From 928212830d7bd46cf055fdef29f8cd6eb280aa01 Mon Sep 17 00:00:00 2001 From: Nick Peng Date: Fri, 5 Jan 2024 23:52:21 +0800 Subject: [PATCH] update ipset,nftset options --- docs/config/ipset-nftset.md | 13 +++++++++++++ docs/configuration.md | 12 ++++++------ en/docs/config/ipset-nftset.md | 12 ++++++++++++ en/docs/configuration.md | 12 ++++++------ 4 files changed, 37 insertions(+), 12 deletions(-) diff --git a/docs/config/ipset-nftset.md b/docs/config/ipset-nftset.md index cfa0ef1ecc..48ec9a1dee 100644 --- a/docs/config/ipset-nftset.md +++ b/docs/config/ipset-nftset.md @@ -19,8 +19,14 @@ hide: 通过如下参数可以配置指定域名的NFTSet规则 ```shell + # 全局配置ipset + ipset ipsetname + # 指定域名配置ipset ipset /domain/ipset + # 指定IP类型配置ipset ipset /domain/[#4:ipsetv4,#6:ipsetv6] + # 忽略ipset规则 + ipset /domain/- ``` 1. 超时 @@ -46,7 +52,12 @@ hide: 通过如下参数可以配置指定域名的IPSet规则 ```shell + # 全局配置nftset + nftset [#4:ip#table#set,#6:ipv6#table#setv6] + # 指定域名配置nftset nftset /domain/[#4:ip#table#set,#6:ipv6#table#setv6] + # 忽略nftset规则 + nftset /domain/#4:-,#6:- ``` 1. 超时 @@ -85,3 +96,5 @@ bind [::]:6053 -ipset [ipset] -nftset [nftset] * -ipset：参数选项参考ipset选项。 * -nftset：选项参考nftset。 + +注意，bind配置ipset或nftset后，将自动禁用`域名预查询`、`过期缓存`和`双栈优选`功能。 diff --git a/docs/configuration.md b/docs/configuration.md index e749e20d4f..84280f305c 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -13,10 +13,10 @@ hide: | 键名 | 功能说明 | 默认值 | 可用值/要求 | 举例 | | :--- | :--- | :--- | :--- | :--- | | server-name | DNS 服务器名称 | 操作系统主机名 / smartdns | 符合主机名规格的字符串 | server-name smartdns | -| bind | DNS 监听端口号 | [::]:53 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 Nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项| bind :53@eth0 | -| bind-tcp | DNS TCP 监听端口号 | [::]:53 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则。
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项 | bind-tcp :53 | -| bind-tls | DNS Over TLS 监听端口号 | [::]:853 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则。
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项| bind-tls :853 | -| bind-https | DNS Over HTTPS 监听端口号 | [::]:853 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则。
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项| bind-https :853 | +| bind | DNS 监听端口号 | [::]:53 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 Nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-force-https-soa]: 禁用HTTPS记录查询
[-no-serve-expired]: 禁用过期缓存
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项| bind :53@eth0 | +| bind-tcp | DNS TCP 监听端口号 | [::]:53 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则。
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-force-https-soa]: 禁用HTTPS记录查询
[-no-serve-expired]: 禁用过期缓存
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项 | bind-tcp :53 | +| bind-tls | DNS Over TLS 监听端口号 | [::]:853 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则。
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-force-https-soa]: 禁用HTTPS记录查询
[-no-serve-expired]: 禁用过期缓存
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项| bind-tls :853 | +| bind-https | DNS Over HTTPS 监听端口号 | [::]:853 | 可绑定多个端口。
IP:PORT@DEVICE: 服务器 IP:端口号@设备名
[-group]: 请求时使用的 DNS 服务器组
[-no-rule-addr]：跳过 address 规则
[-no-rule-nameserver]：跳过 nameserver 规则
[-no-rule-ipset]：跳过 ipset 和 nftset 规则。
[-no-rule-soa]：跳过 SOA(#) 规则
[-no-dualstack-selection]：停用双栈测速
[-no-speed-check]：停用测速
[-no-cache]：停止缓存
[-force-aaaa-soa]: 禁用IPV6查询
[-force-https-soa]: 禁用HTTPS记录查询
[-no-serve-expired]: 禁用过期缓存
[-ipset]: 设置IPSet，参考ipset选项
[-nftset]: 设置nftset，参考nftset选项| bind-https :853 | | bind-cert-file | SSL证书文件路径 | smartdns-cert.pem | 合法路径字符串 | bind-cert-file cert.pem | | bind-cert-key-file | SSL证书KEY文件路径 | smartdns-key.pem | 合法路径字符串 | bind-cert-key-file key.pem | | bind-cert-key-pass | SSL证书KEY文件密码 | 无 | 字符串 | bind-cert-key-pass password | @@ -64,10 +64,10 @@ hide: | hosts-file | 指定hosts文件 | 无 | hosts文件路径 | hosts-file /etc/hosts | | edns-client-subnet | DNS ECS | 无 | edns-client-subnet ip-prefix/mask
指定EDNS客户端子网 | ip-prefix/mask 1.2.3.4/23 | | nameserver | 指定域名使用 server 组解析 | 无 | nameserver /domain/[group\|-], group 为组名，- 表示忽略此规则，配套 server 中的 -group 参数使用 | nameserver /www.example.com/office | -| ipset | 域名 ipset | 无 | ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]]，-表示忽略此规则 | ipset /www.example.com/#4:dns4,#6:-
ipset /www.example.com/dns | +| ipset | 域名 ipset | 无 | ipset [/domain/][ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]]，-表示忽略此规则 | ipset /www.example.com/#4:dns4,#6:-
ipset /www.example.com/dns
ipset ipsetname| | ipset-timeout | 设置 ipset 超时功能启用 | no | [yes\|no] | ipset-timeout yes | | ipset-no-speed | 当测速失败时，将域名结果设置到ipset集合中 | 无 | ipset \| #[4\|6]:ipset | ipset-no-speed #4:ipset4,#6:ipset6
ipset-no-speed ipset| -| nftset | 域名 nftset | 无 | nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]，
-表示忽略此规则；
ipv4 地址的 family 只支持 inet 和 ip；
ipv6 地址的 family 只支持 inet 和 ip6；
由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset /www.example.com/#4:inet#tab#dns4,#6:- | +| nftset | 域名 nftset | 无 | nftset [/domain/][#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]，
-表示忽略此规则；
ipv4 地址的 family 只支持 inet 和 ip；
ipv6 地址的 family 只支持 inet 和 ip6；
由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset /www.example.com/#4:inet#tab#dns4,#6:-
nftset #4:inet#tab#dns4,#6:-| | nftset-timeout | 设置 nftset 超时功能启用 | no | [yes\|no] | nftset-timeout yes | | nftset-no-speed | 当测速失败时，将域名结果设置到nftset集合中 | 无 | nftset-no-speed [#4\|#6]:[family#nftable#nftset][,#[4\|6]:[family#nftable#nftset]]]
ipv4 地址的 family 只支持 inet 和 ip
ipv6 地址的 family 只支持 inet 和 ip6
由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset-no-speed #4:inet#tab#set4| | nftset-debug | 设置 nftset 调试功能启用 | no | [yes\|no] | nftset-debug yes | diff --git a/en/docs/config/ipset-nftset.md b/en/docs/config/ipset-nftset.md index f7dd4e520a..0138104952 100644 --- a/en/docs/config/ipset-nftset.md +++ b/en/docs/config/ipset-nftset.md @@ -19,8 +19,13 @@ Like Dnsmasq, smartdns supports ipset and nftset, which can use TPROXY to transp The following parameters can be used to configure NFTSet rules for specified domain names. ```shell + # set global ipset + ipset ipsetname + # set ipset for specified domain names ipset /domain/ipset ipset /domain/[#4:ipsetv4,#6:ipsetv6] + # ignore ipset rule for specified domain names + ipset /domain/- ``` 1. Timeout @@ -46,7 +51,12 @@ Like Dnsmasq, smartdns supports ipset and nftset, which can use TPROXY to transp The following parameters can be used to configure IPSet rules for specified domain names. ```shell + # set global nftset + nftset [#4:ip#table#set,#6:ipv6#table#setv6] + # set nftset for specified domain names nftset /domain/[#4:ip#table#set,#6:ipv6#table#setv6] + # ignore ipset rule for specified domain names + nftset /domain/#4:-,#6:- ``` 1. Timeout @@ -85,3 +95,5 @@ bind [::]:6053 -ipset [ipset] -nftset [nftset] * -ipset: Refer to ipset options for parameter options. * -nftset: options refer to nftset. + +Note: when bind is configured with ipset or nftset, `domain-prefretch`, `serve-expired`, and `dualstack-selection` functions will be automatically disabled. diff --git a/en/docs/configuration.md b/en/docs/configuration.md index 476158b492..bcbd9f626c 100644 --- a/en/docs/configuration.md +++ b/en/docs/configuration.md @@ -9,10 +9,10 @@ hide: |parameter|Parameter function|Default value|Value type|Example| |--|--|--|--|--| |server-name|DNS name|host name/smartdns|any string like hostname|server-name smartdns -|bind|DNS listening port number|[::]:53|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number, and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the Ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA,
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind :53@eth0 -|bind-tcp|TCP mode DNS listening port number|[::]:53|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA,
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind-tcp :53 -|bind-tls|DOT mode DNS listening port number|[::]:853|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA,
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind-tls :853 -|bind-https|DOH mode DNS listening port number|[::]:853|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA,
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind-https :853 +|bind|DNS listening port number|[::]:53|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number, and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the Ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA.
[-force-https-soa]: force HTTPS query return SOA.
[-no-serve-expired]: no lazy cache.
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind :53@eth0 +|bind-tcp|TCP mode DNS listening port number|[::]:53|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA.
[-force-https-soa]: force HTTPS query return SOA.
[-no-serve-expired]: no lazy cache.
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind-tcp :53 +|bind-tls|DOT mode DNS listening port number|[::]:853|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA.
[-force-https-soa]: force HTTPS query return SOA.
[-no-serve-expired]: no lazy cache.
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind-tls :853 +|bind-https|DOH mode DNS listening port number|[::]:853|Support binding multiple ports
`IP:PORT@DEVICE`: server IP, port number and device.
`[-group]`: The DNS server group used when requesting.
`[-no-rule-addr]`: Skip the address rule.
`[-no-rule-nameserver]`: Skip the Nameserver rule.
`[-no-rule-ipset]`: Skip the ipset or nftset rules.
`[-no-rule-soa]`: Skip address SOA(#) rules.
`[-no-dualstack-selection]`: Disable dualstack ip selection.
`[-no-speed-check]`: Disable speed measurement.
`[-no-cache]`: stop caching
[-force-aaaa-soa]: force AAAA query return SOA.
[-force-https-soa]: force HTTPS query return SOA.
[-no-serve-expired]: no lazy cache.
[-ipset]: set IPSet, refer to ipset option
[-nftset]: set nftset, refer to nftset option |bind-https :853 |bind-cert-file|SSL Certificate file path|smartdns-cert.pem|path| bind-cert-file cert.pem | |bind-cert-key-file|SSL Certificate key file path|none|smartdns-key.pem| bind-cert-key-file key.pem | |bind-cert-key-pass|SSL Certificate key file password|none|string| bind-cert-key-pass password | @@ -60,10 +60,10 @@ hide: |hosts-file| set hosts file | None | hosts file path. | hosts-file /etc/hosts | |edns-client-subnet| DNS ECS | None |edns-client-subnet ip-prefix/mask
set EDNS client subnet | ip-prefix/mask 1.2.3.4/23 | |nameserver|To query domain with specific server group|None|nameserver /domain/[group\|-], `group` is the group name, `-` means ignore this rule, use the `-group` parameter in the related server|nameserver /www.example.com/office -|ipset|Domain IPSet|None|ipset /domain/[ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]], `-` for ignore this rule.|ipset /www.example.com/#4:dns4,#6:- +|ipset|Domain IPSet|None|ipset [/domain/][ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]], `-` for ignore this rule.|ipset /www.example.com/#4:dns4,#6:-
ipset ipsetname |ipset-timeout|ipset timeout enable|no|[yes\|no]|ipset-timeout yes |ipset-no-speed|When speed check fails, set the ip address of the domain name to the ipset | None | ipset \| #[4\|6]:ipset | ipset-no-speed #4:ipset4,#6:ipset6
ipset-no-speed ipset| -|nftset|Domain nftset|None|nftset /domain/[#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]
`-` to ignore this rule.
the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses
due to the limitation of nftable
two types of addresses have to be stored in two sets|nftset /www.example.com/#4:inet#tab#dns4,#6:- +|nftset|Domain nftset|None|nftset [/domain/][#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]
`-` to ignore this rule.
the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses
due to the limitation of nftable
two types of addresses have to be stored in two sets|nftset /www.example.com/#4:inet#tab#dns4,#6:-
nftset #4:inet#tab#dns4,#6:- |nftset-timeout|nftset timeout enable|no|[yes\|no]|nftset-timeout yes |nftset-no-speed|When speed check fails, set the ip address of the domain name to the nftset | None | nftset-no-speed [#4\|#6]:[family#nftable#nftset][,#[4\|6]:[family#nftable#nftset]]]
the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses
due to the limitation of nftable
two types of addresses have to be stored in two sets| nftset-no-speed #4:inet#tab#set4| |nftset-debug|nftset debug enable|no|[yes\|no]|nftset-debug yes