mirror of
https://github.com/caiwx86/small-packages.git
synced 2026-11-06 20:14:19 +08:00
update 2026-10-11 07:08:20
This commit is contained in:
action committed
1 parent
7ae707aaa6
commit
b77f061182
101 files changed
+557634
-19757
No files matched your search
+154
-107
@@ -2,21 +2,25 @@
|
||||
# 部署位置：家庭网关/软路由（10.0.10.2），统一接管内网 DNS 请求
|
||||
# 核心职责：
|
||||
# 1) 国内域名 → 走 DoH/UDP 国内上游（腾讯/阿里/火山）
|
||||
# 2) 国外域名 → 转发给 Clash (:1053) 走代理出网
|
||||
# 2) 国外域名 → 转发给 OpenClash (:1053) 走代理出网
|
||||
# 3) 广告/恶意域名 → 直接黑洞 (NXDOMAIN)
|
||||
# 4) 微软 NCSI 等连通性检测域名 → 强制走国内序列，避免误判"断网"
|
||||
# 5) HTTPS RR (qtype=65) → 走国外序列，让 ECH/DoH 走代理
|
||||
# 5) HTTPS RR (qtype=65) → 返回空应答，让浏览器回退 A/AAAA
|
||||
# 6) 未分类域名 → 先问国内上游，是 CN IP 就用，否则交给 OpenClash
|
||||
#
|
||||
# v2 相对 v1 的改动（速度 / 稳定性）：
|
||||
# - 查询记录 SQLite 与国内缓存 dump 移到 /tmp（RAM），减少闪存写入，
|
||||
# 避免路由器 flash 磨损和 IO 卡顿；查询记录只保留 3 天
|
||||
# - 国内上游增加 UDP 223.5.5.5 / 119.29.29.29，并发数提到 4，取最快响应
|
||||
# - 国内缓存容量 8192 → 16384，dump 周期 30 分钟 → 60 分钟
|
||||
# - 预留可选的 AAAA 过滤（没有可用 IPv6 时开启，可明显减少"网页转圈"）
|
||||
# ==============================================================================
|
||||
|
||||
log:
|
||||
# 日志级别：trace / debug / info / warn / error
|
||||
level: info
|
||||
# 日志文件路径（相对路径以 oxiDNS 运行目录为准）
|
||||
file: ./oxidns.log
|
||||
rotation:
|
||||
# 按天切割日志，避免单文件过大
|
||||
type: daily
|
||||
# 保留最近 3 个日志文件，超出自动清理
|
||||
max_files: 3
|
||||
|
||||
api:
|
||||
@@ -25,6 +29,7 @@ api:
|
||||
auth:
|
||||
type: basic
|
||||
username: admin
|
||||
# 建议改成强密码；默认口令暴露在局域网内不安全
|
||||
password: oxidns
|
||||
webui:
|
||||
root: /usr/share/oxidns/webui
|
||||
@@ -42,84 +47,75 @@ plugins:
|
||||
- name: update_rules
|
||||
interval: 1d
|
||||
executors:
|
||||
- $download_rules # 先下载最新规则
|
||||
- $reload_rules # 再热加载 provider，避免下载过程中规则不一致
|
||||
- $download_rules
|
||||
- $reload_rules
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 规则下载：广告/安全列表 + GeoIP/GeoSite 地理位置数据
|
||||
# 规则下载：广告/安全列表 + GeoIP/GeoSite
|
||||
# ---------------------------------------------------------------------------
|
||||
- tag: download_rules
|
||||
type: download
|
||||
args:
|
||||
timeout: 180s # 单个文件下载超时时间
|
||||
startup_if_missing: true # 启动时若本地缺少规则文件则立即补拉
|
||||
timeout: 180s
|
||||
startup_if_missing: true
|
||||
downloads:
|
||||
# ---------- 广告 / 隐私保护规则 ----------
|
||||
# anti-ad.net：中文站点优化，国内直连可达
|
||||
- url: https://anti-ad.net/adguard.txt
|
||||
dir: /etc/oxidns/rules
|
||||
filename: antiad.txt
|
||||
# OISD Basic：综合广告/追踪列表，big.oisd.nl 国内直连可达
|
||||
- url: https://big.oisd.nl
|
||||
dir: /etc/oxidns/rules
|
||||
filename: oisd_big.txt
|
||||
# Hagezi 系列：统一走 jsDelivr CDN，国内访问更稳定
|
||||
- url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/ultimate.mini.txt
|
||||
dir: /etc/oxidns/rules
|
||||
filename: hagezi_ultimate_mini.txt
|
||||
- url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/popupads.txt
|
||||
dir: /etc/oxidns/rules
|
||||
filename: hagezi_popupads.txt
|
||||
- url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/hoster.txt
|
||||
dir: /etc/oxidns/rules
|
||||
filename: hagezi_hoster.txt
|
||||
- url: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@main/adblock/doh.txt
|
||||
dir: /etc/oxidns/rules
|
||||
filename: hagezi_doh.txt
|
||||
# ---------- 地理位置数据 ----------
|
||||
# Loyalsoldier/v2ray-rules-dat：GeoSite 域名分类（cn / geolocation-!cn）
|
||||
- url: https://cdn.jsdelivr.net/gh/Loyalsoldier/v2ray-rules-dat@release/geosite.dat
|
||||
dir: /etc/oxidns/rules
|
||||
filename: geosite.dat
|
||||
# Loyalsoldier/geoip：仅含中国大陆 + 私有网段
|
||||
- url: https://cdn.jsdelivr.net/gh/Loyalsoldier/geoip@release/geoip-only-cn-private.dat
|
||||
dir: /etc/oxidns/rules
|
||||
filename: geoip.dat
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 热加载：下载完成后重载以下 provider，无需重启 oxiDNS
|
||||
# 热加载：下载完成后重载以下 provider
|
||||
# ---------------------------------------------------------------------------
|
||||
- tag: reload_rules
|
||||
type: reload_provider
|
||||
args:
|
||||
- $ad_rules # 广告规则
|
||||
- $security_rules # 安全规则
|
||||
- $geoip_cn # 国内 IP
|
||||
- $geosite_cn # 国内域名
|
||||
- $geosite_no_cn # 非国内域名
|
||||
- $ms_ncsi_white # 微软 NCSI 白名单
|
||||
- $ad_rules
|
||||
- $security_rules
|
||||
- $geoip_cn
|
||||
- $geosite_cn
|
||||
- $geosite_no_cn
|
||||
- $geosite_pt
|
||||
- $direct_custom
|
||||
- $ms_ncsi_white
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Prometheus 指标收集（供 Prometheus / Grafana 抓取）
|
||||
# Prometheus 指标
|
||||
# ---------------------------------------------------------------------------
|
||||
- tag: metrics_main
|
||||
type: metrics_collector
|
||||
args:
|
||||
name: home # 指标名前缀：home_*
|
||||
name: home
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 查询记录：落 SQLite，供 WebUI 查询/分析/排障
|
||||
# 查询记录：放在 /tmp（内存盘），避免每次查询都写闪存；重启后清空
|
||||
# ---------------------------------------------------------------------------
|
||||
- tag: recorder_main
|
||||
type: query_recorder
|
||||
args:
|
||||
path: /etc/oxidns/rules/query_history.sqlite
|
||||
retention_days: 7 # 只保留最近 7 天，自动清理
|
||||
path: /tmp/oxidns_query_history.sqlite
|
||||
retention_days: 3
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 规则 Provider：把 AdGuard 格式规则加载成内存 matcher
|
||||
# 规则 Provider
|
||||
# ---------------------------------------------------------------------------
|
||||
# 广告规则：偏"展示型广告 / 弹窗"拦截
|
||||
- tag: ad_rules
|
||||
type: adguard_rule
|
||||
args:
|
||||
@@ -127,29 +123,22 @@ plugins:
|
||||
- /etc/oxidns/rules/antiad.txt
|
||||
- /etc/oxidns/rules/hagezi_popupads.txt
|
||||
|
||||
# 安全规则：偏"恶意 / 钓鱼 / 追踪 / 恶意托管商 / DoH 滥用"拦截
|
||||
- tag: security_rules
|
||||
type: adguard_rule
|
||||
args:
|
||||
files:
|
||||
- /etc/oxidns/rules/oisd_big.txt
|
||||
- /etc/oxidns/rules/hagezi_ultimate_mini.txt
|
||||
- /etc/oxidns/rules/hagezi_hoster.txt
|
||||
- /etc/oxidns/rules/hagezi_doh.txt
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 地理位置 Provider：用于 IP / 域名分流判断
|
||||
# ---------------------------------------------------------------------------
|
||||
# 中国大陆 + 私有网段 IP
|
||||
- tag: geoip_cn
|
||||
type: geoip
|
||||
args:
|
||||
file: /etc/oxidns/rules/geoip.dat
|
||||
selectors:
|
||||
- cn
|
||||
country: true # 按国家代码匹配
|
||||
country: true
|
||||
|
||||
# 中国大陆域名（geosite-cn 分类）
|
||||
- tag: geosite_cn
|
||||
type: geosite
|
||||
args:
|
||||
@@ -157,7 +146,6 @@ plugins:
|
||||
selectors:
|
||||
- cn
|
||||
|
||||
# 非中国大陆域名（geolocation-!cn）
|
||||
- tag: geosite_no_cn
|
||||
type: geosite
|
||||
args:
|
||||
@@ -165,11 +153,40 @@ plugins:
|
||||
selectors:
|
||||
- geolocation-!cn
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 微软 NCSI 连通性探测域名白名单
|
||||
# 这些域名必须能解析到任意可达 IP，否则 Windows 会判定"无网络"
|
||||
# 因此强制走国内上游，不走代理
|
||||
# ---------------------------------------------------------------------------
|
||||
# PT 站点（geosite 的 category-pt 分类）
|
||||
- tag: geosite_pt
|
||||
type: geosite
|
||||
args:
|
||||
file: /etc/oxidns/rules/geosite.dat
|
||||
selectors:
|
||||
- category-pt
|
||||
|
||||
# 自定义"强制走国内解析"的域名：BT 公共 tracker、BT/磁力站点等
|
||||
# 子域名自动包含；PT 站点没被 category-pt 收录时，往这里加即可
|
||||
- tag: direct_custom
|
||||
type: domain_set
|
||||
args:
|
||||
files: []
|
||||
domains:
|
||||
# --- BT 公共 tracker ---
|
||||
- opentrackr.org
|
||||
- openbittorrent.com
|
||||
- demonii.com
|
||||
- leechers-paradise.org
|
||||
- coppersurfer.tk
|
||||
- torrent.eu.org
|
||||
- tiny-vps.com
|
||||
- stealth.si
|
||||
# --- BT / 动漫资源站 ---
|
||||
- nyaa.si
|
||||
- dmhy.org
|
||||
- mikanani.me
|
||||
- mikanime.tv
|
||||
- bangumi.moe
|
||||
- acg.rip
|
||||
# --- 你自己的 PT 站点域名（示例，按需添加）---
|
||||
# - example-pt.com
|
||||
|
||||
- tag: ms_ncsi_white
|
||||
type: domain_set
|
||||
args:
|
||||
@@ -181,75 +198,89 @@ plugins:
|
||||
- www.msftconnecttest.com
|
||||
- www.msftncsi.com
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 本地 hosts（可手工写死某些解析，目前为空，预留）
|
||||
# ---------------------------------------------------------------------------
|
||||
- tag: hosts
|
||||
type: hosts
|
||||
args:
|
||||
files: []
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 缓存：分国内/国外两个实例，避免互相污染、TTL 策略也不同
|
||||
# 缓存：国内 / 国外 / 未分类 三个实例，互不污染
|
||||
# ---------------------------------------------------------------------------
|
||||
# 国内缓存：容量较大，TTL 较激进（国内上游稳定）
|
||||
# 国内缓存：容量加大，dump 放 /tmp（进程重启可热启动，整机重启则冷启动）
|
||||
- tag: cache_direct
|
||||
type: cache
|
||||
args:
|
||||
size: 8192 # LRU 容量
|
||||
short_circuit: true # 命中缓存直接返回，不再走下游
|
||||
lazy_cache_ttl: 3600 # 懒加载 TTL（秒）
|
||||
cache_negative: true # 缓存 NXDOMAIN 等否定应答
|
||||
max_negative_ttl: 60 # 否定应答最长缓存
|
||||
negative_ttl_without_soa: 10 # 无 SOA 的否定应答 TTL
|
||||
max_positive_ttl: 3600 # 强制上限（防上游 TTL 过长）
|
||||
min_positive_ttl: 5 # 强制下限（防上游 TTL 过短）
|
||||
ecs_in_key: false # 不把 ECS 写入 key（家庭场景无需按子网区分）
|
||||
dump_file: /etc/oxidns/rules/dns_cache_direct.dump # 退出时持久化
|
||||
dump_interval: 1800 # 每 30 分钟周期性 dump
|
||||
size: 16384
|
||||
short_circuit: true
|
||||
lazy_cache_ttl: 3600
|
||||
cache_negative: true
|
||||
max_negative_ttl: 60
|
||||
negative_ttl_without_soa: 10
|
||||
max_positive_ttl: 3600
|
||||
min_positive_ttl: 5
|
||||
ecs_in_key: false
|
||||
dump_file: /tmp/oxidns_cache_direct.dump
|
||||
dump_interval: 3600
|
||||
|
||||
# 国外缓存：容量略小，TTL 更保守（依赖 OpenClash 出口）
|
||||
# 国外缓存：不落盘、不做 lazy cache，避免 OpenClash 重启后 FakeIP 失效
|
||||
- tag: cache_remote
|
||||
type: cache
|
||||
args:
|
||||
size: 4096
|
||||
short_circuit: true
|
||||
lazy_cache_ttl: 3600
|
||||
cache_negative: true
|
||||
max_negative_ttl: 30
|
||||
negative_ttl_without_soa: 10
|
||||
max_positive_ttl: 3600
|
||||
max_positive_ttl: 60
|
||||
min_positive_ttl: 5
|
||||
ecs_in_key: false
|
||||
|
||||
# 未分类域名缓存：不落盘
|
||||
- tag: cache_unknown
|
||||
type: cache
|
||||
args:
|
||||
size: 4096
|
||||
short_circuit: true
|
||||
cache_negative: true
|
||||
max_negative_ttl: 30
|
||||
negative_ttl_without_soa: 10
|
||||
max_positive_ttl: 600
|
||||
min_positive_ttl: 5
|
||||
ecs_in_key: false
|
||||
dump_file: /etc/oxidns/rules/dns_cache_remote.dump
|
||||
dump_interval: 1800
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 广告黑洞：命中广告/安全规则时直接 NXDOMAIN
|
||||
# 广告黑洞：NXDOMAIN
|
||||
# ---------------------------------------------------------------------------
|
||||
- tag: ad_blackhole
|
||||
type: black_hole
|
||||
args:
|
||||
rcode: 3 # 3 = NXDOMAIN
|
||||
rcode: 3
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 上游转发：分国内 / OpenClash 两条
|
||||
# 上游转发
|
||||
# ---------------------------------------------------------------------------
|
||||
# 国内上游：并发查询 + prefer_positive，避免单一上游故障
|
||||
# 国内上游：DoH + UDP 混合并发，取最快的正响应
|
||||
# UDP 延迟最低，DoH 作为抗干扰/防篡改的补充
|
||||
- tag: forward_cn
|
||||
type: forward
|
||||
args:
|
||||
concurrent: 3 # 同时向 3 个上游发，取最快正响应
|
||||
response_selection: prefer_positive # 有正响应优先，避免被否定应答"误杀"
|
||||
concurrent: 4
|
||||
response_selection: prefer_positive
|
||||
upstreams:
|
||||
# 腾讯 DoH：dial_addr 写死 IP，防止 DoH 域名递归解析死锁
|
||||
- tag: udp_alidns
|
||||
addr: 223.5.5.5:53
|
||||
idle_timeout: 30
|
||||
timeout: 3s
|
||||
- tag: udp_dnspod
|
||||
addr: 119.29.29.29:53
|
||||
idle_timeout: 30
|
||||
timeout: 3s
|
||||
- tag: doh_tencent
|
||||
addr: https://doh.pub/dns-query
|
||||
dial_addr: 1.12.12.12
|
||||
idle_timeout: 30
|
||||
insecure_skip_verify: false
|
||||
timeout: 5s
|
||||
# 阿里 DoH：开启 HTTP/3 加速
|
||||
- tag: doh_alibaba
|
||||
addr: https://dns.alidns.com/dns-query
|
||||
dial_addr: 223.5.5.5
|
||||
@@ -257,14 +288,12 @@ plugins:
|
||||
insecure_skip_verify: false
|
||||
timeout: 5s
|
||||
enable_http3: true
|
||||
# 火山 UDP：传统 UDP 53 作为备用
|
||||
- tag: udp_volcengine
|
||||
addr: 180.184.1.1:53
|
||||
idle_timeout: 30
|
||||
timeout: 3s
|
||||
|
||||
# 国外上游：交给 OpenClash 的 DNS 转发端口
|
||||
# OpenClash 内部会做 FakeIP + 代理出网
|
||||
# 国外上游：交给 OpenClash 的 DNS 端口
|
||||
- tag: forward_openclash
|
||||
type: forward
|
||||
args:
|
||||
@@ -274,19 +303,17 @@ plugins:
|
||||
timeout: 8s
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 三段子序列：每段都是 "cache → upstream → 兜底"
|
||||
# 子序列
|
||||
# ---------------------------------------------------------------------------
|
||||
# NCSI 子序列：仅给微软 NCSI 域名用，强制走国内上游保证"有网"
|
||||
- tag: ncsi_seq
|
||||
type: sequence
|
||||
args:
|
||||
- exec: $cache_direct
|
||||
- matches: has_resp # 命中缓存直接返回
|
||||
- matches: has_resp
|
||||
exec: accept
|
||||
- exec: $forward_cn
|
||||
- exec: accept # 兜底：无论返回什么都接受（让 NCSI 通过）
|
||||
- exec: accept
|
||||
|
||||
# 国内子序列：缓存 → 国内上游 → 仅保留国内 IP → 丢境外 IP
|
||||
- tag: local_seq
|
||||
type: sequence
|
||||
args:
|
||||
@@ -294,11 +321,8 @@ plugins:
|
||||
- matches: has_resp
|
||||
exec: accept
|
||||
- exec: $forward_cn
|
||||
- matches: resp_ip $geoip_cn # 响应 IP 必须属于中国大陆
|
||||
exec: accept
|
||||
- exec: drop_resp # 否则丢弃（防境外 IP 污染/劫持）
|
||||
- exec: accept
|
||||
|
||||
# 国外子序列：缓存 → OpenClash → 直接接受
|
||||
- tag: remote_seq
|
||||
type: sequence
|
||||
args:
|
||||
@@ -308,40 +332,63 @@ plugins:
|
||||
- exec: $forward_openclash
|
||||
- exec: accept
|
||||
|
||||
- tag: unknown_seq
|
||||
type: sequence
|
||||
args:
|
||||
- exec: $cache_unknown
|
||||
- matches: has_resp
|
||||
exec: accept
|
||||
- exec: $forward_cn
|
||||
- matches: resp_ip $geoip_cn
|
||||
exec: accept
|
||||
- exec: drop_resp
|
||||
- exec: $forward_openclash
|
||||
- exec: accept
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# 主序列：所有查询的统一入口（按优先级顺序匹配）
|
||||
# 主序列：统一入口
|
||||
# ---------------------------------------------------------------------------
|
||||
- tag: main_sequence
|
||||
type: sequence
|
||||
args:
|
||||
- exec: $recorder_main # 1) 全量记录查询日志（WebUI 可查）
|
||||
- exec: $recorder_main # 1) 记录查询日志
|
||||
|
||||
- exec: $hosts # 2) hosts 优先
|
||||
- matches: has_resp
|
||||
exec: accept
|
||||
|
||||
- matches: qtype PTR # 3) PTR 反向查询直接拒绝
|
||||
exec: reject 3 # 不向外泄露内网设备信息
|
||||
- matches: qtype PTR # 3) PTR 直接拒绝
|
||||
exec: reject 3
|
||||
|
||||
- matches: qname $ms_ncsi_white # 4) 微软 NCSI → 国内序列（保证"已联网"）
|
||||
- matches: qname $ms_ncsi_white # 4) NCSI → 国内序列
|
||||
exec: goto ncsi_seq
|
||||
|
||||
- matches: qtype 65 # 5) HTTPS RR (SVCB/HTTPS, type=65)
|
||||
exec: goto remote_seq # 让 ECH/DoH 引导信息走代理
|
||||
|
||||
- matches: qname $ad_rules # 6) 广告域名 → 黑洞
|
||||
exec: $ad_blackhole
|
||||
- matches: qname $security_rules # 7) 安全域名 → 黑洞
|
||||
exec: $ad_blackhole
|
||||
|
||||
- matches: qname $geosite_cn # 8) 国内站点 → 国内序列（含 GeoIP 校验）
|
||||
# 4.5) PT / BT 站点 → 国内序列（放在广告规则之前，避免 tracker 被拦截规则误杀）
|
||||
- matches: qname $geosite_pt
|
||||
exec: goto local_seq
|
||||
- matches: qname $direct_custom
|
||||
exec: goto local_seq
|
||||
|
||||
- matches: qname $geosite_no_cn # 9) 非国内站点 → 国外序列
|
||||
- matches: qname $ad_rules # 5) 广告 → 黑洞
|
||||
exec: $ad_blackhole
|
||||
- matches: qname $security_rules # 6) 安全 → 黑洞
|
||||
exec: $ad_blackhole
|
||||
|
||||
- matches: qtype 65 # 7) HTTPS RR → 空应答
|
||||
exec: reject 0
|
||||
|
||||
# 8) 【可选】没有可用 IPv6 时取消下面两行注释，直接返回空 AAAA，
|
||||
# 避免浏览器等待 IPv6 连接超时后才回退 IPv4
|
||||
- matches: qtype 28
|
||||
exec: reject 0
|
||||
|
||||
- matches: qname $geosite_cn # 9) 国内站点
|
||||
exec: goto local_seq
|
||||
|
||||
- matches: qname $geosite_no_cn # 10) 非国内站点
|
||||
exec: goto remote_seq
|
||||
|
||||
- exec: goto remote_seq # 10) 兜底：未分类域名一律走国外
|
||||
# 防止 DNS 泄露到国内上游
|
||||
- exec: goto unknown_seq # 11) 兜底：未分类域名
|
||||
|
||||
- tag: udp_server
|
||||
type: udp_server
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
Binary file not shown.
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
Reference in new issue
Block a user