refine winroute#6478
Conversation
|
wfp 应该在路由查找之前，这个 pr 需要测试 |
|
似乎没有原生的 gui 能查看完整的 wfp 规则，只能 |
|
翻了下 fwpmu.h 准备补 layer ippacket，但是发现能用的 condition 有点少，那还是算了，ale layer 阻止多宿主解析应该够用了 |
46cfbff to
ed49032
Compare
|
应该只能这样了 其他进程发起系统查询要正常 xray 需要配置 dns FwpV4AddrAndMask 需要 host order，FwpV6AddrAndMask 则不需要，晚点我再检查下，应该没什么要改的了 |
|
这东西重启后保留吗 别给人整不带xray重启下系统网就断了 之前tun动防火墙也是怕这些 |
|
FWPM_SESSION_FLAG_DYNAMIC，创建的是 dynamic session，会在进程退出后清理 filter，即使没主动清理 |
|
TUN 的 DNS 泄露只是系统层面的而非应用层面的（应用指定 DNS 地址的话会被 TUN 劫持），你测过我说的那两个方法了吗 |
|
发起doh就不算泄露了吧，哪个方法，修改默认网卡dns？如果是改tun网卡dns应该和普通设置8.8.8.8没区别，系统解析不会因为某个网卡设置了内网地址就改变行为 |
|
真要测的话内容还有点多，有点懒，有六种情况，分别是开关多宿主下，默认路由的tun网卡 未配置dns，配置有效dns，配置内网dns 三种情况下是否泄露 其实就是对于win系统解析行为的猜测，测试是假设系统解析会用默认路由网卡的dns进行多宿主查询，但也没测试的必要，即使可以成功，那么要实现不泄露tun就得与dns模块绑定一起，想要简单一个tun in一个out做到不泄露就不行 网卡配置dns搭配开启wfp可以完美覆盖上面的六种测试情况，配置也可以做到一个简单tun in+一个proxy out |
|
比如 Win11 能在 WLAN 详情里开 DoH，这种的话 block 53 就没用 “多宿主解析”就直接关掉吧，不然我说的那两个方法应该也还是会漏，默认它是关的情况下你再测 |
|
前置准备：禁用多宿主，清空 http(s)_proxy env 
配置 8.8.8.8 作为 dns，有一半 
配置 gateway ipv4 作为 dns， 
从 v2n 搬的绕过大陆配置 |
|
wlan 那个设置我也找了一下，默认 dhcp 分配的吧， |
|
@LjhAUMEM 禁用“多宿主”后先重启一下电脑，以及你所说的“配置 dns”设置的是哪里？系统的还是 TUN？若假设为系统的：
配置了这个之后还要把 UDP/53 导到 DNS 出站，
|
|
上述步骤加入重启后对于设置 gateway 作为 dns 结果还是一样
tun 的，设置里其实也是动以太网那张网卡，动默认网卡感觉就没意思了 下面是配置 Details
{
"log": {
"loglevel": "warning"
},
"dns": {
"hosts": {
"dns.google": [
"8.8.8.8",
"8.8.4.4",
"2001:4860:4860::8888",
"2001:4860:4860::8844"
],
"dns.alidns.com": [
"223.5.5.5",
"223.6.6.6",
"2400:3200::1",
"2400:3200:baba::1"
],
"one.one.one.one": [
"1.1.1.1",
"1.0.0.1",
"2606:4700:4700::1111",
"2606:4700:4700::1001"
],
"1dot1dot1dot1.cloudflare-dns.com": [
"1.1.1.1",
"1.0.0.1",
"2606:4700:4700::1111",
"2606:4700:4700::1001"
],
"cloudflare-dns.com": [
"104.16.249.249",
"104.16.248.249",
"2606:4700::6810:f8f9",
"2606:4700::6810:f9f9"
],
"dns.cloudflare.com": [
"104.16.132.229",
"104.16.133.229",
"2606:4700::6810:84e5",
"2606:4700::6810:85e5"
],
"dot.pub": [
"1.12.12.12",
"120.53.53.53"
],
"doh.pub": [
"1.12.12.12",
"120.53.53.53"
],
"dns.quad9.net": [
"9.9.9.9",
"149.112.112.112",
"2620:fe::fe",
"2620:fe::9"
],
"dns.yandex.net": [
"77.88.8.8",
"77.88.8.1",
"2a02:6b8::feed:0ff",
"2a02:6b8:0:1::feed:0ff"
],
"dns.sb": [
"185.222.222.222",
"2a09::"
],
"dns.umbrella.com": [
"208.67.220.220",
"208.67.222.222",
"2620:119:35::35",
"2620:119:53::53"
],
"dns.sse.cisco.com": [
"208.67.220.220",
"208.67.222.222",
"2620:119:35::35",
"2620:119:53::53"
],
"engage.cloudflareclient.com": [
"162.159.192.1"
]
},
"servers": [
{
"address": "119.29.29.29",
"domains": [
"domain:alidns.com",
"domain:doh.pub",
"domain:dot.pub",
"domain:360.cn",
"domain:onedns.net"
],
"skipFallback": true,
"tag": "direct-dns-1"
},
{
"address": "https://cloudflare-dns.com/dns-query",
"domains": [
"geosite:google"
],
"skipFallback": true
},
{
"address": "119.29.29.29",
"domains": [
"geosite:private",
"geosite:cn"
],
"skipFallback": true,
"tag": "direct-dns-2"
},
{
"address": "119.29.29.29",
"domains": [
"full:cloudflare-dns.com"
],
"skipFallback": true
},
"https://cloudflare-dns.com/dns-query"
],
"tag": "dns-module"
},
"inbounds": [
{
"tag": "tun",
"protocol": "tun",
"sniffing": {
"enabled": false,
"destOverride": [
"http",
"tls"
],
"routeOnly": false
},
"settings": {
"name": "xray_tun",
"MTU": 9000,
"gateway": [
"172.18.0.1/30"
],
"autoSystemRoutingTable": [
"0.0.0.0/0"
,"::/0"
],
"dns": [
"172.18.0.1"
],
"autoOutboundsInterface": "auto"
}
}
],
"outbounds": [
{
"tag": "proxy",
},
{
"tag": "direct",
"protocol": "freedom"
},
{
"tag": "block",
"protocol": "blackhole"
},
{
"tag": "dns",
"protocol": "dns"
}
],
"routing": {
"domainStrategy": "AsIs",
"rules": [
{
"type": "field",
"inboundTag": [
"api"
],
"outboundTag": "api"
},
{
"port": "135,137-139,5353",
"network": "udp",
"outboundTag": "block"
},
{
"outboundTag": "block",
"ip": [
"224.0.0.0/3",
"ff00::/8"
]
},
{
"port": "53",
"outboundTag": "dns",
"process": [
"v2ray.exe",
"mihomo-windows-amd64-v1.exe",
"mihomo-windows-amd64-compatible.exe",
"mihomo-windows-amd64.exe",
"mihomo-windows-arm64.exe",
"clash.exe",
"mihomo.exe",
"hysteria.exe",
"naive.exe",
"naiveproxy.exe",
"tuic-client.exe",
"tuic.exe",
"sing-box-client.exe",
"sing-box.exe",
"juicity-client.exe",
"juicity.exe",
"hysteria-windows-amd64.exe",
"hysteria-linux-amd64.exe",
"brook_windows_amd64.exe",
"brook_linux_amd64.exe",
"brook.exe",
"overtls-bin.exe",
"overtls.exe",
"shadowquic.exe",
"mieru.exe"
]
},
{
"outboundTag": "direct",
"process": [
"v2ray.exe",
"xray.exe",
"mihomo-windows-amd64-v1.exe",
"mihomo-windows-amd64-compatible.exe",
"mihomo-windows-amd64.exe",
"mihomo-windows-arm64.exe",
"clash.exe",
"mihomo.exe",
"hysteria.exe",
"naive.exe",
"naiveproxy.exe",
"tuic-client.exe",
"tuic.exe",
"sing-box-client.exe",
"sing-box.exe",
"juicity-client.exe",
"juicity.exe",
"hysteria-windows-amd64.exe",
"hysteria-linux-amd64.exe",
"brook_windows_amd64.exe",
"brook_linux_amd64.exe",
"brook.exe",
"overtls-bin.exe",
"overtls.exe",
"shadowquic.exe",
"mieru.exe",
"xray/",
"self/"
]
},
{
"port": "53",
"outboundTag": "dns"
},
{
"type": "field",
"port": "443",
"network": "udp",
"outboundTag": "block"
},
{
"type": "field",
"outboundTag": "proxy",
"domain": [
"geosite:google"
]
},
{
"type": "field",
"outboundTag": "direct",
"ip": [
"geoip:private"
]
},
{
"type": "field",
"outboundTag": "direct",
"domain": [
"geosite:private"
]
},
{
"type": "field",
"outboundTag": "direct",
"ip": [
"223.5.5.5",
"223.6.6.6",
"2400:3200::1",
"2400:3200:baba::1",
"119.29.29.29",
"1.12.12.12",
"120.53.53.53",
"2402:4e00::",
"2402:4e00:1::",
"180.76.76.76",
"2400:da00::6666",
"114.114.114.114",
"114.114.115.115",
"114.114.114.119",
"114.114.115.119",
"114.114.114.110",
"114.114.115.110",
"180.184.1.1",
"180.184.2.2",
"101.226.4.6",
"218.30.118.6",
"123.125.81.6",
"140.207.198.6",
"1.2.4.8",
"210.2.4.8",
"52.80.66.66",
"117.50.22.22",
"2400:7fc0:849e:200::4",
"2404:c2c0:85d8:901::4",
"117.50.10.10",
"52.80.52.52",
"2400:7fc0:849e:200::8",
"2404:c2c0:85d8:901::8",
"117.50.60.30",
"52.80.60.30"
]
},
{
"type": "field",
"outboundTag": "direct",
"domain": [
"domain:alidns.com",
"domain:doh.pub",
"domain:dot.pub",
"domain:360.cn",
"domain:onedns.net"
]
},
{
"type": "field",
"outboundTag": "direct",
"ip": [
"geoip:cn"
]
},
{
"type": "field",
"outboundTag": "direct",
"domain": [
"geosite:cn"
]
},
{
"type": "field",
"inboundTag": [
"direct-dns-1",
"direct-dns-2"
],
"outboundTag": "direct"
},
{
"type": "field",
"inboundTag": [
"dns-module"
],
"outboundTag": "proxy"
}
]
}
} |
|
才发现我没有测试未配置 dns 的情况，未配置 dns 如下 
|
|
update: 将组策略里的禁用改到未配置或者已启用都会出现(不用重启)，即使未配置dns 而从未配置/已启用改到已禁用可能有缓存测试还是全是，执行 |
|
更新：去掉dns模块去掉route只留一个proxy out 未配置dns 全是 Details
{
"log": {
"loglevel": "warning"
},
"inbounds": [
{
"tag": "tun",
"protocol": "tun",
"settings": {
"name": "xray_tun",
"MTU": 9000,
"gateway": [
"172.18.0.1/30"
],
"autoSystemRoutingTable": [
"0.0.0.0/0"
,"::/0"
],
// "dns": [
// // "8.8.8.8"
// "172.18.0.1"
// ],
"autoOutboundsInterface": "auto"
}
}
],
"outbounds": [
{
"tag": "proxy",
}
]
} |
|
简单来说，现在的防漏依赖于 禁用多宿主，未配置dns，dns模块 缺一不可，且不治本，在查询失败下仍可能fallback到其他网卡，这解释了为什么单in out+未配置dns也会泄露的情况 而且目前单in out想要不泄露只能wfp |
|
我说的当然是改系统（默认网卡？）DNS，你只改 TUN 的 |
所以继续往三条件上堆条件有意义吗 改默认网卡还有个问题，1. 后续如何恢复，2. 如果有其他网卡也设置了dns是否还会泄露 假设把所有网卡dns都设置成了tun gateway成功不漏了，那么就是四条件，其中两个还是要手动设置的 |
|
主要是不太想把 WFP 弄进来，此外就像我说的，如果系统 DNS 配置成 DoH，你那规则也拦不住吧， 还有并不是堆条件，比如如果自动把所有网卡的 DNS 全改了，似乎也不需要“禁用多宿主，未配置 dns”了，只需要 dns 模块 除非台式机瞬间断电，其它情况 Xray-core 都能收到“退出”信号，可以自动恢复，还可以加个“修复 DNS”的脚本打包进 release |
|
总之你先测测“改所有 DNS”，我说的两种都测测， 另外“任务管理器”直接杀掉 Xray 进程可能也会导致它收不到“退出”信号，这个也没测过 |
|
改其他网卡dns这侵入比wfp动态session还大，我不支持这种，我也不会pr这种... 所以是放弃单in out的防漏了吗，不是很想配置dns模块，至于改网卡dns的修复谁pr谁测吧... |
呃，修改物理网卡的DNS为tun gateway 其实计算机里的程序能接收到，即使这个地址在这个网卡不可达（至少AdGuardHome可以接收到），见 |
|
不是，还真有人愿意被动默认网卡啊， 至于 doh 那个问题也简单，改成 blockAll 就行了，就是允许项要增多 |
CF warp client在Windows的默认做法就是这个 |
5 participants
closes #6454