<%+header%>
<%
local uci = require "luci.model.uci".cursor()
local function g(sec, opt, def)
local v = uci:get("dnsguard", sec, opt)
if v == nil or v == "" then return def or "" end
return v
end
local function e(s)
s = tostring(s or "")
return (s:gsub("&", "&"):gsub("<", "<"):gsub(">", ">"):gsub('"', """))
end
local function on(sec, opt)
return g(sec, opt, "0") == "1"
end
-- 取 API 地址：优先 build_url，拿不到就退回固定路径（保证页面不白屏）
local api_url = "/cgi-bin/luci/admin/services/dnsguard/api"
local ok_disp, disp = pcall(require, "luci.dispatcher")
if ok_disp and disp and disp.build_url then
local ok1, u1 = pcall(disp.build_url, "admin", "services", "dnsguard", "api")
if ok1 and u1 then api_url = u1 end
end
local cfg_enabled = on("main", "enabled")
local cfg_redirect = on("main", "redirect53")
local cfg_watch = on("main", "watch")
local cfg_853 = on("main", "block853")
local cfg_doh = on("main", "blockdoh")
local cfg_port = g("main", "target_port", "53")
local cfg_ifaces = g("main", "ifaces", "br-lan")
local cfg_skip = g("main", "skip_devices", "")
local cfg_loglimit = g("main", "log_limit", "5")
local cfg_rollmin = g("main", "rollback_minutes", "10")
local cfg_nh4 = g("limits", "never_hijack4", "")
local cfg_nh6 = g("limits", "never_hijack6", "")
local cfg_dohsrv = g("limits", "doh_servers", "")
%>
DNS 防绕过
把局域网内「绕过 AdGuard Home 的 DNS」拉回本机解析：53 明文用透明重定向（客户端无感）、
853 DoT 用阻断（逼其回落 53）、DoH 专用 IP 可选阻断。
配置存于 /etc/config/dnsguard，保存后渲染到 /etc/nftables.d/20-dns-guard.nft 并重载 fw4。