功能请求：更专业的DNS分流

[Meo597]

完整性要求

• 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。
• 我提供了完整的配置文件和日志，而不是出于自己的判断只给出截取的部分。
• 我搜索了 issues, 没有发现已提出的类似问题。
• 问题在 Release 最新的版本上可以成功复现

描述

一些权威DNS不支持EDNS导致特定情况下DNS分流失效，造成绕路问题

场景：
如果你的Xray用透明代理充当局域网关，并且你有多个节点分布在不同的国家
你希望看奈飞、亚马逊走HK；其它走默认的美国

最好的做法肯定是在DNS和路由都做策略

DNS做域名的rule是为了保证解析出HK的IP
路由做域名的rule确保流量一定从那出去
路由做IP的rule防止漏网之鱼

但许多大厂CDN的权威DNS压根不支持EDNS

所以可能需要改造DNS模块，让DNS支持指定的outbound

希望支持如下配置：

{
  "dns": {
    "servers": [
      {
        "address": "8.8.8.8",
        "port": 53,
        "domains": ["geosite:netflix"],
        "outboundTag": "node-hk" // 新功能：从hk出去，无视routing的IP rule
      }
      "8.8.8.8" // 这里没指定，因此将遵守routing模块的IP rule
    ]
  }
}

---

现在目前临时解决办法是：
1.多准备几个不同的递归DNS，在路由规则中指定出口，放弃EDNS
但如果节点特别多，递归DNS明显不够用，而且这个方法不够优雅

2.让Xray节点sniff+routeOnly=false覆盖IP
但显然会造成二次DNS解析，也不够优雅

重现方式

假如你有两个节点，HK和US，8.8.8.8走US
比如下面这个DNS策略，youtube没问题，facebook会解析出美国IP

...省略
      {
        // 利用EDNS尝试获取节点位置的A/AAAA记录
        "address": "8.8.8.8",
        "port": 53,
        "skipFallback": true,
        "domains": ["geosite:youtube", "geosite:meta"],
        "clientIp": "110.235.0.0" // 香港的家宽IP
      },
...省略

客户端配置

N/A

服务端配置

N/A

客户端日志

N/A

服务端日志

N/A

[Fangliding]

倒可以加一个per server的inbound tag 这样就能在路由处理了 这个全局的确实不好

[wyx2685]

@Meo597 两个节点的情况用fakedns按域名分流解决

[Fangliding]

DNS可以指定目标地址然后用目标路由 好像也是

[Meo597]

倒可以加一个per server的inbound tag 这样就能在路由处理了 这个全局的确实不好

这样也挺好，省代码

---

下面的问题已经找到根源，详见
#4508

然后我还发现一个问题：
DNS似乎是并发请求的？在测试，如果是同步的就当我乱说。。。
假设我们实现了上面提到的功能，或者用不同的递归DNS暂时实现需求
因为去往不同服务器的延迟不一样，仍然会导致解析结果混乱，是DNS并发导致的

因为当前代码的逻辑是 skipFallback 为true的提取出来是一组 并发请求。如果失败了再找false的为一组并发请求
因为网络延迟，美国>香港，奈飞同时存在于geosite:netflix和geosite:geolocation-!cn
因此美国的解析结果永远被丢弃，DNS这块奈飞走的还是香港

我测了下如果一个域同时命中俩dnsserverobject，不是按照配置文件中定义的先后顺序执行
这会给分流带来很大困扰

假设我们在中国，希望默认境外走香港，奈飞去美国
由于同时命中了俩规则，DNS解析结果不受控制不可预测
代码我看应该是串行的，给人的感觉像并行，或许是随机？没看出头绪

      {
        "address": "208.67.222.222", // 走美国
        "port": 53,
        "skipFallback": true,
        "domains": ["geosite:netflix"]
      },
      {
        // 疑似为非中国的域，优先用明确不支持EDNS的Cloudflare解析以避免DNS泄露 VPS IP
        // 若返回中国的IP，则让之后的谷歌DNS利用EDNS请求直连优化的A/AAAA记录
        "address": "1.1.1.1", // 走香港
        "port": 53,
        "skipFallback": true,
        "domains": ["geosite:geolocation-!cn"],
        "expectIPs": ["geoip:!cn"]
      },
      {
        // 利用EDNS尝试获取中国的A/AAAA记录
        // 若没有，则按顺序请求之后的DNS，以获取代理出口优化的A/AAAA记录
        "address": "8.8.8.8",
        "port": 53,
        "skipFallback": false,
        "clientIp": "218.2.2.2", // 提供当地ISP的IP地址以获取直连优化的A/AAAA记录
        "expectIPs": ["geoip:cn"]
      },
      "8.8.8.8"

[Meo597]

@Meo597 两个节点的情况用fakedns按域名分流解决

fakedns是有状态的万一崩了直接火葬场，而且我内网用干净了，并不是很希望使用这种方式
实现需求很简单，但我想追求最优雅的配置

[Fangliding]

这一般就不会在考虑了

[patterniha]

You can add a per server inbound tag so that the routing can handle this globally.

@Fangliding @Meo597 @RPRX

Instead of per server inbound tag, we can do the following alternative:

use a dedicated port for each DNS-server and then route based on ports,
of course, we will also need dialerProxy to recover the original ports.

so instead of:

{
  "dns": {
    "servers": [
      {
        "address": "8.8.8.8",
        "port": 53,
        "domains": ["geosite:netflix"],
        "outboundTag": "node-hk"
      },
      "8.8.8.8"
    ]
  }
}

We can do the following alternative:

{
  "dns": {    
    "servers": [
      {
        "address": "8.8.8.8",
        "port": 1,
        "domains": ["geosite:netflix"]
      },
      {
        "address": "8.8.8.8",
        "port": 2
      }
    ],
  "tag": "dns-query"
  },
  "outbounds": [
    {
        "tag": "recover-port-hk",
        "protocol": "freedom",      
        "settings": {"redirect": ":53"},
        "streamSettings": {"sockopt": {"dialerProxy": "node-hk"}}
    },
    {
        "tag": "recover-port-us",
        "protocol": "freedom",      
        "settings": {"redirect": ":53"},
        "streamSettings": {"sockopt": {"dialerProxy": "node-us"}}
    },
    {
        "tag": "node-hk",
        ...
    },
    {
        "tag": "node-us",
        ...
    }
 ],
 "routing": {
    "rules": [      
      {"outboundTag": "recover-port-hk",
       "inboundTag": ["dns-query"], "port": 1
      },
      {"outboundTag": "recover-port-us",
       "inboundTag": ["dns-query"], "port": 2
      }
    ]
  }
}

[zhangsan946]

Actually it is better to have outboundTag support in the DnsServerObject. As currently if the address contains local it would use the auto-selected freedom outbound which is ambiguous if it contains more than one freedom outbounds. It is better to replace local with outboundTag

[patterniha]

Actually it is better to have outboundTag support in the DnsServerObject. As currently if the address contains local it would use the auto-selected freedom outbound which is ambiguous if the outbounds contains more than one freedom outbounds. It is better to replace local with outboundTag

No, this is wrong, it would not use the auto-selected freedom-outbound, it uses its own freedom, which is completely separate from the outbounds of the config.

///

according to this from @RPRX :

for those that can be implemented in a nested manner, we should prioritize nested implementation, which is also the usage of ray

If we don't want to use dialerProxy, there are many features that can be added, such as: #4424, #4370, #4505, ...

///

UPDATE:

I simplified the solution and now it is routed based on ports, so it works even for two DOH with the same domain.

[zhangsan946]

@patterniha if this is the case, it won't hava sockopt config for the dedicated freedom, and it may cause issue in the transparent proxy use case.

[patterniha]

@patterniha if this is the case, it won't hava sockopt config for the dedicated freedom, and it may cause issue in the transparent proxy use case.

This is not related to this issue. You should ask @Fangliding about this.
Also, +local dns cannot use built-in-dns-hosts to resolve its domain to IP.
I personally never understood why we need +local dns.

[Meo597]

你可以添加一个每个服务器的入站标签，以便路由可以全局处理这一点。

@Fangliding @Meo597 @RPRX

我们可以采用以下替代方案，而不是每个服务器的入站标签：

为每个 DNS 服务器使用一个专用端口，然后根据端口进行路由，当然，我们还需要 dialerProxy 来恢复原始端口。

所以与其：

{
  "dns": {
    "servers": [
      {
        "address": "8.8.8.8",
        "port": 53,
        "domains": ["geosite:netflix"],
        "outboundTag": "node-hk"
      },
      "8.8.8.8"
    ]
  }
}

我们可以采取以下替代方案：

{
  "dns": {    
    "servers": [
      {
        "address": "8.8.8.8",
        "port": 1,
        "domains": ["geosite:netflix"]
      },
      {
        "address": "8.8.8.8",
        "port": 2
      }
    ],
  "tag": "dns-query"
  },
  "outbounds": [
    {
        "tag": "recover-port-hk",
        "protocol": "freedom",      
        "settings": {"redirect": ":53"},
        "streamSettings": {"sockopt": {"dialerProxy": "node-hk"}}
    },
    {
        "tag": "recover-port-us",
        "protocol": "freedom",      
        "settings": {"redirect": ":53"},
        "streamSettings": {"sockopt": {"dialerProxy": "node-us"}}
    },
    {
        "tag": "node-hk",
        ...
    },
    {
        "tag": "node-us",
        ...
    }
 ],
 "routing": {
    "rules": [      
      {"outboundTag": "recover-port-hk",
       "inboundTag": ["dns-query"], "port": 1
      },
      {"outboundTag": "recover-port-us",
       "inboundTag": ["dns-query"], "port": 2
      }
    ]
  }
}

这样配置起来太复杂了，而且确实没有什么太大意义，毕竟全球任播的DNS IP数量还是足够多的，够用

这个issues旨在改善原有设计，原设计思路毕竟就有tag，但是自动应用到所有dns，而不是每个dnsServerObject。这是问题所在

tag直接简单有效，是最佳实践