使用overture替换dnsmasq做域名分流解析
20210617更新：RouterOS使用DNS转发功能实现域名分流解析
之前分享过使用dnsmasq基于大陆域名白名单分流解析域名，这种办法受限于白名单列表的更新，列表总是滞后于网站实际使用的域名，造成一些境内网站cdn解析到了境外，影响境内网站打开速度。
由于gfw的dns污染只会使用境外地址和私有地址，可以利用这个特性做dns分流解析：所有域名用境内dns服务器解析，如果域名解析得到境内ip则直接采用，如果得到境外ip则使用境外dns服务器解析。
开源软件overture就可以实现这个功能。overture有AB两组dns服务器，AB组各有一个IP列表和域名列表，假设A组为境内dns服务器，A的ip列表是大陆IP列表，A的域名列表是境内域名白名单，B的域名列表是被墙的域名gfwlist。
下面是overture的安装及配置步骤
安装脚本overture_install.sh
#! /bin/bash
apt update && apt install curl wget unzip
wget -q https://github.com/shawn1m/overture/releases/download/v1.7/overture-linux-amd64.zip
unzip overture-linux-amd64.zip "overture-linux-amd64"
mv overture-linux-amd64 /sbin/overture
cat << EOF > /lib/systemd/system/overture.service
[Unit]
Description=overture-dns-server
After=syslog.target network-online.target
[Service]
ExecStart=/sbin/overture -c /etc/overture/config.yml
StandardOutput=syslog
Restart=on-abnormal
[Install]
WantedBy=multi-user.target
EOF
mkdir /etc/overture
cat << EOF > /etc/overture/config.yml
bindAddress: :53
debugHTTPAddress:
dohEnabled: false
primaryDNS:
- name: dns1
address: 114.114.114.114:53
protocol: udp
socks5Address:
timeout: 2
ednsClientSubnet:
policy: disable
externalIP:
noCookie: true
- name: dns2
address: 223.5.5.5:53
protocol: udp
socks5Address:
timeout: 2
ednsClientSubnet:
policy: disable
externalIP:
noCookie: true
alternativeDNS:
- name: google8888
address: 8.8.8.8:53
protocol: udp
socks5Address:
timeout: 3
ednsClientSubnet:
policy: disable
externalIP:
noCookie: true
- name: google8844
address: 8.8.4.4:53
protocol: udp
socks5Address:
timeout: 3
ednsClientSubnet:
policy: disable
externalIP:
noCookie: true
onlyPrimaryDNS: false
ipv6UseAlternativeDNS: false
alternativeDNSConcurrent: true
whenPrimaryDNSAnswerNoneUse: alternativeDNS
ipNetworkFile:
primary: /etc/overture/china_ip_list.txt
alternative: /etc/overture/china_ip_list.txt
domainFile:
primary: /etc/overture/china_list.txt
alternative: /etc/overture/gfw_list.txt
matcher: suffix-tree
hostsFile:
hostsFile:
finder: full-map
minimumTTL: 0
domainTTLFile:
cacheSize: 0
cacheRedisUrl:
cacheRedisConnectionPoolSize:
rejectQType:
- 255
EOF
systemctl enable overture
列表更新脚本 overture_update_fliters.sh，首次运行overture前需要执行此脚本。
#! /bin/bash
cd /etc/overture
rm china_list.txt gfw_list.txt china_ip_list.txt
curl -s https://raw.githubusercontent.com/17mon/china_ip_list/master/china_ip_list.txt > china_ip_list.txt
curl -s https://raw.githubusercontent.com/felixonmars/dnsmasq-china-list/master/accelerated-domains.china.conf | sed 's/server=\///g;s/\/114.114.114.114//g' > china_list1.txt
curl -s https://raw.githubusercontent.com/hq450/fancyss/master/rules/WhiteList_new.txt | sed 's/Server=\///g;s/\///g' > china_list2.txt
cat china_list1.txt china_list2.txt | sort -u > china_list.txt
rm china_list1.txt china_list2.txt
curl -s https://raw.githubusercontent.com/Loukky/gfwlist-by-loukky/master/gfwlist.txt | base64 -d | sort -u | sed '/^$\|@@/d'| sed 's#!.\+##; s#|##g; s#@##g; s#http:\/\/##; s#https:\/\/##;' | sed '/\*/d; /apple\.com/d; /sina\.cn/d; /sina\.com\.cn/d; /baidu\.com/d; /qq\.com/d' | sed '/^[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+$/d' | grep '^[0-9a-zA-Z\.-]\+$' | grep '\.' | sed 's#^\.\+##' | sort -u > gfwlist.txt
curl -s https://raw.githubusercontent.com/hq450/fancyss/master/rules/gfwlist.conf | sed 's/ipset=\/\.//g; s/\/gfwlist//g; /^server/d' > koolshare.txt
cat gfwlist.txt koolshare.txt | sort -u > gfw_list.txt
rm gfwlist.txt koolshare.txt
systemctl restart overture
配置定时任务定期更新overture的域名和IP列表
0 3 * * 1 /root/overture_update_fliters.sh
