windy/vps
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs(dns): record mosdns fallback hardening for AGH outage (W1N-56)

Browse Source
This commit is contained in:
windyboy
2026-08-12 22:24:54 +08:00
parent 82203038f0
commit 2fd354c2a9
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/lan-dns-architecture.md
+5
View File
@@ -37,6 +37,11 @@
且在 AGH 拦截表)经 mosdns 返回真实 IP `183.60.227.49` 而非 `0.0.0.0`。已修复(备份 且在 AGH 拦截表)经 mosdns 返回真实 IP `183.60.227.49` 而非 `0.0.0.0`。已修复(备份
`/etc/mosdns/config.yaml.bak-20260812`),修复后同一域名返回 `0.0.0.0`,taobao/google 解析 `/etc/mosdns/config.yaml.bak-20260812`),修复后同一域名返回 `0.0.0.0`,taobao/google 解析
与 clash 链均无回归。**§6 的二期示例同款缺陷已一并修正。** 与 clash 链均无回归。**§6 的二期示例同款缺陷已一并修正。**
同日追加加固:`domestic_fallback`(fallback 插件:`primary: domestic_upstream`(AGH)、
`secondary: default_upstream`(223.5.5.5/119.29.29.29)、`threshold: 500ms`)使 AGH 宕机时
DIRECT 国内真实 IP 查询回退国内公网 DNS,不再直接报错;实测:AGH 停止时缓存未命中查询由
fallback 应答(NXDOMAIN/真实 IP),AGH 恢复后主路径即时应答且拦截(`0.0.0.0`)恢复。
备份:`/etc/mosdns/config.yaml.bak-fallback-20260812`。
- AGH rewrites(实测):`hass.windy.lan`/`hass.local` → `192.168.55.11`;`dns.windy.lan` → `.36`; - AGH rewrites(实测):`hass.windy.lan`/`hass.local` → `192.168.55.11`;`dns.windy.lan` → `.36`;
`ubnt.windy.lan` → `.46`;`gfw.windy.lan` → `.1`;`nas.windy.local` → `.32`。 `ubnt.windy.lan` → `.46`;`gfw.windy.lan` → `.1`;`nas.windy.local` → `.32`。
- 拦截:仅启用 **AdGuard DNS filter**(filter_1);实测 `doubleclick.net`/`googleadservices.com` → `0.0.0.0`。 - 拦截:仅启用 **AdGuard DNS filter**(filter_1);实测 `doubleclick.net`/`googleadservices.com` → `0.0.0.0`。
hosts/gfw.windy.lan.md
+4 -2
View File
@@ -33,8 +33,10 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
> 2026-08-12: fixed missing `has_resp → accept` guard after the domestic > 2026-08-12: fixed missing `has_resp → accept` guard after the domestic
> branch in `/etc/mosdns/config.yaml` (domestic queries were double-forwarded, > branch in `/etc/mosdns/config.yaml` (domestic queries were double-forwarded,
> final answer came from CN public DNS, bypassing AGH blocking/rewrites; > final answer came from CN public DNS, bypassing AGH blocking/rewrites;
> verified via `dup.baidustatic.com` before/after). Backup: > verified via `dup.baidustatic.com` before/after); added `domestic_fallback`
> `/etc/mosdns/config.yaml.bak-20260812`. See > (fallback plugin: primary=AGH, secondary=CN public DNS, 500ms) so domestic
> DIRECT lookups survive an AGH outage. Backups:
> `config.yaml.bak-20260812` / `config.yaml.bak-fallback-20260812`. See
> [docs/lan-dns-architecture.md](../docs/lan-dns-architecture.md) §1. > [docs/lan-dns-architecture.md](../docs/lan-dns-architecture.md) §1.
- nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into
`table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused) `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)