🎨 Sync 2026-04-10 15:34:26

luci-app-passwall2/Makefile

@@ -6,7 +6,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall2
-PKG_VERSION:=26.4.5
+PKG_VERSION:=26.4.10
 PKG_RELEASE:=1
 PKG_PO_VERSION:=$(PKG_VERSION)
 

luci-app-passwall2/luasrc/model/cbi/passwall2/client/global.lua

@@ -168,6 +168,19 @@ node_socks_bind_local:depends({ node = "", ["!reverse"] = true })
 
 s:tab("DNS", translate("DNS"))
 
+o = s:taboption("DNS", TextValue, "direct_dns_shunt", translate("Direct domain DNS routing"))
+o.description = "<br /><ul>"
+.. "<li>" .. translate("Subdomain (recommended): Begining with 'domain:' and the rest is a domain. When the targeting domain is exactly the value, or is a subdomain of the value, this rule takes effect. Example: rule 'domain:v2ray.com' matches 'www.v2ray.com', 'v2ray.com', but not 'xv2ray.com'.") .. "</li>"
+.. "<li>" .. translate("Full domain: Begining with 'full:' and the rest is a domain. When the targeting domain is exactly the value, the rule takes effect. Example: rule 'domain:v2ray.com' matches 'v2ray.com', but not 'www.v2ray.com'.") .. "</li>"
+.. "<li>" .. translate("Such as:") .. "</li>"
+.. "<li>" .. "domain:my-nodes.com tcp://223.5.5.5" .. "</li>"
+.. "<li>" .. "domain:vpn.com udp://119.29.29.29:53" .. "</li>"
+.. "<li>" .. "full:www.dnspod.com https://120.53.53.53/dns-query" .. "</li>"
+.. "<li>" .. '<a style="color:red">' .. translate("Please note that the program will not start if the format is incorrect!") .. '</a>' .. "</li>"
+.. "</ul>"
+o.rows = 3
+o.wrap = "off"
+
 o = s:taboption("DNS", ListValue, "direct_dns_query_strategy", translate("Direct Query Strategy"))
 o.default = "UseIP"
 o:value("UseIP")

luci-app-passwall2/luasrc/passwall2/util_sing-box.lua

@@ -91,6 +91,34 @@ local function convert_geofile()
 	convert(GEO_VAR.IP_PATH, "geoip", GEO_VAR.IP_TAGS)
 end
 
+function parseDNS(str)
+	local result_dns_server
+	-- [proto]://[ip]
+	-- [proto]://[ip]:[port]
+	-- https://[ip]/[path]
+	-- https://[ip]:[port]/[path]
+	local _a = api.parseURL(str)
+	if _a then
+		if _a.protocol == "tcp" or _a.protocol == "udp" or _a.protocol == "https" then
+			result_dns_server = {
+				type = _a.protocol,
+				server = _a.hostname
+			}
+			if _a.port then
+				result_dns_server.server_port = _a.port
+			else
+				if _a.protocol == "https" then
+					result_dns_server.server_port = 443
+				else
+					result_dns_server.server_port = 53
+				end
+			end
+			result_dns_server.path = _a.pathname
+		end
+	end
+	return result_dns_server
+end
+
 function gen_outbound(flag, node, tag, proxy_table)
 	local result = nil
 	if node then
@@ -1754,6 +1782,13 @@ function gen_config(var)
 		tag = "local"
 	})
 
+	local direct_strategy = "prefer_ipv6"
+	if direct_dns_query_strategy == "UseIPv4" then
+		direct_strategy = "ipv4_only"
+	elseif direct_dns_query_strategy == "UseIPv6" then
+		direct_strategy = "ipv6_only"
+	end
+
 	if dns_listen_port then
 		local dns_host = ""
 		if flag == "global" then
@@ -1891,13 +1926,6 @@ function gen_config(var)
 				})
 			end
 
-			direct_strategy = "prefer_ipv6"
-			if direct_dns_query_strategy == "UseIPv4" then
-				direct_strategy = "ipv4_only"
-			elseif direct_dns_query_strategy == "UseIPv6" then
-				direct_strategy = "ipv6_only"
-			end
-
 			local server_port = tonumber(direct_dns_udp_port) or 53
 
 			table.insert(dns.servers, {
@@ -2229,7 +2257,155 @@ function gen_proto_config(var)
 	return jsonc.stringify(config, 1)
 end
 
+function gen_front_dns_config(var)
+	local dns_listen_port = var["dns_listen_port"]
+	local direct_dns_udp_server = var["direct_dns_udp_server"]
+	local direct_dns_udp_port = var["direct_dns_udp_port"]
+	local direct_dns_query_strategy = var["direct_dns_query_strategy"]
+	local default_dns_udp_server = var["default_dns_udp_server"]
+	local default_dns_udp_port = var["default_dns_udp_port"]
+
+	local dns = {
+		servers = {},
+		rules = {}
+	}
+	local inbounds = {}
+	local outbounds = {}
+	local route = {}
+
+	local direct_strategy = "prefer_ipv6"
+	if direct_dns_query_strategy == "UseIPv4" then
+		direct_strategy = "ipv4_only"
+	elseif direct_dns_query_strategy == "UseIPv6" then
+		direct_strategy = "ipv6_only"
+	end
+
+	table.insert(outbounds, {
+		type = "direct",
+		tag = "direct",
+		routing_mark = 255,
+		domain_resolver = {
+			server = "direct",
+			strategy = direct_strategy
+		}
+	})
+
+	local direct_dns_shunt = uci:get(appname, "@global[0]", "direct_dns_shunt") or ""
+	if #direct_dns_shunt > 0 then
+		local dns_server = {}
+		string.gsub(direct_dns_shunt, '[^' .. "\r\n" .. ']+', function(w)
+			if w:find("#") == 1 then return end
+			local domain = sys.exec(string.format("echo -n $(echo %s | awk -F ' ' '{print $1}')", w))
+			local dns = sys.exec(string.format("echo -n $(echo %s | awk -F ' ' '{print $2}')", w))
+			if domain ~= "" and dns ~= "" then
+				local new_dns_server = parseDNS(dns)
+				if new_dns_server then
+					if not dns_server[dns] then
+						dns_server[dns] = {}
+					end
+					if not dns_server[dns].server then
+						dns_server[dns].server = new_dns_server
+						dns_server[dns].server.tag = dns
+						dns_server[dns].server.detour = "direct"
+					end
+					if not dns_server[dns].rule then
+						dns_server[dns].rule = {
+							action = "route",
+							server = dns,
+							domain = {},
+							domain_suffix = {},
+							domain_keyword = {}
+						}
+					end
+					if domain:find("full:") == 1 then
+						table.insert(dns_server[dns].rule.domain, domain:sub(1 + #"full:"))
+					elseif domain:find("domain:") == 1 then
+						table.insert(dns_server[dns].rule.domain_suffix, domain:sub(1 + #"domain:"))
+					else
+						table.insert(dns_server[dns].rule.domain_keyword, domain)
+					end
+				end
+			end
+		end)
+		for k, v in pairs(dns_server) do
+			table.insert(dns.servers, v.server)
+			if #v.rule.domain == 0 then v.rule.domain = nil end
+			if #v.rule.domain_suffix == 0 then v.rule.domain_suffix = nil end
+			if #v.rule.domain_keyword == 0 then v.rule.domain_keyword = nil end
+			table.insert(dns.rules, v.rule)
+		end
+	end
+
+	if direct_dns_udp_server then
+		table.insert(dns.servers, {
+			tag = "direct",
+			type = "udp",
+			server = direct_dns_udp_server,
+			server_port = tonumber(direct_dns_udp_port) or 53,
+			detour = "direct"
+		})
+		local node_domain = {}
+		local nodes_domain_text = sys.exec('uci show passwall2 | grep ".address=" | cut -d "\'" -f 2 | grep "[a-zA-Z]$" | sort -u')
+		string.gsub(nodes_domain_text, '[^' .. "\r\n" .. ']+', function(w)
+			table.insert(node_domain, w)
+		end)
+		if #node_domain > 0 then
+			table.insert(dns.rules, {
+				action = "route",
+				server = "direct",
+				domain = node_domain
+			})
+		end
+	end
+
+	if default_dns_udp_server then
+		table.insert(dns.servers, {
+			tag = "default",
+			type = "udp",
+			server = default_dns_udp_server,
+			server_port = tonumber(default_dns_udp_port) or 53,
+			detour = "direct"
+		})
+		dns.final = "default"
+	else
+		dns.final = "direct"
+	end
+
+	local dns_in_inbound = {
+		type = "direct",
+		tag = "dns-in",
+		listen = "127.0.0.1",
+		listen_port = tonumber(dns_listen_port),
+	}
+	table.insert(inbounds, dns_in_inbound)
+
+	route.rules = {}
+	table.insert(route.rules, {
+		action = "hijack-dns",
+		inbound = dns_in_inbound.tag
+	})
+	table.insert(route.rules, {
+		action = "sniff",
+		inbound = dns_in_inbound.tag
+	})
+	route.final = "direct"
+
+	local config = {
+		log = {
+			disabled = true,
+			level = "debug",
+			timestamp = true,
+		},
+		dns = dns,
+		inbounds = inbounds,
+		outbounds = outbounds,
+		route = route
+	}
+	return jsonc.stringify(config, 1)
+end
+
 _G.gen_config = gen_config
+_G.gen_front_dns_config = gen_front_dns_config
 _G.gen_proto_config = gen_proto_config
 _G.geo_convert_srs = geo_convert_srs
 

luci-app-passwall2/luasrc/passwall2/util_xray.lua

@@ -28,6 +28,35 @@ local function get_domain_excluded()
 	return hosts
 end
 
+function parseDNS(str)
+	local result_dns_server
+	-- [proto]://[ip]
+	-- [proto]://[ip]:[port]
+	-- https://[ip]/[path]
+	-- https://[ip]:[port]/[path]
+	local _a = api.parseURL(str)
+	if _a then
+		if _a.protocol == "tcp" or _a.protocol == "udp" or _a.protocol == "https" then
+			result_dns_server = {
+				address = str
+			}
+			if _a.protocol == "udp" then
+				result_dns_server.address = _a.hostname
+			end
+			if _a.port then
+				result_dns_server.port = _a.port
+			else
+				if _a.protocol == "https" then
+					result_dns_server.port = 443
+				else
+					result_dns_server.port = 53
+				end
+			end
+		end
+	end
+	return result_dns_server
+end
+
 function gen_outbound(flag, node, tag, proxy_table)
 	local result = nil
 	if node then
@@ -1451,12 +1480,22 @@ function gen_config(var)
 		queryStrategy = "UseIP"
 	}
 
-	table.insert(dns_servers, {
-		server = {
-			tag = "local",
-			address = "localhost"
+	local _direct_dns = nil
+	if direct_dns_udp_server then
+		_direct_dns = {
+			tag = direct_dns_tag,
+			address = direct_dns_udp_server,
+			port = tonumber(direct_dns_udp_port) or 53,
+			queryStrategy = (direct_dns_query_strategy and direct_dns_query_strategy ~= "") and direct_dns_query_strategy or "UseIP"
 		}
-	})
+
+		if _direct_dns.address then
+			table.insert(dns_servers, {
+				outboundTag = "direct",
+				server = _direct_dns
+			})
+		end
+	end
 
 	if dns_listen_port then
 		local _remote_dns_proto = "tcp"
@@ -1556,8 +1595,7 @@ function gen_config(var)
 				server = _remote_fakedns
 			})
 		end
-	
-		local _direct_dns = nil
+
 		if direct_dns_udp_server then
 			local domain = {}
 			local nodes_domain_text = sys.exec('uci show passwall2 | grep ".address=" | cut -d "\'" -f 2 | grep "[a-zA-Z]$" | sort -u')
@@ -1565,24 +1603,10 @@ function gen_config(var)
 				table.insert(domain, "full:" .. w)
 			end)
 			if #domain > 0 then
-				table.insert(dns_domain_rules, 1, {
-					shunt_rule_name = "logic-vpslist",
-					outboundTag = "direct",
-					domain = domain
-				})
-			end
-
-			_direct_dns = {
-				tag = direct_dns_tag,
-				address = direct_dns_udp_server,
-				port = tonumber(direct_dns_udp_port) or 53,
-				queryStrategy = (direct_dns_query_strategy and direct_dns_query_strategy ~= "") and direct_dns_query_strategy or "UseIP",
-			}
-
-			if _direct_dns.address then
-				table.insert(dns_servers, {
-					outboundTag = "direct",
-					server = _direct_dns
+				table.insert(dns.servers, 1, {
+					tag = "local",
+					address = "localhost",
+					domains = domain
 				})
 			end
 		end
@@ -1773,6 +1797,21 @@ function gen_config(var)
 		end
 	end
 
+	local has_default_dns_server = "0"
+	for index, value in ipairs(dns.servers) do
+		if value.domains == nil then
+			has_default_dns_server = "1"
+			break
+		end
+	end
+
+	if #dns.servers == 0 or not has_default_server == "0" then
+		table.insert(dns.servers, 1, {
+			tag = "local",
+			address = "localhost"
+		})
+	end
+
 	if redir_port then
 		local inbound = {
 			port = tonumber(redir_port),
@@ -1994,250 +2033,154 @@ function gen_proto_config(var)
 	return jsonc.stringify(config, 1)
 end
 
-function gen_dns_config(var)
+function gen_front_dns_config(var)
 	local dns_listen_port = var["dns_listen_port"]
-	local dns_out_tag = var["dns_out_tag"]
 	local direct_dns_udp_server = var["direct_dns_udp_server"]
 	local direct_dns_udp_port = var["direct_dns_udp_port"]
-	local direct_dns_tcp_server = var["direct_dns_tcp_server"]
-	local direct_dns_tcp_port = var["direct_dns_tcp_port"]
-	local direct_dns_doh_url = var["direct_dns_doh_url"]
-	local direct_dns_doh_host = var["direct_dns_doh_host"]
-	local direct_dns_doh_ip = var["direct_dns_doh_ip"]
-	local direct_dns_doh_port = var["direct_dns_doh_port"]
-	local direct_dns_query_strategy = var["direct_dns_query_strategy"]
-	local remote_dns_udp_server = var["remote_dns_udp_server"]
-	local remote_dns_udp_port = var["remote_dns_udp_port"]
-	local remote_dns_tcp_server = var["remote_dns_tcp_server"]
-	local remote_dns_tcp_port = var["remote_dns_tcp_port"]
-	local remote_dns_doh_url = var["remote_dns_doh_url"]
-	local remote_dns_doh_host = var["remote_dns_doh_host"]
-	local remote_dns_doh_ip = var["remote_dns_doh_ip"]
-	local remote_dns_doh_port = var["remote_dns_doh_port"]
-	local remote_dns_query_strategy = var["remote_dns_query_strategy"]
-	local remote_dns_detour = var["remote_dns_detour"]
-	local remote_dns_client_ip = var["remote_dns_client_ip"]
-	local remote_dns_outbound_socks_address = var["remote_dns_outbound_socks_address"]
-	local remote_dns_outbound_socks_port = var["remote_dns_outbound_socks_port"]
-	local dns_cache = var["dns_cache"]
-	local loglevel = var["loglevel"] or "warning"
-	
+	local default_dns_udp_server = var["default_dns_udp_server"]
+	local default_dns_udp_port = var["default_dns_udp_port"]
+
+	local queryStrategy = "UseIP"
+	local dns = {
+		tag = "dns-global-direct",
+		disableCache = false,
+		disableFallback = true,
+		disableFallbackIfMatch = true,
+		queryStrategy = queryStrategy,
+		servers = {}
+	}
 	local inbounds = {}
 	local outbounds = {}
-	local dns = nil
-	local routing = nil
+	local routing = {
+		rules = {}
+	}
 
-	if dns_listen_port then
-		routing = {
-			domainStrategy = "IPOnDemand",
-			rules = {}
-		}
-	
-		dns = {
-			tag = "dns-global",
-			hosts = {},
-			disableCache = (dns_cache == "1") and false or true,
-			disableFallback = true,
-			disableFallbackIfMatch = true,
-			servers = {},
-			clientIp = (remote_dns_client_ip and remote_dns_client_ip ~= "") and remote_dns_client_ip or nil,
-		}
-	
-		local other_type_dns_proto, other_type_dns_server, other_type_dns_port
-	
-		if dns_out_tag == "remote" then
-			dns.queryStrategy = (remote_dns_query_strategy and remote_dns_query_strategy ~= "") and remote_dns_query_strategy or "UseIPv4"
-			if remote_dns_detour == "direct" then
-				dns_out_tag = "direct"
-				table.insert(outbounds, 1, {
-					tag = dns_out_tag,
-					protocol = "freedom",
-					settings = {
-						domainStrategy = (direct_dns_query_strategy and direct_dns_query_strategy ~= "") and direct_dns_query_strategy or "UseIP"
-					},
-					streamSettings = {
-						sockopt = {
-							mark = 255
-						}
-					}
-				})
-			else
-				if remote_dns_outbound_socks_address and remote_dns_outbound_socks_port then
-					table.insert(outbounds, 1, {
-						tag = dns_out_tag,
-						protocol = "socks",
-						streamSettings = {
-							network = "tcp",
-							security = "none"
-						},
-						settings = {
-							servers = {
-								{
-									address = remote_dns_outbound_socks_address,
-									port = tonumber(remote_dns_outbound_socks_port)
-								}
-							}
-						}
-					})
-				end
-			end
-
-			local _remote_dns = {
-				tag = "dns-in-remote"
+	table.insert(outbounds, {
+		tag = "direct",
+		protocol = "freedom",
+		settings = {
+			domainStrategy = queryStrategy
+		},
+		streamSettings = {
+			sockopt = {
+				mark = 255
 			}
-	
-			if remote_dns_udp_server then
-				_remote_dns.address = remote_dns_udp_server
-				_remote_dns.port = tonumber(remote_dns_udp_port) or 53
-				
-				other_type_dns_proto = "udp"
-				other_type_dns_server = remote_dns_udp_server
-				other_type_dns_port = _remote_dns.port
-			end
-	
-			if remote_dns_tcp_server then
-				_remote_dns.address = "tcp://" .. remote_dns_tcp_server .. ":" .. tonumber(remote_dns_tcp_port) or 53
-				_remote_dns.port = tonumber(remote_dns_tcp_port) or 53
-				
-				other_type_dns_proto = "tcp"
-				other_type_dns_server = remote_dns_tcp_server
-				other_type_dns_port = _remote_dns.port
-			end
-	
-			if remote_dns_doh_url and remote_dns_doh_host then
-				if remote_dns_doh_ip and remote_dns_doh_host ~= remote_dns_doh_ip and not api.is_ip(remote_dns_doh_host) then
-					dns.hosts[remote_dns_doh_host] = remote_dns_doh_ip
+		}
+	})
+
+	if default_dns_udp_server then
+		table.insert(dns.servers, {
+			tag = "default",
+			address = default_dns_udp_server,
+			port = tonumber(default_dns_udp_port) or 53,
+			queryStrategy = queryStrategy,
+		})
+	end
+
+	local direct_dns_shunt = uci:get(appname, "@global[0]", "direct_dns_shunt") or ""
+	if #direct_dns_shunt > 0 then
+		local dns_server = {}
+		string.gsub(direct_dns_shunt, '[^' .. "\r\n" .. ']+', function(w)
+			if w:find("#") == 1 then return end
+			local domain = sys.exec(string.format("echo -n $(echo %s | awk -F ' ' '{print $1}')", w))
+			local dns = sys.exec(string.format("echo -n $(echo %s | awk -F ' ' '{print $2}')", w))
+			if domain ~= "" and dns ~= "" then
+				local new_dns_server = parseDNS(dns)
+				if new_dns_server then
+					if not dns_server[dns] then
+						dns_server[dns] = {}
+					end
+					dns_server[dns].tag = dns
+					dns_server[dns].queryStrategy = queryStrategy
+					dns_server[dns].address = new_dns_server.address
+					dns_server[dns].port = new_dns_server.port
+					dns_server[dns].finalQuery = true
+					if not dns_server[dns].domains then
+						dns_server[dns].domains = {}
+					end
+					table.insert(dns_server[dns].domains, domain)
 				end
-				_remote_dns.address = remote_dns_doh_url
-				_remote_dns.port = tonumber(remote_dns_doh_port) or 443
 			end
-	
-			table.insert(dns.servers, _remote_dns)
-		elseif dns_out_tag == "direct" then
-			dns.queryStrategy = (direct_dns_query_strategy and direct_dns_query_strategy ~= "") and direct_dns_query_strategy or "UseIP"
-			table.insert(outbounds, 1, {
-				tag = dns_out_tag,
-				protocol = "freedom",
-				settings = {
-					domainStrategy = dns.queryStrategy
+		end)
+		for k, v in pairs(dns_server) do
+			table.insert(dns.servers, v)
+			table.insert(routing.rules, {
+				inboundTag = {
+					v.tag
 				},
-				streamSettings = {
-					sockopt = {
-						mark = 255
-					}
-				}
+				outboundTag = "direct"
 			})
-
-			local _direct_dns = {
-				tag = "dns-in-direct"
-			}
-	
-			if direct_dns_udp_server then
-				_direct_dns.address = direct_dns_udp_server
-				_direct_dns.port = tonumber(direct_dns_udp_port) or 53
-				table.insert(routing.rules, 1, {
-					ip = {
-						direct_dns_udp_server
-					},
-					port = tonumber(direct_dns_udp_port) or 53,
-					network = "udp",
-					outboundTag = "direct"
-				})
-
-				other_type_dns_proto = "udp"
-				other_type_dns_server = direct_dns_udp_server
-				other_type_dns_port = _direct_dns.port
-			end
-	
-			if direct_dns_tcp_server then
-				_direct_dns.address = "tcp+local://" .. direct_dns_tcp_server
-				_direct_dns.port = tonumber(direct_dns_tcp_port) or 53
-				
-				other_type_dns_proto = "tcp"
-				other_type_dns_server = direct_dns_tcp_server
-				other_type_dns_port = _direct_dns.port
-			end
-	
-			if direct_dns_doh_url and direct_dns_doh_host then
-				if direct_dns_doh_ip and direct_dns_doh_host ~= direct_dns_doh_ip and not api.is_ip(direct_dns_doh_host) then
-					dns.hosts[direct_dns_doh_host] = direct_dns_doh_ip
-				end
-				_direct_dns.address = direct_dns_doh_url:gsub("https://", "https+local://")
-				_direct_dns.port = tonumber(direct_dns_doh_port) or 443
-			end
-	
-			table.insert(dns.servers, _direct_dns)
 		end
-	
-		local dns_hosts_len = 0
-		for key, value in pairs(dns.hosts) do
-			dns_hosts_len = dns_hosts_len + 1
-		end
-	
-		if dns_hosts_len == 0 then
-			dns.hosts = nil
-		end
-	
-		table.insert(inbounds, {
-			listen = "127.0.0.1",
-			port = tonumber(dns_listen_port),
-			protocol = "dokodemo-door",
-			tag = "dns-in",
-			settings = {
-				address = other_type_dns_server or "1.1.1.1",
-				port = other_type_dns_port or 53,
-				network = "tcp,udp"
-			}
-		})
-	
-		table.insert(outbounds, {
-			tag = "dns-out",
-			protocol = "dns",
-			proxySettings = {
-				tag = dns_out_tag
-			},
-			settings = {
-				address = other_type_dns_server or "1.1.1.1",
-				port = other_type_dns_port or 53,
-				network = other_type_dns_proto or "tcp",
-				nonIPQuery = "reject"
-			}
-		})
-	
-		table.insert(routing.rules, 1, {
-			inboundTag = {
-				"dns-in"
-			},
-			outboundTag = "dns-out"
-		})
-	
-		table.insert(routing.rules, {
-			inboundTag = {
-				"dns-global"
-			},
-			outboundTag = dns_out_tag
-		})
 	end
-	
-	if inbounds or outbounds then
-		local config = {
-			log = {
-				--dnsLog = true,
-				loglevel = loglevel
-			},
-			dns = dns,
-			inbounds = inbounds,
-			outbounds = outbounds,
-			routing = routing
+
+	if direct_dns_udp_server then
+		local node_domain = {}
+		local nodes_domain_text = sys.exec('uci show passwall2 | grep ".address=" | cut -d "\'" -f 2 | grep "[a-zA-Z]$" | sort -u')
+		string.gsub(nodes_domain_text, '[^' .. "\r\n" .. ']+', function(w)
+			table.insert(node_domain, "full:" .. w)
+		end)
+		if #node_domain > 0 then
+			table.insert(dns.servers, {
+				tag = "direct",
+				address = direct_dns_udp_server,
+				port = tonumber(direct_dns_udp_port) or 53,
+				queryStrategy = queryStrategy,
+				domains = node_domain
+			})
+		end
+	end
+
+	table.insert(inbounds, {
+		tag = "dns-in",
+		listen = "127.0.0.1",
+		port = tonumber(dns_listen_port),
+		protocol = "dokodemo-door",
+		settings = {
+			address = "0.0.0.0",
+			network = "tcp,udp"
 		}
-		return jsonc.stringify(config, 1)
-	end
-	
+	})
+
+	table.insert(outbounds, {
+		tag = "dns-out",
+		protocol = "dns",
+		proxySettings = {
+			tag = "direct"
+		},
+		settings = {
+			address = direct_dns_udp_server,
+			port = tonumber(direct_dns_udp_port) or 53,
+			network = "udp",
+			nonIPQuery = "skip",
+			blockTypes = {
+				65
+			}
+		}
+	})
+
+	table.insert(routing.rules, {
+		inboundTag = {
+			"dns-in"
+		},
+		outboundTag = "dns-out"
+	})
+
+	local config = {
+		log = {
+			dnsLog = true,
+			loglevel = "debug"
+		},
+		dns = dns,
+		inbounds = inbounds,
+		outbounds = outbounds,
+		routing = routing
+	}
+	return jsonc.stringify(config, 1)
 end
 
 _G.gen_config = gen_config
+_G.gen_front_dns_config = gen_front_dns_config
 _G.gen_proto_config = gen_proto_config
-_G.gen_dns_config = gen_dns_config
 
 if arg[1] then
 	local func =_G[arg[1]]

luci-app-passwall2/po/fa/passwall2.po

@@ -121,6 +121,12 @@ msgstr "0 به معنای عدم استفاده است"
 msgid "Current node: %s"
 msgstr "گره فعلی: %s"
 
+msgid "Direct domain DNS routing"
+msgstr "مسیریابی مستقیم DNS دامنه"
+
+msgid "Please note that the program will not start if the format is incorrect!"
+msgstr "لطفا توجه داشته باشید که اگر قالب نادرست باشد، برنامه شروع نخواهد شد!"
+
 msgid "IP:Port mode acceptable, multi value split with english comma."
 msgstr "حالت IP:Port قابل قبول است، مقادیر متعدد را با کاما انگلیسی جدا کنید."
 

luci-app-passwall2/po/ru/passwall2.po

@@ -118,6 +118,12 @@ msgstr "0 — отключить функцию"
 msgid "Current node: %s"
 msgstr "Текущий узел: %s"
 
+msgid "Direct domain DNS routing"
+msgstr "Прямая маршрутизация DNS домена"
+
+msgid "Please note that the program will not start if the format is incorrect!"
+msgstr "Обратите внимание, что программа не запустится, если формат указан неверно!"
+
 msgid "IP:Port mode acceptable, multi value split with english comma."
 msgstr "Допустим формат IP:Port. Несколько значений указывайте через запятую."
 

luci-app-passwall2/po/zh-cn/passwall2.po

@@ -118,6 +118,12 @@ msgstr "0为不使用"
 msgid "Current node: %s"
 msgstr "当前节点：%s"
 
+msgid "Direct domain DNS routing"
+msgstr "直连域名 DNS 分流"
+
+msgid "Please note that the program will not start if the format is incorrect!"
+msgstr "请注意，格式不正确将无法启动！"
+
 msgid "IP:Port mode acceptable, multi value split with english comma."
 msgstr "接受 IP:Port 形式的输入，多个以英文逗号分隔。"
 

luci-app-passwall2/po/zh-tw/passwall2.po

@@ -118,6 +118,12 @@ msgstr "0為不使用"
 msgid "Current node: %s"
 msgstr "當前節點：%s"
 
+msgid "Direct domain DNS routing"
+msgstr "直連網域 DNS 分流"
+
+msgid "Please note that the program will not start if the format is incorrect!"
+msgstr "請注意，格式不正確將無法啟動！"
+
 msgid "IP:Port mode acceptable, multi value split with english comma."
 msgstr "接受 IP:Port 形式的輸入，多個以英文逗号分隔。"
 

luci-app-passwall2/root/usr/share/passwall2/app.sh

@@ -106,14 +106,6 @@ run_xray() {
 	[ -n "$dns_listen_port" ] && {
 		json_add_string "dns_listen_port" "${dns_listen_port}"
 		[ -n "$dns_cache" ] && json_add_string "dns_cache" "${dns_cache}"
-
-		local _dns=$(get_first_dns AUTO_DNS 53 | sed 's/#/:/g')
-		local _dns_address=$(echo ${_dns} | awk -F ':' '{print $1}')
-		local _dns_port=$(echo ${_dns} | awk -F ':' '{print $2}')
-
-		DIRECT_DNS_UDP_SERVER=${_dns_address}
-		DIRECT_DNS_UDP_PORT=${_dns_port}
-
 		[ "${node_protocol}" = "_shunt" ] && local write_ipset_direct=$(config_n_get $node write_ipset_direct 0)
 		[ "${write_ipset_direct}" = "1" ] && {
 			direct_dnsmasq_listen_port=$(get_new_port $(expr $dns_listen_port + 1) udp)
@@ -188,38 +180,17 @@ run_xray() {
 		[ -n "$remote_dns_client_ip" ] && json_add_string "remote_dns_client_ip" "${remote_dns_client_ip}"
 		local _json2_arg="$(json_dump)"
 
-		local independent_dns
-		if [ -z "${independent_dns}" ]; then
-			local _json2_keys key
-			json_load "${_json2_arg}"
-			json_get_keys _json2_keys
-			for key in ${_json2_keys}; do
-				json_get_var "_json2_$key" "$key"
-			done
-			json_load "${_json1_arg}"
-			for key in ${_json2_keys}; do
-				eval "local _v=\$_json2_$key"
-				json_add_string "$key" "$_v"
-			done
-		else
-			dns_remote_listen_port=$(get_new_port $(expr ${direct_dnsmasq_listen_port:-${dns_listen_port}} + 1) udp)
-			V2RAY_DNS_REMOTE_CONFIG="${TMP_PATH}/${flag}_dns_remote.json"
-			V2RAY_DNS_REMOTE_LOG="${TMP_PATH}/${flag}_dns_remote.log"
-			V2RAY_DNS_REMOTE_LOG="/dev/null"
-			json_load "${_json2_arg}"
-			json_add_string "dns_out_tag" "remote"
-			json_add_string "dns_listen_port" "${dns_remote_listen_port}"
-			json_add_string "remote_dns_outbound_socks_address" "127.0.0.1"
-			json_add_string "remote_dns_outbound_socks_port" "${socks_port}"
-			_json2_arg="$(json_dump)"
-			lua $UTIL_XRAY gen_dns_config "${_json2_arg}" > $V2RAY_DNS_REMOTE_CONFIG
-			ln_run "$XRAY_BIN" "xray" $V2RAY_DNS_REMOTE_LOG run -c "$V2RAY_DNS_REMOTE_CONFIG"
-
-			json_load "${_json1_arg}"
-			json_add_string "remote_dns_udp_port" "${dns_remote_listen_port}"
-			json_add_string "remote_dns_udp_server" "127.0.0.1"
-			json_add_string "remote_dns_query_strategy" "${remote_dns_query_strategy}"
-		fi
+		local _json2_keys key
+		json_load "${_json2_arg}"
+		json_get_keys _json2_keys
+		for key in ${_json2_keys}; do
+			json_get_var "_json2_$key" "$key"
+		done
+		json_load "${_json1_arg}"
+		for key in ${_json2_keys}; do
+			eval "local _v=\$_json2_$key"
+			json_add_string "$key" "$_v"
+		done
 	}
 
 	[ -n "${redir_port}" ] && {
@@ -290,13 +261,6 @@ run_singbox() {
 		}
 	}
 	[ -n "$dns_listen_port" ] && {
-		local _dns=$(get_first_dns AUTO_DNS 53 | sed 's/#/:/g')
-		local _dns_address=$(echo ${_dns} | awk -F ':' '{print $1}')
-		local _dns_port=$(echo ${_dns} | awk -F ':' '{print $2}')
-
-		DIRECT_DNS_UDP_SERVER=${_dns_address}
-		DIRECT_DNS_UDP_PORT=${_dns_port}
-
 		[ "${node_protocol}" = "_shunt" ] && local write_ipset_direct=$(config_n_get $node write_ipset_direct 0)
 		[ "${write_ipset_direct}" = "1" ] && {
 			direct_dnsmasq_listen_port=$(get_new_port $(expr $dns_listen_port + 1) udp)
@@ -633,8 +597,6 @@ run_global() {
 	TYPE=$(echo $(config_n_get $NODE type) | tr 'A-Z' 'a-z')
 	[ -z "$TYPE" ] && return 1
 
-	mkdir -p ${GLOBAL_ACL_PATH}
-
 	if [ $PROXY_IPV6 == "1" ]; then
 		log_i18n 0 "To enable experimental IPv6 transparent proxy (TProxy), please ensure your node and type support IPv6!"
 	fi
@@ -712,8 +674,62 @@ run_global() {
 		return 1
 	fi
 
+	set_cache_var "ACL_GLOBAL_node" "$NODE"
+	set_cache_var "ACL_GLOBAL_redir_port" "$REDIR_PORT"
+}
+
+run_front_dns() {
+	local switch=0
+	direct_dns_shunt=$(config_t_get global direct_dns_shunt)
+	direct_dns_shunt=$(echo "${direct_dns_shunt}" | grep -v "^#")
+	[ -n "${direct_dns_shunt}" ] && switch=1
+	[ "${switch}" == "1" ] && {
+		local config_file="${TMP_PATH}/direct_dns.json"
+		local log_file="${TMP_PATH}/direct_dns.log"
+		log_file="/dev/null"
+		local listen_port=$(get_new_port 10553)
+		json_init
+		json_add_string "dns_listen_port" "${listen_port}"
+		json_add_string "direct_dns_udp_server" "${DIRECT_DNS_UDP_SERVER}"
+		json_add_string "direct_dns_udp_port" "${DIRECT_DNS_UDP_PORT}"
+		json_add_string "direct_dns_query_strategy" "${DIRECT_DNS_QUERY_STRATEGY}"
+		[ -n "${ACL_GLOBAL_node}" ] && [ -n "${TUN_DNS_PORT}" ] && {
+			json_add_string "default_dns_udp_server" "127.0.0.1"
+			json_add_string "default_dns_udp_port" "${TUN_DNS_PORT}"
+		}
+		local _json_arg="$(json_dump)"
+
+		local preferred_core=""
+		[ -n "${XRAY_BIN}" ] && preferred_core="xray"
+		[ -n "${SINGBOX_BIN}" ] && preferred_core="sing-box"
+
+		if [ "${preferred_core}" = "xray" ]; then
+			lua $UTIL_XRAY gen_front_dns_config "${_json_arg}" > $config_file
+			ln_run "$XRAY_BIN" "xray" "${log_file}" run -c "$config_file"
+		elif [ "${preferred_core}" = "sing-box" ]; then
+			lua $UTIL_SINGBOX gen_front_dns_config "${_json_arg}" > $config_file
+			ln_run "$SINGBOX_BIN" "sing-box" "${log_file}" run -c "$config_file"
+		else
+			return 1
+		fi
+
+		FRONT_DNS_SERVER="127.0.0.1"
+		FRONT_DNS_PORT="${listen_port}"
+	}
+}
+
+run_global_dnsmasq() {
+	[ -z "${ACL_GLOBAL_node}" ] && [ -z "${FRONT_DNS_PORT}" ] && return
 	local RUN_NEW_DNSMASQ=1
 	RUN_NEW_DNSMASQ=${DNS_REDIRECT}
+	DNSMASQ_DEFAULT_DNS="${AUTO_DNS}"
+	DNSMASQ_LOCAL_DNS="${LOCAL_DNS:-${AUTO_DNS}}"
+	DNSMASQ_TUN_DNS="${TUN_DNS}"
+	[ -n "${FRONT_DNS_PORT}" ] && {
+		DNSMASQ_DEFAULT_DNS="${FRONT_DNS_SERVER}#${FRONT_DNS_PORT}"
+		DNSMASQ_LOCAL_DNS="${DNSMASQ_DEFAULT_DNS}"
+		DNSMASQ_TUN_DNS="${DNSMASQ_DEFAULT_DNS}"
+	}
 	if [ "${RUN_NEW_DNSMASQ}" == "0" ]; then
 		#The old logic will be removed in the future.
 		#Run a copy dnsmasq instance, DNS hijack that don't need a proxy devices.
@@ -738,9 +754,9 @@ run_global() {
 		json_add_string "FLAG" "default"
 		json_add_string "TMP_DNSMASQ_PATH" "${GLOBAL_DNSMASQ_CONF_PATH}"
 		json_add_string "DNSMASQ_CONF_FILE" "${GLOBAL_DNSMASQ_CONF}"
-		json_add_string "DEFAULT_DNS" "${AUTO_DNS}"
-		json_add_string "LOCAL_DNS" "${LOCAL_DNS:-${AUTO_DNS}}"
-		json_add_string "TUN_DNS" "${TUN_DNS}"
+		json_add_string "DEFAULT_DNS" "${DNSMASQ_DEFAULT_DNS}"
+		json_add_string "LOCAL_DNS" "${DNSMASQ_LOCAL_DNS}"
+		json_add_string "TUN_DNS" "${DNSMASQ_TUN_DNS}"
 		json_add_string "NFTFLAG" "${nftflag:-0}"
 		json_add_string "NO_LOGIC_LOG" "${NO_LOGIC_LOG:-0}"
 		lua $APP_PATH/helper_dnsmasq.lua add_rule "$(json_dump)"
@@ -753,14 +769,11 @@ run_global() {
 	else
 		#Run a copy dnsmasq instance, DNS hijack for that need proxy devices.
 		GLOBAL_DNSMASQ_PORT=$(get_new_port 11400)
-		run_copy_dnsmasq flag="default" listen_port=$GLOBAL_DNSMASQ_PORT tun_dns="${TUN_DNS}"
+		run_copy_dnsmasq flag="default" listen_port=$GLOBAL_DNSMASQ_PORT tun_dns="${DNSMASQ_TUN_DNS}"
 		DNS_REDIRECT_PORT=${GLOBAL_DNSMASQ_PORT}
 		#dhcp.leases to hosts
 		$APP_PATH/lease2hosts.sh > /dev/null 2>&1 &
 	fi
-
-	set_cache_var "ACL_GLOBAL_node" "$NODE"
-	set_cache_var "ACL_GLOBAL_redir_port" "$REDIR_PORT"
 }
 
 start_socks() {
@@ -1188,7 +1201,10 @@ start() {
 			lua $APP_PATH/helper_dnsmasq.lua restart "$(json_dump)"
 		}
 	fi
+	mkdir -p ${GLOBAL_ACL_PATH}
 	[ "$ENABLED_DEFAULT_ACL" == 1 ] && run_global
+	run_front_dns
+	run_global_dnsmasq
 	[ -n "$USE_TABLES" ] && source $APP_PATH/${USE_TABLES}.sh start
 	set_cache_var "USE_TABLES" "$USE_TABLES"
 	if [ "$ENABLED_DEFAULT_ACL" == 1 ] || [ "$ENABLED_ACLS" == 1 ]; then
@@ -1312,6 +1328,12 @@ get_config() {
 	[ -z "${DEFAULT_DNS}" ] && DEFAULT_DNS=$(echo -n $ISP_DNS | tr ' ' '\n' | head -2 | tr '\n' ',' | sed 's/,$//')
 	AUTO_DNS=${DEFAULT_DNS:-119.29.29.29}
 
+	local AUTO_DNS2=$(get_first_dns AUTO_DNS 53 | sed 's/#/:/g')
+	local AUTO_DNS_ADDRESS=$(echo ${AUTO_DNS2} | awk -F ':' '{print $1}')
+	local AUTO_DNS_PORT=$(echo ${AUTO_DNS2} | awk -F ':' '{print $2}')
+	DIRECT_DNS_UDP_SERVER=${AUTO_DNS_ADDRESS}
+	DIRECT_DNS_UDP_PORT=${AUTO_DNS_PORT}
+
 	DNSMASQ_CONF_DIR=/tmp/dnsmasq.d
 	DEFAULT_DNSMASQ_CFGID="$(uci -q show "dhcp.@dnsmasq[0]" | awk 'NR==1 {split($0, conf, /[.=]/); print conf[2]}')"
 	if [ -f "/tmp/etc/dnsmasq.conf.$DEFAULT_DNSMASQ_CFGID" ]; then