mosdns自动添加IP到ipset，供ssrp和passwall使用

[yyysuo]

最近研究了一下ipset，发现ssrp和passwall都向op和防火墙添加了ipset相关的规则，有2个ipset，whitelist和blacklist，都被使用了，并且作用是相同的，强制国内和强制代理。虽然passwall和ssrp都预先使用了其它ipset来区分国内和国外流量，但是其它ipset并不是实时动态更新的，所以可以利用mosdns添加ipset的功能，向whitelist和blacklist添加ip，实时供ssrp和passwall调用。

本人小白一个，想请教各路大神，这种使用方法可行吗，有没有什么问题？

log:
level: info
file: "/tmp/mosdns.log"

include: []

data_providers:

• tag: geoip
  file: "/usr/share/v2ray/geoip.dat"
  auto_reload: true

• tag: geosite
  file: "/usr/share/v2ray/geosite.dat"
  auto_reload: true

• tag: whitelist
  file: "/etc/mosdns/rule/whitelist.txt"
  auto_reload: true

• tag: blocklist
  file: "/etc/mosdns/rule/blocklist.txt"
  auto_reload: true

• tag: greylist
  file: "/etc/mosdns/rule/greylist.txt"
  auto_reload: true

• tag: hosts
  file: "/etc/mosdns/rule/hosts.txt"
  auto_reload: true

• tag: redirect
  file: "/etc/mosdns/rule/redirect.txt"
  auto_reload: true

• tag: local_ptr
  file: "/etc/mosdns/rule/local-ptr.txt"
  auto_reload: true

• tag: adlist
  file: "/etc/mosdns/rule/adlist.txt"
  auto_reload: true

plugins:

• tag: lazy_cache
  type: cache
  args:
  size: 20000000
  lazy_cache_ttl: 259200000

• tag: modify_ttl
  type: ttl
  args:
  minimal_ttl: 0
  maximum_ttl: 0

• tag: "forward_local"
  type: forward
  args:
  upstream:
  - addr: 10.10.10.1:8055
  bootstrap:
  - "223.5.5.5"

• tag: "forward_remote"
  type: fast_forward
  args:
  upstream:
  - addr: 10.10.10.1:5555
  enable_pipeline: false

• tag: remote_ipset
  type: ipset
  args:
  set_name4: "blacklist"
  set_name6: "blacklist6"
  mask4: "24"
  mask6: "64"

• tag: local_ipset
  type: ipset
  args:
  set_name4: "whitelist"
  set_name6: "whitelist6"
  mask4: "24"

• tag: query_is_whitelist_domain
  type: query_matcher
  args:
  domain:
  - "provider:whitelist"

• tag: query_is_blocklist_domain
  type: query_matcher
  args:
  domain:
  - "provider:blocklist"

• tag: query_is_greylist_domain
  type: query_matcher
  args:
  domain:
  - "provider:greylist"

• tag: query_is_hosts_domain
  type: hosts
  args:
  hosts:
  - "provider:hosts"

• tag: query_is_redirect_domain
  type: redirect
  args:
  rule:
  - "provider:redirect"

• tag: query_is_local_domain
  type: query_matcher
  args:
  domain:
  - "provider:geosite:cn"

• tag: query_is_non_local_domain
  type: query_matcher
  args:
  domain:
  - "provider:geosite:geolocation-!cn"

• tag: response_has_local_ip
  type: response_matcher
  args:
  ip:
  - "provider:geoip:cn"

• tag: query_is_ad_domain
  type: query_matcher
  args:
  domain:
  - "full:disable-category-ads-all.null"

• tag: match_local_ptr
  type: query_matcher
  args:
  qtype: [12]
  domain:
  - "provider:local_ptr"

• tag: match_qtype65
  type: query_matcher
  args:
  qtype: [65]

• tag: "main_sequence"
  type: "sequence"
  args:
  exec:
  - _misc_optm
  - query_is_hosts_domain
  - query_is_redirect_domain

  - if: query_is_whitelist_domain
    exec:
      - forward_local
      - modify_ttl
      - _return
  
  - if: "query_is_blocklist_domain || query_is_ad_domain || match_local_ptr || match_qtype65"
    exec:
      - _new_nxdomain_response
      - _return
  
  - lazy_cache
  
  - if: query_is_greylist_domain
    exec:
      - forward_remote
      - modify_ttl
      - _return
  
  - if: query_is_local_domain
    exec:
      - forward_local
      - modify_ttl
      - local_ipset
      - _return
  
  - if: query_is_non_local_domain
    exec:
      - _prefer_ipv4
      - forward_remote
      - modify_ttl
      - remote_ipset
      - _return
  - primary:
      - forward_local
      - if: "(! response_has_local_ip) && [_response_valid_answer]"
        exec:
          - _drop_response
    secondary:
      - _prefer_ipv4
      - forward_remote
      - modify_ttl
    fast_fallback: 200
  

servers:

• exec: main_sequence
  listeners:
  • protocol: udp
    addr: ":5454"
  • protocol: tcp
    addr: ":5454"

[milosz20222]

我来测试下，已经添加到自定义配置，v4，观察看下效果

[yyysuo]

观
你用这个新的。

log:
level: info
file: "/tmp/mosdns.log"

include: []

data_providers:

• tag: geoip
  file: "/usr/share/v2ray/geoip.dat"
  auto_reload: true

• tag: geosite
  file: "/usr/share/v2ray/geosite.dat"
  auto_reload: true

• tag: whitelist
  file: "/etc/mosdns/rule/whitelist.txt"
  auto_reload: true

• tag: blocklist
  file: "/etc/mosdns/rule/blocklist.txt"
  auto_reload: true

• tag: greylist
  file: "/etc/mosdns/rule/greylist.txt"
  auto_reload: true

• tag: hosts
  file: "/etc/mosdns/rule/hosts.txt"
  auto_reload: true

• tag: redirect
  file: "/etc/mosdns/rule/redirect.txt"
  auto_reload: true

• tag: local_ptr
  file: "/etc/mosdns/rule/local-ptr.txt"
  auto_reload: true

• tag: adlist
  file: "/etc/mosdns/rule/adlist.txt"
  auto_reload: true

plugins:

• tag: lazy_cache
  type: cache
  args:
  size: 20000000
  lazy_cache_ttl: 259200000

• tag: modify_ttl
  type: ttl
  args:
  minimal_ttl: 0
  maximum_ttl: 0

• tag: "forward_local"
  type: forward
  args:
  upstream:
  - addr: 223.5.5.5
  bootstrap:
  - "223.5.5.5"

• tag: "forward_remote"
  type: fast_forward
  args:
  upstream:
  - addr: 8.8.4.4
  enable_pipeline: false

• tag: remote_ipset
  type: ipset
  args:
  set_name4: "blacklist"
  set_name6: "blacklist6"
  mask4: "24"
  mask6: "64"

• tag: local_ipset
  type: ipset
  args:
  set_name4: "whitelist"
  set_name6: "whitelist6"
  mask4: "24"

• tag: query_is_whitelist_domain
  type: query_matcher
  args:
  domain:
  - "provider:whitelist"

• tag: query_is_blocklist_domain
  type: query_matcher
  args:
  domain:
  - "provider:blocklist"

• tag: query_is_greylist_domain
  type: query_matcher
  args:
  domain:
  - "provider:greylist"

• tag: query_is_hosts_domain
  type: hosts
  args:
  hosts:
  - "provider:hosts"

• tag: query_is_redirect_domain
  type: redirect
  args:
  rule:
  - "provider:redirect"

• tag: query_is_local_domain
  type: query_matcher
  args:
  domain:
  - "provider:geosite:cn"

• tag: query_is_non_local_domain
  type: query_matcher
  args:
  domain:
  - "provider:geosite:geolocation-!cn"

• tag: response_has_local_ip
  type: response_matcher
  args:
  ip:
  - "provider:geoip:cn"

• tag: query_is_ad_domain
  type: query_matcher
  args:
  domain:
  - "full:disable-category-ads-all.null"

• tag: match_local_ptr
  type: query_matcher
  args:
  qtype: [12]
  domain:
  - "provider:local_ptr"

• tag: match_qtype65
  type: query_matcher
  args:
  qtype: [65]

• tag: "main_sequence"
  type: "sequence"
  args:
  exec:
  - _misc_optm
  - query_is_hosts_domain
  - query_is_redirect_domain

  - if: query_is_whitelist_domain
    exec:
      - forward_local
      - modify_ttl
      - local_ipset
      - _return
  
  - if: "query_is_blocklist_domain || query_is_ad_domain || match_local_ptr || match_qtype65"
    exec:
      - _new_nxdomain_response
      - _return
  
  - lazy_cache
  
  - if: query_is_greylist_domain
    exec:
      - forward_remote
      - modify_ttl
      - remote_ipset
      - _return
  
  - if: query_is_local_domain
    exec:
      - forward_local
      - modify_ttl
      - local_ipset
      - _return
  
  - if: query_is_non_local_domain
    exec:
      - _prefer_ipv4
      - forward_remote
      - modify_ttl
      - remote_ipset
      - _return
  - primary:
      - forward_local
      - if: "(! response_has_local_ip) && [_response_valid_answer]"
        exec:
          - _drop_response
    secondary:
      - _prefer_ipv4
      - forward_remote
      - modify_ttl
      - remote_ipset
    fast_fallback: 200
  

servers:

• exec: main_sequence
  listeners:
  • protocol: udp
    addr: ":5335"
  • protocol: tcp
    addr: ":5335"

[xiaoqingfengATGH]

modns似乎不支持geosite.dat

[yyysuo]

modns似乎不支持geosite.dat

V5不支持了，sbwml大佬的luci支持按标签解包geodata为txt至指定位置。