dcba:9876::1/126"
],
"mtu": 9000,
"auto_route": true,
"route_address": [ #只劫持 fakeip 、telegram ip 、gv ip 、tun ip 段、公网 ipv6 段（用于指定国内 ipv6 是否走手机数据）
"7.0.0.0/8",
"2002::/16",
"10.10.10.0/24", #改为自己的内网 ip 段
"194.221.250.50/32",
"5.28.195.0/24",
"216.239.36.0/24",
"91.108.56.0/22",
"91.108.4.0/22",
"91.108.8.0/22",
"91.108.16.0/22",
"91.108.12.0/22",
"149.154.160.0/20",
"91.105.192.0/23",
"91.108.20.0/22",
"95.161.64.0/20",
"185.76.151.0/24",
"172.18.0.1/30",
"8.8.8.8/32",
"8.8.8.8/32",
"9.9.9.9/32",
"1.1.1.1/32",
"2001:4860:4860::8888/128",
"2001:4860:4860::8844/128",
"fdfe:dcba:9876::1/126",
"2000::/3"
],
"strict_route": false
}
],
"outbounds": [
{
"type": "tuic", #改为自己家中节点
},
{
"type": "tuic", #改为自己的 vps 节点
},
{
"type": "direct",
"tag": "direct"
},
{ #手机数据出站
"type": "direct",
"network_type": "cellular",
"tag": "directm"
}
],
"experimental": {
"clash_api": {
"external_ui": "zash",
"external_ui_download_url": "https://github.com/Zephyruso/zashboard/releases/latest/download/dist.zip",
"external_ui_download_detour": "proxy",
"secret": "123456",
"external_controller": "0.0.0.0:9090",
"access_control_allow_origin": [
"http://192.168.4.132", #改为自己手机分配的内网地址用于在电脑上使用 web ui 看日志
"http://board.zash.run.place"
],
"access_control_allow_private_network": true
},
"cache_file": {
"enabled": true,
"path": "cacheios.db"
}
}
}
