update 2026-07-15 14:09:58

dae/files/config.d/dns.dae

@@ -0,0 +1,25 @@
+# dns.dae
+dns {
+    optimistic_cache_ttl: 86400
+    max_cache_size: 4096
+    upstream {
+        localdns: 'udp://127.0.0.1:53'
+        overseadns: 'tcp+udp://1.0.0.1:53'
+        nodedns: 'udp://111.222.333.444:53'
+    }
+    routing {
+        request {
+            sub(sub_name) -> overseadns
+            subnode(sub_name) && subnode(name_keyword: 114514) -> nodedns
+            qtype(https) -> reject
+            qname(geosite:gfw) -> overseadns
+            fallback: localdns
+        }
+        response {
+            upstream(overseadns) -> accept
+            qname(geosite:private) -> accept
+            ip(geoip:cn) -> accept
+            fallback: overseadns
+        }
+    }
+}

dae/files/config.d/node.dae

@@ -0,0 +1,19 @@
+# node.dae
+node {
+    node1: 'xxx'
+    node2: 'xxx'
+}
+subscription {
+    my_sub: 'https://www.example.com/subscription/link'
+}
+group {
+    my_group {
+        filter: subtag(my_sub) && !name(keyword: 'ExpireAt:')
+        filter: subtag(my_sub2)
+        policy: min_moving_avg
+    }
+    local_group {
+        filter: name(node1, node2)
+        policy: fixed(0)
+    }
+}

dae/files/config.d/route.dae

@@ -0,0 +1,22 @@
+# route.dae
+routing {
+    pname(dnsmasq, zerotier-one) -> must_direct
+    dip(224.0.0.0/3, 'ff00::/8', geoip:private) -> direct
+
+    domain(geosite:category-bank-cn, geosite:boc@!cn, geosite:synology) -> direct
+
+    domain(geosite:category-ai-!cn, geosite:google, geosite:category-entertainment, geosite:gfw, geosite:github, geosite:spotify) && l4proto(udp) && dport(443) -> block
+
+    domain(geosite:spotify) -> proxy
+    domain(geosite:category-entertainment) -> proxy
+    domain(geosite:category-ai-!cn, geosite:google, geosite:github) -> proxy
+    domain(geosite:gfw) -> proxy
+
+    dip(geoip:telegram) -> proxy
+
+    dip(geoip:cn) -> direct
+
+    l4proto(udp) && dport(443) -> block
+
+    fallback: proxy
+}

dae/files/config.dae

@@ -0,0 +1,18 @@
+# config.dae
+# load all dae files placed in ./config.d/
+include {
+    config.d/*.dae
+}
+global {
+    log_level:warn
+    check_interval:600s
+    check_tolerance:20ms
+    lan_interface:"br-lan"
+    wan_interface:auto
+    auto_config_kernel_parameter:true
+    sniffing_timeout:300ms
+    udp_check_dns: "dns.google:53,8.8.8.8,2001:4860:4860::8888"
+    tcp_check_url: "http://cp.cloudflare.com,1.1.1.1,2606:4700:4700::1111"
+    dial_mode: domain
+    allow_insecure: true
+}

dae/files/dae.init

@@ -11,13 +11,14 @@ PROG="/usr/bin/dae"
 LOG="/var/log/dae/dae.log"
 DAE_HOST_IFACE="dae0"
 DAE_PEER_IFACE="dae0peer"
-DAENETNS="/run/netns/daens"
+DAE_NETNS_NAME="daens"
+DAENETNS="/run/netns/$DAE_NETNS_NAME"
 RESOLV_DAE="/tmp/resolv.conf.dae"
 
 set_chmod_640() {
-    chmod -R 640 /etc/dae/ 2>/dev/null || true
     mkdir -p /etc/dae/config.d
     mkdir -p /var/log/dae
+    chmod -R 640 /etc/dae/ 2>/dev/null || true
 }
 
 update_cron() {
@@ -116,9 +117,9 @@ start_service() {
     [ "$enabled" -eq "1" ] || return 1
 
     config_get config_file "config" "config_file" "/etc/dae/config.dae"
-    "$PROG" validate -c "$config_file" || return 1
 
     set_chmod_640
+    "$PROG" validate -c "$config_file" || return 1
     update_cron "add"
     hijack_resolv_conf
 	cleanup_netns