diff --git a/docs/config/client-rule.md b/docs/config/client-rule.md new file mode 100644 index 0000000000..dd8e2cba45 --- /dev/null +++ b/docs/config/client-rule.md @@ -0,0 +1,86 @@ +--- +hide: + - toc +--- + +# 客户端规则 + +smartdns支持根据客户端IP地址，对客户端设置不同的规则，可以实现： + + * 家长控制：限制特定客户端可访问的网站。 + * 访问控制：禁止未经允许的客户端查询。 + * 基于客户端域名分流查询：设置规则组和上游组绑定，不同的客户端查询不同的上游。 + +## 家长控制 + +设置smartdns针对特定的客户端使用特定的上游查询，也可以设置禁止访问特定的域名或IP地址，来实现家长控制。 + +``` +# 启用规则组 +group-begin child +# 设置规则组对应的客户端IP +client-rules 192.168.1.13 +# 设置规则组使用的上游服务器 +server 1.2.3.4 -e +# 禁止特定域名 +address /block.com/# +# 禁止特定IP +ignore-ip 2.2.2.2 +group-end +``` + +为方便管理，也可采用多配置文件的方式，如 + +1. 主配置文件 +``` +conf-file child.conf -group child +``` + +1. 包含的配置文件 +``` +# 设置规则组对应的客户端IP +client-rules 192.168.1.13 +# 设置规则组使用的上游服务器 +server 1.2.3.4 -e +# 禁止特定域名 +address /block.com/# +# 禁止特定IP +ignore-ip 2.2.2.2 +``` + +其中group-begin和group-end的配置块，等价于conf-file -group 包含的配置文件， + +## 访问控制 + +smartdns支持基本的ACL功能，可以通过如下参数开启和设置允许访问的主机。 + +``` +# 启用ACL +acl-enable yes +# 设置允许访问的主机 +client-rules 192.168.1.2/24 +``` + +## 基于客户端域名分流查询 + +类似家长控制，smartdns可以将特定需要分流和配合ipset/nftset访问的主机，进行分流。 + +1. 主配置文件 +``` +conf-file oversea.conf -group oversea +``` + +1. 包含的配置文件 +``` +# 设置规则组对应的客户端IP +client-rules 192.168.1.13 +# 设置规则组使用的上游服务器 +server-https https://1.2.3.4 -e +server-tls tls://1.2.3.4 -e +# 禁止测速 +speed-check-mode none +# 禁止IPV6和HTTPS记录 +force-qtype-SOA 28 65 +# 设置ipset +ipset oversea +``` \ No newline at end of file diff --git a/docs/config/domain-rule.md b/docs/config/domain-rule.md new file mode 100644 index 0000000000..d1f983c479 --- /dev/null +++ b/docs/config/domain-rule.md @@ -0,0 +1,23 @@ +--- +hide: + - toc +--- + +# 域名规则 + +为方便对同一个域名设置多个规则，smartdns提供了`domain-rules`参数，可以对域名设置多个规则。 + +1. 使用`domain-rules`设置多个规则，如： + + ``` + domain-rules /a.com/ -g group -address #6 -ipset ipset + ``` + + domain-rules的选项请阅读配置选项。 + +1. 在有/domain/配置的选项使用域名集合，只需要将`/domain/`配置为`/domain-set:[集合名称]/`即可，如： + + ```shell + domain-set -name ad -file /etc/smartdns/ad-list.conf + domain-rules /domain-set:ad/ -a # + ``` diff --git a/docs/configuration.md b/docs/configuration.md index 84280f305c..1d87c222c6 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -46,7 +46,10 @@ hide: | audit-file-mode | 审计归档文件权限 | 0640 | 文件权限 | log-file-mode 644 | | audit-console | 是否输出审计日志到控制台 | no | [yes\|no] | audit-console yes | | audit-syslog | 是否输出审计日志到系统日志 | no | [yes\|no] | audit-syslog yes | -| conf-file | 附加配置文件 | 无 | 合法路径字符串，通配符号 | conf-file /etc/smartdns/smartdns.more.conf
conf-file *.conf | +| acl-enable | 启用ACL | no | [yes\|no]
和client-rules搭配使用。| acl-enable yes | +| group-begin | 规则组开始 | 无 | 组名:
和group-end搭配使用，启用此参数后，group-begin参数之后的配置项将设置到对应的组中，直到group-end结束。| group-begin group-name | +| group-end | 规则组结束 | 无 | 和group-begin搭配使用 | group-end | +| conf-file | 附加配置文件 | 无 | path [-g\|group group-name]
path: 合法路径字符串，通配符号
[-g\|group]: 对应配置文件配置所属规则组 | conf-file /etc/smartdns/smartdns.more.conf
conf-file \*.conf
conf-file \*.conf -group oversea | | server | 上游 UDP DNS | 无 | 可重复。
[ip][:port]\|URL：服务器 IP:端口（可选）或 URL
[-blacklist-ip]：配置 IP 过滤结果。
[-whitelist-ip]：指定仅接受参数中配置的 IP 范围
[-g\|-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用
[-e\|-exclude-default-group]：将 DNS 服务器从默认组中排除。
[-set-mark mark]：设置数据包标记so-mark。
[-p\|-proxy name]：设置代理服务器。
[-b\|-bootstrap-dns]：标记此服务器为bootstrap服务器。
[-subnet]：指定服务器使用的edns-client-subnet。
[-interface]：绑定到对应的网口。| server 8.8.8.8:53 -blacklist-ip -group g1 -proxy proxy
server tls://8.8.8.8| | server-tcp | 上游 TCP DNS | 无 | 可重复。
[ip][:port]：服务器 IP:端口（可选）
[-blacklist-ip]：配置 IP 过滤结果
[-whitelist-ip]：指定仅接受参数中配置的 IP 范围。
[-g\|-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用
[-e\|-exclude-default-group]：将 DNS 服务器从默认组中排除。
[-set-mark mark]：设置数据包标记so-mark。
[-p\|-proxy name]：设置代理服务器。
[-b\|-bootstrap-dns]：标记此服务器为bootstrap服务器。
[-subnet]：指定服务器使用的edns-client-subnet。
[-interface]：绑定到对应的网口。| server-tcp 8.8.8.8:53 | | server-tls | 上游 TLS DNS | 无 | 可重复。
[ip][:port]：服务器 IP:端口（可选)
[-spki-pin [sha256-pin]]：TLS 合法性校验 SPKI 值，base64 编码的 sha256 SPKI pin 值
[-host-name]：TLS SNI 名称, 名称设置为-，表示停用SNI名称。
[-host-ip]: 主机IP地址。
[-tls-host-verify]：TLS 证书主机名校验
[-k\|-no-check-certificate]：跳过证书校验
[-blacklist-ip]：配置 IP 过滤结果
[-whitelist-ip]：仅接受参数中配置的 IP 范围
[-g\|-group [group] ...]：DNS 服务器所属组，比如 office 和 foreign，和 nameserver 配套使用
[-e\|-exclude-default-group]：将 DNS 服务器从默认组中排除。
[-set-mark mark]：设置数据包标记so-mark。
[-p\|-proxy name]：设置代理服务器。
[-b\|-bootstrap-dns]：标记此服务器为bootstrap服务器。
[-subnet]：指定服务器使用的edns-client-subnet。
[-interface]：绑定到对应的网口。| server-tls 8.8.8.8:853 | @@ -64,7 +67,7 @@ hide: | hosts-file | 指定hosts文件 | 无 | hosts文件路径 | hosts-file /etc/hosts | | edns-client-subnet | DNS ECS | 无 | edns-client-subnet ip-prefix/mask
指定EDNS客户端子网 | ip-prefix/mask 1.2.3.4/23 | | nameserver | 指定域名使用 server 组解析 | 无 | nameserver /domain/[group\|-], group 为组名，- 表示忽略此规则，配套 server 中的 -group 参数使用 | nameserver /www.example.com/office | -| ipset | 域名 ipset | 无 | ipset [/domain/][ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]]，-表示忽略此规则 | ipset /www.example.com/#4:dns4,#6:-
ipset /www.example.com/dns
ipset ipsetname| +| ipset | 域名 ipset | 无 | ipset [/domain/][ipset\|-\|#[4\|6]:[ipset\|-][,#[4\|6]:[ipset\|-]]]，-表示忽略此规则，只有ipset名称没有域名时，表示全局生效。| ipset /www.example.com/#4:dns4,#6:-
ipset /www.example.com/dns
ipset ipsetname| | ipset-timeout | 设置 ipset 超时功能启用 | no | [yes\|no] | ipset-timeout yes | | ipset-no-speed | 当测速失败时，将域名结果设置到ipset集合中 | 无 | ipset \| #[4\|6]:ipset | ipset-no-speed #4:ipset4,#6:ipset6
ipset-no-speed ipset| | nftset | 域名 nftset | 无 | nftset [/domain/][#4\|#6\|-]:[family#nftable#nftset\|-][,#[4\|6]:[family#nftable#nftset\|-]]]，
-表示忽略此规则；
ipv4 地址的 family 只支持 inet 和 ip；
ipv6 地址的 family 只支持 inet 和 ip6；
由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset /www.example.com/#4:inet#tab#dns4,#6:-
nftset #4:inet#tab#dns4,#6:-| @@ -73,6 +76,7 @@ hide: | nftset-debug | 设置 nftset 调试功能启用 | no | [yes\|no] | nftset-debug yes | | domain-rules | 设置域名规则 | 无 | domain-rules /domain/ [-rules...]
[-c\|-speed-check-mode]：测速模式，参考 speed-check-mode 配置
[-a\|-address]：参考 address 配置
[-n\|-nameserver]：参考 nameserver 配置
[-p\|-ipset]：参考ipset配置
[-t\|-nftset]：参考nftset配置
[-d\|-dualstack-ip-selection]：参考 dualstack-ip-selection
[-no-serve-expired]：禁用过期缓存
[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: 参考配置rr-ttl, rr-ttl-min, rr-ttl-max
[-no-cache]：不缓存当前域名
[-r\|-response-mode]：响应模式，参考 response-mode 配置
[-delete]：删除对应的规则
[no-ip-alias]: 忽略ip别名规则| domain-rules /www.example.com/ -speed-check-mode none | | domain-set | 设置域名集合 | 无 | domain-set [options...]
[-n\|-name]：域名集合名称
[-t\|-type]：域名集合类型，当前仅支持list，格式为域名列表，一行一个域名。
[-f\|-file]：域名集合文件路径。
选项需要配合address, nameserver, ipset, nftset等需要指定域名的地方使用，使用方式为 /domain-set:[name]/| domain-set -name set -type list -file /path/to/list
address /domain-set:set/1.2.4.8 | +| client-rules | 客户端规则 | 无 | [ip/subnet] [-g\|group group-name] [-rules...]
设置客户端规则和规则组，规则参数与bind一样，具体参数选项请参考bind，一般情况搭配group-begin、group-end使用。 | client-rules 192.168.1.1 -g oversea | | bogus-nxdomain | 假冒 IP 地址过滤 | 无 | [ip/subnet]，可重复 | bogus-nxdomain 1.2.3.4/16 | | ignore-ip | 忽略 IP 地址 | 无 | [ip/subnet]，可重复 | ignore-ip 1.2.3.4/16 | | whitelist-ip | 白名单 IP 地址 | 无 | [ip/subnet]，可重复 | whitelist-ip 1.2.3.4/16 | diff --git a/en/docs/config/client-rule.md b/en/docs/config/client-rule.md new file mode 100644 index 0000000000..421162a4f1 --- /dev/null +++ b/en/docs/config/client-rule.md @@ -0,0 +1,90 @@ +--- +hide: + - toc +--- + +# Client Rules + +smartdns supports setting different rules for clients based on their IP addresses, allowing for: + + * Parental control: Restricting access to specific websites for certain clients. + * Access control: Prohibiting unauthorized clients from making queries. + * Client-based domain-based query routing: Binding rule groups with upstream groups, so that different clients can query different upstream servers. + +## Parental Control + + By configuring smartdns to use specific upstream queries for certain clients, you can implement parental control by restricting access to specific domains or IP addresses. + + ``` + # Enable Rule Group + group-begin child + # Set client IP for the rule group + client-rules 192.168.1.13 + # Set upstream server for the rule group + server 1.2.3.4 -e + # Block specific domain + address /block.com/# + # Block specific IP + ignore-ip 2.2.2.2 + group-end + ``` + +For convenience in management, multiple configuration files can also be used, such as: + + 1. Main configuration file + + ``` + conf-file child.conf -group child + ``` + + 1. Included Configuration File + + ``` + # Set client IP for the rule group + client-rules 192.168.1.13 + # Set upstream server for the rule group + server 1.2.3.4 -e + # Block specific domain + address /block.com/# + # Block specific IP + ignore-ip 2.2.2.2 + ``` + +The configuration blocks of group-begin and group-end are equivalent to the configuration files included with conf-file -group. + +## Access Control + + smartdns supports basic ACL functionality, which allows you to enable and set the hosts that are allowed to access. + + ``` + # Enable ACL + acl-enable yes + # Set allowed hosts + client-rules 192.168.1.2/24 + ``` + +## Client-based Domain-based Query Forwarding + +Similar to parental control, smartdns can route specific hosts that require redirection and are accessed with ipset/nftset. + + 1. Main Configuration File + + ``` + conf-file oversea.conf -group oversea + ``` + + 1. Included Configuration File + + ``` + # Set the client IP for the rule group + client-rules 192.168.1.13 + # Set the upstream servers for the rule group + server-https https://1.2.3.4 -e + server-tls tls://1.2.3.4 -e + # Disable speed check + speed-check-mode none + # Disable IPV6 and HTTPS logging + force-qtype-SOA 28 65 + # Set ipset + ipset group-tv + ``` \ No newline at end of file diff --git a/en/docs/config/domain-rule.md b/en/docs/config/domain-rule.md new file mode 100644 index 0000000000..190bad47aa --- /dev/null +++ b/en/docs/config/domain-rule.md @@ -0,0 +1,28 @@ +--- +hide: + - toc +--- + +# Domain Rules + +To facilitate setting multiple rules for the same domain, smartdns provides the `domain-rules` parameter, which allows you to set multiple rules for a domain. + +1. Use the `domain-rules` parameter to set multiple rules, for example: + + ``` + domain-rules /a.com/ -g group -address #6 -ipset ipset + ``` + + Please refer to the configuration options for more information on the `domain-rules` options. + +1. When using domain sets in options with `/domain/` configuration, you only need to replace `/domain/` with `/domain-set:[set name]/`, for example: + + ```shell + domain-set -name ad -file /etc/smartdns/ad-list.conf + domain-rules /domain-set:ad/ -a # + ``` + + ```shell + domain-set -name ad -file /etc/smartdns/ad-list.conf + domain-rules /domain-set:ad/ -a # + ``` diff --git a/en/docs/configuration.md b/en/docs/configuration.md index bcbd9f626c..b9328054b1 100644 --- a/en/docs/configuration.md +++ b/en/docs/configuration.md @@ -42,7 +42,10 @@ hide: |audit-file-mode|archived audit log file mode|0640|Integer|audit-file-mode 644 |audit-console|enable output audit log to console|no|[yes\|no]|audit-console yes |audit-syslog|enable output audit log to syslog|no|[yes\|no]|audit-syslog yes -|conf-file|additional conf file|None|File path, wildcard |conf-file /etc/smartdns/smartdns.more.conf
conf-file *.conf +|acl-enable|enable ACL| no | [yes\|no]
Used with client-rules.| acl-enable yes | +|group-begin|rule group start|None|Group name:
Used with group-end, when enabled, the configuration items after group-begin will be set to the corresponding group until group-end is encountered.|group-begin group-name| +|group-end|rule group end| None | Used group-begin.| group-end | +|conf-file|additional conf file|None|file [-g\|-group group-name]
file: File path, wildcard.
[-g\|-group group-name]: The rule group to which the corresponding configuration file configuration belongs. |conf-file /etc/smartdns/smartdns.more.conf
conf-file \*.conf
conf-file \*.conf -g group-tv | |server|Upstream UDP DNS server|None|Repeatable
`[ip][:port]|URL`: Server IP, port optional OR URL.
`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip".
`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted.
`[-g|-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver.
`[-e|-exclude-default-group]`: Exclude DNS servers from the default group.
`[-set-mark mark]`: set mark on packets
`[-p|-proxy name]`: set proxy server
`[-b|-bootstrap-dns]`: set as bootstrap dns server
[-subnet]：set per server edns-client-subnet.
[-interface]: bind to interface. | server 8.8.8.8:53 -blacklist-ip
server tls://8.8.8.8 |server-tcp|Upstream TCP DNS server|None|Repeatable
`[ip][:port]`: Server IP, port optional.
`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip".
`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted.
`[-g|-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver.
`[-e|-exclude-default-group]`: Exclude DNS servers from the default group
`[-set-mark mark]`: set mark on packets
`[-p|-proxy name]`: set proxy server
`[-b|-bootstrap-dns]`: set as bootstrap dns server
[-subnet]：set per server edns-client-subnet.
[-interface]: bind to interface. | server-tcp 8.8.8.8:53 |server-tls|Upstream TLS DNS server|None|Repeatable
`[ip][:port]`: Server IP, port optional.
`[-spki-pin [sha256-pin]]`: TLS verify SPKI value, a base64 encoded SHA256 hash
`[-host-name]`:TLS Server name. `-` to disable SNI name.
[-host-ip]: host ip address.
`[-tls-host-verify]`: TLS cert hostname to verify.
`[-k|-no-check-certificate]`: No check certificate.
`[-blacklist-ip]`: The "-blacklist-ip" parameter is to filtering IPs which is configured by "blacklist-ip".
`[-whitelist-ip]`: whitelist-ip parameter specifies that only the IP range configured in whitelist-ip is accepted.
`[-g|-group [group] ...]`: The group to which the DNS server belongs, such as office, foreign, use with nameserver.
`[-e|-exclude-default-group]`: Exclude DNS servers from the default group
`[-set-mark mark]`: set mark on packets
`[-p|-proxy name]`: set proxy server
`[-b|-bootstrap-dns]`: set as bootstrap dns server
[-subnet]：set per server edns-client-subnet.
[-interface]: bind to interface. | server-tls 8.8.8.8:853 @@ -69,6 +72,7 @@ hide: |nftset-debug|nftset debug enable|no|[yes\|no]|nftset-debug yes |domain-rules|set domain rules|None|domain-rules /domain/ [-rules...]
[-c\|-speed-check-mode]: set speed check mode, same as parameter `speed-check-mode`
[-a\|-address]: same as parameter `address`
[-n\|-nameserver]: same as parameter `nameserver`
[-p|-ipset]: same as parameter `nftset`
[-t\|-nftset]: same as parameter `nftset`
[-d\|-dualstack-ip-selection]: same as parameter `dualstack-ip-selection`
[-no-serve-expired]: disable serve expired
[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: same as parameter: `rr-ttl`, `rr-ttl-min`, `rr-ttl-max`
[-no-cache]：not cache this domain.
[-r\|-response-mode]：response mode, same as `response-mod`e
[-delete]: delete rule
[no-ip-alias]: ignore ip-alias rule|domain-rules /www.example.com/ -speed-check-mode none | domain-set | collection of domains|None| domain-set [options...]
[-n\|-name]: name of set
[-t\|-type] [list]: set type, only support list, one domain per line
[-f\|-file]: file path of domain set
used with address, nameserver, ipset, nftset, example: /domain-set:[name]/ | domain-set -name set -type list -file /path/to/list
address /domain-set:set/1.2.4.8 | +|client-rules| Client rules | None | [ip/subnet] [-g\|group group-name] [-rules...]
Set client rules and rule groups, the rule parameters are the same as bind, please refer to bind for specific parameter options. Generally used with group-begin, group-end. | client-rules 192.168.1.1 -g group-tv | |bogus-nxdomain|bogus IP address|None|[IP/subnet], Repeatable| bogus-nxdomain 1.2.3.4/16 |ignore-ip|ignore ip address|None|[ip/subnet], Repeatable| ignore-ip 1.2.3.4/16 |whitelist-ip|ip whitelist|None|[ip/subnet], Repeatable, When the filtering server responds IPs in the IP whitelist, only result in whitelist will be accepted| whitelist-ip 1.2.3.4/16 diff --git a/en/mkdocs.yml b/en/mkdocs.yml index 619483c05f..3690e7674b 100644 --- a/en/mkdocs.yml +++ b/en/mkdocs.yml @@ -87,9 +87,8 @@ nav: - Disable IPV6: 'config/block-ipv6.md' - Domain Forwarding: 'config/domain-forwarding.md' - Check Speed Mode: 'config/check-speed-mode.md' - - Security Related: 'config/security.md' - - Resolve Local Hostname: 'config/resolv-dnsmasq-lease.md' - - Bootstrap DNS: 'config/bootstrap-dns.md' + - Domain Rules: 'config/domain-rule.md' + - Client Rules: 'config/client-rule.md' - Domain Address: 'config/domain-address.md' - CNAME Alias Query: 'config/cname.md' - Domain Set: 'config/domain-set.md' @@ -99,8 +98,11 @@ nav: - IP Rule: 'config/ip-rule.md' - IP Set: 'config/ip-set.md' - IP Alias: 'config/ip-alias.md' + - Security Related: 'config/security.md' - Forwarding with IPSet: 'config/forwarding-with-ipset.md' - Edns Client Subnet: 'config/edns-client-subnet.md' + - Bootstrap DNS: 'config/bootstrap-dns.md' + - Resolve Local Hostname: 'config/resolv-dnsmasq-lease.md' - Configurations: 'configuration.md' - Compile: 'compile.md' - FAQ: 'faq.md' diff --git a/mkdocs.yml b/mkdocs.yml index 39be2c9925..070483c26b 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -87,9 +87,8 @@ nav: - 禁用IPV6: 'config/block-ipv6.md' - DNS分流: 'config/domain-forwarding.md' - 测速模式: 'config/check-speed-mode.md' - - 安全相关: 'config/security.md' - - 解析本地主机名: 'config/resolv-dnsmasq-lease.md' - - Bootstrap DNS: 'config/bootstrap-dns.md' + - 域名规则: 'config/domain-rule.md' + - 客户端规则: 'config/client-rule.md' - 域名地址: 'config/domain-address.md' - cname别名查询: 'config/cname.md' - 域名集合: 'config/domain-set.md' @@ -99,8 +98,11 @@ nav: - IP规则: 'config/ip-rule.md' - IP地址集合: 'config/ip-set.md' - IP别名: 'config/ip-alias.md' + - 安全相关: 'config/security.md' - 白名单分流请求: 'config/forwarding-with-ipset.md' - EDNS客户端子网: 'config/edns-client-subnet.md' + - Bootstrap DNS: 'config/bootstrap-dns.md' + - 解析本地主机名: 'config/resolv-dnsmasq-lease.md' - 更多指导: 'config/more.md' - 配置选项: 'configuration.md' - 编译: 'compile.md'