nzhl

@wangyu17455 兄弟我试了下 ip rule

> ip rule
0: from all lookup local
9500: from all to 198.18.0.0/16 lookup 1970566510
9510: from all ipproto icmp goto 9560
9520: not from all dport 53 lookup main suppress_prefixlength 0
9530: not from all iif lo lookup 1970566510
9540: from 0.0.0.0 iif lo uidrange 0-4294967294 lookup 1970566510
9550: from 198.18.0.1 iif lo uidrange 0-4294967294 lookup 1970566510
9560: from all nop
32766: from all lookup main
32767: from all lookup default

看着

9520: not from all dport 53 lookup main suppress_prefixlength 0
这一行有点像在拦截 53 ？

Sep 16, 2022

Replied to a topic by nzhl DNS 在 Linux 上开 clash tun 模式 clash 是怎么劫持 dns 的

接上层，我其实好奇的就是这个对 DNS 的拦截是怎么做的, 因为 TUN 是 premium 的功能，只是功能开源了但是代码没开源。

我理解要拦截 DNS 有几个做法:
1. cat /etc/hosts

# Standard host addresses
127.0.0.1 localhost
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
# This host address
127.0.1.1 nzhl-manjaro

2. cat /etc/resolv.conf

# Generated by NetworkManager
nameserver 192.168.50.1 # 这是我的华硕路由器

3. 根据 5 楼的说法以及看他配置似乎确实是在监听 53 端口, 但是首先我发现 53 端口啥也没有

> sudo netstat -tlunp|grep 53
tcp 0 0 127.0.0.1:53000 0.0.0.0:* LISTEN 586/clash-core-serv
udp 0 0 0.0.0.0:34622 0.0.0.0:* 537/avahi-daemon: r
udp 0 0 224.0.0.251:5353 0.0.0.0:* 405557/chrome --ena
udp 0 0 224.0.0.251:5353 0.0.0.0:* 405557/chrome --ena
udp 0 0 224.0.0.251:5353 0.0.0.0:* 405599/chrome --typ
udp 0 0 224.0.0.251:5353 0.0.0.0:* 405599/chrome --typ
udp 0 0 0.0.0.0:5353 0.0.0.0:* 537/avahi-daemon: r
udp6 0 0 :::51972 :::* 537/avahi-daemon: r
udp6 0 0 :::5353 :::* 537/avahi-daemon: r

More replies by nzhl