From 95ec2350afcac2ef18dc6197ffc94f136f17572c Mon Sep 17 00:00:00 2001 From: windyboy Date: Thu, 13 Aug 2026 10:56:40 +0800 Subject: [PATCH] docs(dns): record mosdns foreign DoH multi-upstream redundancy (W1N-62) --- docs/lan-dns-architecture.md | 11 ++++++++--- hosts/gfw.windy.lan.md | 7 +++++++ 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/docs/lan-dns-architecture.md b/docs/lan-dns-architecture.md index 9c5e5c4..379d81b 100644 --- a/docs/lan-dns-architecture.md +++ b/docs/lan-dns-architecture.md @@ -13,11 +13,16 @@ > **重要修正(定稿)**:DoH 流量实测为 **gfw→hk2 直连,未经 clash 代理**——nft output 链 > (mangle mark/tcp redirect)计数为 0、`/proc/net/tcp` 存在到 hk2:443 的 established > 连接,路由自身 TCP 输出当前并未被 OpenClash 重定向,故"经代理访问加密 DNS"的假设不成立。 -> **最终决策:接受直连,不强行走代理**——`foreign_upstream` 唯一指向自建解析器 -> `adg.chans.xyz`(hk2),自有 VPS 直连即可达、无被墙/污染问题、DoH/TLS 已加密、应答干净, +> **最终决策:接受直连,不强行走代理**——`foreign_upstream` 以自建解析器 +> `adg.chans.xyz`(hk2)为主力,自有 VPS 直连即可达、无被墙/污染问题、DoH/TLS 已加密、应答干净, > 走代理毫无增益反而把 DNS 平面耦合进 clash;实测 kill clash 期间国外查询 0.01s 正常应答, > watchdog 自动拉起,直连使 DNS 平面独立于代理(优于过代理)。 -> 备份:`config.yaml.bak-foreign-doh-20260813-103746` / `config.yaml.bak-foreign-doh-20260813-103813`。 +> **多上游冗余(同日)**:`concurrent: 3`,新增 `https://dns.quad9.net/dns-query` 与 +> `https://dns.cloudflare.com/dns-query`(2026-08-13 本网络实测可达;`dns.quad101.net` +> TLS 握手失败已排除)——hk2 故障时仍由干净的国外 DoH 应答,最后才退化明文国内兜底。 +> 验证:google AAAA 由 hk2 的 `2607:f8b0…` 变为新上游的 `2404:6800…`,国内外/拦截/代理平面无回归。 +> 备份:`config.yaml.bak-foreign-doh-20260813-103746` / `config.yaml.bak-foreign-doh-20260813-103813` / +> `config.yaml.bak-multi-doh-20260813-105421`。 ## 1. 现状(实测 2026-08-12) diff --git a/hosts/gfw.windy.lan.md b/hosts/gfw.windy.lan.md index 5791733..27010a8 100644 --- a/hosts/gfw.windy.lan.md +++ b/hosts/gfw.windy.lan.md @@ -53,6 +53,13 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration > Kill-test: foreign queries answered during clash outage, watchdog > auto-restarted. Backups: `config.yaml.bak-foreign-doh-20260813-103746` / > `config.yaml.bak-foreign-doh-20260813-103813`. + > 2026-08-13 (W1N-62): added redundancy to `foreign_upstream` — + > `concurrent: 3`, upstreams = `adg.chans.xyz` (hk2) + `dns.quad9.net` + + > `dns.cloudflare.com` (both direct-reachable from CN, live-tested 2026-08-13; + > `dns.quad101.net` excluded — TLS handshake fails). Verified: google.com + > AAAA now `2404:6800…` (new upstream answering, was `2607:f8b0…` via hk2), + > taobao/intercept/clash-fake-ip all unchanged. Backup: + > `config.yaml.bak-multi-doh-20260813-105421`. - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)