fix: dnsmasq DNS server entries use /#/ wildcard; disable strict-order; set no-resolv#491
Open
li3p wants to merge 1 commit into
Open
fix: dnsmasq DNS server entries use /#/ wildcard; disable strict-order; set no-resolv#491li3p wants to merge 1 commit into
li3p wants to merge 1 commit into
Conversation
…r; set no-resolv Previously, only the first `server=` line used the `/#/` catch-all wildcard, while extra DNS instances generated by `dns_count` used plain `server=` entries. In dnsmasq, domain-specific directives have higher priority than generic ones, so the extra ports (5301, 5302, ...) could be starved by the first catch-all rule and never queried effectively. Also, keep `strict-order` disabled and explicitly set `no-resolv`: - Without `strict-order`, dnsmasq can query any known-up upstream and prefer healthy servers, improving failover and reducing head-of-line blocking. - `no-resolv` prevents fallback to resolvers from `/tmp/resolv.conf*` (often ISP DNS on OpenWrt WAN). This is critical to avoid polluted DNS answers, especially for blocked domains that have no IPv6 records, where leaked ISP DNS resolution can bypass intended Xray DNS behavior. Changes: - Add `/#/` wildcard to all generated `server=` lines so all configured Xray DNS ports are treated uniformly. - Keep `strict-order` disabled (commented out in template). - Add `no-resolv` to ensure dnsmasq only uses configured Xray DNS upstreams. - Start extra-port loop from `dns_port + 1` to avoid duplicate first entry. References: - dnsmasq man page (-o/--strict-order, -R/--no-resolv): https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, only the first
server=line used the/#/catch-all wildcard,while extra DNS instances generated by
dns_countused plainserver=entries. In dnsmasq, domain-specific directives have higher priority than
generic ones, so the extra ports (5301, 5302, ...) could be starved by the
first catch-all rule and never queried effectively.
Also, keep
strict-orderdisabled and explicitly setno-resolv:strict-order, dnsmasq can query any known-up upstream and preferhealthy servers, improving failover and reducing head-of-line blocking.
no-resolvprevents fallback to resolvers from/tmp/resolv.conf*(oftenISP DNS on OpenWrt WAN). This is critical to avoid polluted DNS answers,
especially for blocked domains that have no IPv6 records, where leaked ISP
DNS resolution can bypass intended Xray DNS behavior.
Changes:
/#/wildcard to all generatedserver=lines so all configured XrayDNS ports are treated uniformly.
strict-orderdisabled (commented out in template).no-resolvto ensure dnsmasq only uses configured Xray DNS upstreams.dns_port + 1to avoid duplicate first entry.References:
https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html