Advanced DNS Filtering Function

[FlingCarnationProposal]

I can't seem to grasp what the Advanced DNS filtering option does. Can anyone explain?

Edit: Found this, but there is still some confusion about its behaviour:

1. What happens if a.com and b.com both have multiple IP addresses, 1 of which is shared, a.com is blocked, and an app connects to that IP address? What is the difference between normal and advanced filtering?
2. How does it ensure a 1:1 correspondence between an IP and a domain like in the situation above? What happens if more than 1 IP are shared? What if all IPs are shared between 2 or more domains? What if 2 domains only have 1 IP each, and both are the same?

[ignoramous]

What happens if a.com and b.com both have multiple IP addresses, 1 of which is shared, a.com is blocked, and an app connects to that IP address? What is the difference between normal and advanced filtering?

In normal filtering mode, if a.com and b.com have the same IP, and if a.com is blocked, then b.com would also be blocked. In Advanced filtering, that won't be the case since Rethink assigns a unique IP per domain name.

How does it ensure a 1:1 correspondence between an IP and a domain like in the situation above? What happens if more than 1 IP are shared? What if all IPs are shared between 2 or more domains? What if 2 domains only have 1 IP each, and both are the same?

All these cases are covered for, afaik. If you can understand go, please do review the code: https://github.com/celzero/firestack/blob/37b6b37c99bca4d7b549d73091e982361716f9bd/intra/dnsx/alg.go#L239

The particular technique (it was pointed out to me by someone else) is similar to rfc3089 and also used by proxifiers like V2Ray and SingBox.

---

An example a community member (link):

Rethink blocks on an IP basis. If a domain is blocked, then sites associated with that IP address are also blocked.

The advanced filtering employs the same technique already in use in EPs like V2Ray, Xray and Sing Box, called "fake DNS/IP". When advanced filtering is enabled, each domain is assigned a temporary fake IP address, while Rethink acts like a middleman to route traffic sent to each fake address back to correct ones. Since each domain gets its own unique IP address, the "different domain same IP" problem is solved.

(firewall)
a.example.com: blocked
b.example.com: allowed

(original DNS records)
A a.example.com: 11.4.5.14
A b.example.com: 11.4.5.14

(outcome)
a.example.com: blocked
b.example.com: blocked

(fake DNS/advanced filtering)
A a.example.com: 198.0.0.1
A b.example.com: 198.0.0.2

(outcome)
a.example.com: blocked
b.example.com: allowed