From e501b93d65cc136cbf1e27dc8feddaf3cb8be4c1 Mon Sep 17 00:00:00 2001 From: windyboy Date: Wed, 12 Aug 2026 21:38:57 +0800 Subject: [PATCH] docs(dns): correct gfw/.1 facts (W1N-56) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - hosts/gfw.windy.lan.md: 3 NICs (eth2/VLAN10 ubunt_upg live), mosdns is now OpenClash's nameserver (not idle), rewrite VLAN10 Wi-Fi section to live-verified state - docs/lan-dns-architecture.md: mosdns on gfw no longer 闲置; note the recommended AGH+.36 companion architecture is still pending review --- docs/lan-dns-architecture.md | 7 +++++-- hosts/gfw.windy.lan.md | 35 ++++++++++++++++++++--------------- 2 files changed, 25 insertions(+), 17 deletions(-) diff --git a/docs/lan-dns-architecture.md b/docs/lan-dns-architecture.md index 6d6a847..81db042 100644 --- a/docs/lan-dns-architecture.md +++ b/docs/lan-dns-architecture.md @@ -1,6 +1,9 @@ # 内网 DNS 架构调研与优化建议 > 状态:2026-08-12 调研,Linear **W1N-56**。基于网络工程师视角,方案待实施评审。 +> 2026-08-12 现场核查修正:gfw 上 mosdns 已并入 OpenClash DNS 链(作为 clash 的 +> `nameserver`,DIRECT 规则真实 IP 解析用),**不再闲置**;推荐方案(AGH 前端 + +> `.36` 伴生 mosdns 后端)仍待评审落地。 > 相关:`docs/lan-overview.md`、`hosts/dns.windy.lan.md`、`hosts/gfw.windy.lan.md`。 ## 1. 现状(实测) @@ -8,10 +11,10 @@ | 角色 | 部署 | 职责 | 是否在活动路径 | |------|------|------|----------------| | **AdGuard Home** | `192.168.66.36`(PVE VM 120,Docker host 网络) | EdgeRouter DHCP 通告给 LAN55/66 客户端的 DNS;广告/过滤、查询统计、Web 面板 | ✅ **是** | -| **mosdns** | `192.168.66.1`(gfw OpenWrt)监听 `127.0.0.1:6052` | 无(DNS 分流器) | ❌ 闲置 | +| **mosdns** | `192.168.66.1`(gfw OpenWrt)监听 `127.0.0.1:6052` | OpenClash custom DNS 的 `nameserver`(DIRECT 规则真实 IP 分流:国内→AGH `.36`,国外→国内公网 DNS `223.5.5.5`/`119.29.29.29`) | ✅ 网关侧(clash 消费,不面向客户端) | | **OpenClash / clash(meta)** | `192.168.66.1`(gfw) | gateway 自身/被劫持流量的 fake-ip + 代理,DNS 走 dnsmasq→clash `#7874` | 仅网关侧 | -**关键事实:** LAN 客户端 DNS 直连 `66.36`,**不经过** gfw(EdgeRouter `service dns forwarding` cache 512,通告 `.36`)。所以 gfw/clash 的 fake-ip 分流对"直连 AGH 的客户端"不起作用;mosdns 目前完全闲置。 +**关键事实:** LAN 客户端 DNS 直连 `66.36`,**不经过** gfw(EdgeRouter `service dns forwarding` cache 512,通告 `.36`)。所以 gfw/clash 的 fake-ip 分流对"直连 AGH 的客户端"不起作用;gfw 上 mosdns 作为 clash 的 `nameserver` 供 DIRECT 规则连接的真实 IP 解析用(国内→AGH,国外→国内公网 DNS),不面向 LAN 客户端。 **现状缺口:** 1. AGH 上游是**固定 DoH**(alidns/doh.pub,兜底 adg.chans.xyz),**没有"国内/国外分流"能力** → 国外域名解析易受 DNS 污染/时延差,也无法为不同 region 选最优上游。 diff --git a/hosts/gfw.windy.lan.md b/hosts/gfw.windy.lan.md index 729e9a1..602e30d 100644 --- a/hosts/gfw.windy.lan.md +++ b/hosts/gfw.windy.lan.md @@ -8,7 +8,7 @@ | IPv4 | `192.168.66.1` | | SSH | `ssh -4 root@192.168.66.1` (key-only, verified 2026-08-06) | | OS | ImmortalWrt 25.12.0 (r37854), Linux `6.12.87`, x86/64 | -| **Host** | **PVE VM 140 (`gfw`)** — dual NIC: `net0`→vmbr0(LAN66), `net1`→vmbr1(LAN55) (verified 2026-08-09) | +| **Host** | **PVE VM 140 (`gfw`)** — 3 NICs: `net0`→vmbr0(LAN66/eth0), `net1`→vmbr1(LAN55/eth1, up but unaddressed), `net2`→VLAN10/`ubunt_upg`(eth2, `192.168.10.1/24`) (topology 2026-08-09; eth2/VLAN10 live verified 2026-08-11) | Do not store the root password in this repository. @@ -25,8 +25,11 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration - Mode: **fake-ip + TPROXY transparent proxy** (`operation_mode=fake-ip`, `en_mode=fake-ip`, `proxy_mode=rule`); fake-ip network `198.18.0.0/16` - DNS path: dnsmasq → clash DNS `127.0.0.1#7874` (`server=127.0.0.1#7874` in - dnsmasq config); `mosdns` also listens on `127.0.0.1:6052` but is not the - active resolver path + dnsmasq config); OpenClash custom DNS uses `mosdns` on `127.0.0.1:6052` as its + `nameserver`/`default-nameserver` for DIRECT-rule real-IP resolution + (`/etc/mosdns/config.yaml`): domestic domains → AGH `.36:53`, foreign → + `223.5.5.5`/`119.29.29.29` (Chinese public DNS). mosdns is **not** in the + client query path — LAN/VLAN10 clients receive fake-ip from clash :7874. - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused) @@ -43,20 +46,22 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration `8443` is not an OpenClash listener and has no runtime nftables forwarding rule. It is included only in OpenClash's common TLS-sniffing port list. -## VLAN 10 Wi-Fi feasibility +## VLAN 10 Wi-Fi -`gfw` is a VM attached to untagged LAN 66, rather than a physical VLAN-trunk -endpoint. The U6 Lite likewise reaches the ER-X over LAN 66, whose DHCP -service supplies client addresses. Therefore `gfw` cannot currently receive an -SSID's VLAN 10 traffic merely by creating an `eth0.10` interface inside the VM. +`gfw`'s third NIC `eth2` hosts the `ubunt_upg` interface at `192.168.10.1/24`, +serving the dedicated `ubnt-upg` SSID VLAN 10 (untagged access path from a +VLAN-capable switch/trunk; AP management stays untagged on LAN66). The +`ubunt_upg` zone runs the **only** DHCP server for `192.168.10.0/24` (UDP/67), +allows DNS (53), and applies `192.168.10.0/24 → eth0 masquerade` (NAT) for +Internet egress. `forward_ubunt_upg` isolates VLAN10 from LAN66/55 and RFC1918 +(deny counters 0, `accept_to_lan` passes). -Do not treat a local `eth0.10`/`192.168.10.1` configuration as a deployable -Wi-Fi gateway unless the hypervisor/vSwitch and the complete physical path to -the AP have first been configured and verified to carry tagged VLAN 10. The -`ubnt-upg` test receiving a `192.168.66.x` lease was the expected consequence -of the available untagged path, not evidence that this host should compete -with ER-X DHCP. See -[UniFi Network: Dedicated Wi-Fi through a third-party gateway](../docs/unifi-network.md#dedicated-wi-fi-through-a-third-party-gateway). +Live-verified 2026-08-11: an `ubnt-upg` client received `192.168.10.168` (lease +in `/tmp/dhcp.leases`), the `192.168.10.0/24 masquerade` counter climbed +(215 pkts/42KB), and the LAN55/LAN66 deny counters stayed 0 → VLAN10→LAN +isolation holds. See +[docs/lan-se5420-deployment-guide.md](../docs/lan-se5420-deployment-guide.md), +[docs/unifi-openwrt-vlan10-implementation-examples.md](../docs/unifi-openwrt-vlan10-implementation-examples.md) ## Operational note