主页 / ubuntu / 问题 / 1526813
Accepted
bragdon
Asked: 2024-09-15 01:46:46 +0800 CST

dnsmasq 返回 HTTPS 而不是 NODATA

  • 772

我正在尝试使用 dnsmasq 在 ubuntu 服务器上为连接到 VPN 的人们设置 DNS。我不希望人们从此 VPN 搜索成人内容网站。

因此我安装了 dnsmask 并将其设置为使用主机列表，禁止大多数已知的成人内容网站：https://github.com/Sinfonietta/hostfiles/blob/master/pornography-hosts

对于 pornhub.com 它正在运行并且我收到以下日志：

dnsmasq[2438]: query[HTTPS] pornhub.com from 10.8.0.4
dnsmasq[2438]: forwarded pornhub.com to x:x:x:x:x:x:x:x
dnsmasq[2438]: query[A] pornhub.com from 10.8.0.4
dnsmasq[2438]: /etc/hosts-porn-content pornhub.com is 0.0.0.0
dnsmasq[2438]: reply pornhub.com is NODATA

但是，由于某种原因，当某个网站可以通过 ipv6 解析时，客户端仍然可以访问该网站。例如，即使 dnsmasq 在 /etc/hosts-porn-content 中找到配置，hanime.tv 仍可解析：

dnsmasq[2438]: query[HTTPS] hanime.tv from 10.8.0.4
dnsmasq[2438]: forwarded hanime.tv to x:x:x:x:x:x:x:x
dnsmasq[2438]: query[A] hanime.tv from 10.8.0.4
dnsmasq[2438]: /etc/hosts-porn-content hanime.tv is 0.0.0.0
dnsmasq[2438]: reply hanime.tv is <HTTPS>

这是我的 dnsmasq 配置：

# On systems which support it, dnsmasq binds the wildcard address,
# even when it is listening on only some interfaces. It then discards
# requests that it shouldn't reply to. This has the advantage of
# working even when interfaces come and go and change address. If you
# want dnsmasq to really bind only the interfaces it is listening on,
# uncomment this option. About the only time you may need this is when
# running another nameserver on the same machine.
bind-interfaces
clear-on-reload
filter-AAAA

# If you don't want dnsmasq to read /etc/hosts, uncomment the
# following line.
#no-hosts
# or if you want it to read another file, as well as /etc/hosts, use
# this.
addn-hosts=/etc/hosts-porn-content

systemd-resolve 配置：

[Resolve]
# Some examples of DNS servers which may be used for DNS= and FallbackDNS=:
# Cloudflare: 1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com
# Google:     8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
# Quad9:      9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
DNS=127.0.0.1
#FallbackDNS=
#Domains=
#DNSSEC=no
#DNSOverTLS=no
#MulticastDNS=no
#LLMNR=no
#Cache=no-negative
#CacheFromLocalhost=no
DNSStubListener=no
#DNSStubListenerExtra=
#ReadEtcHosts=yes
#ResolveUnicastSingleLabel=no

OpenVPN 配置使用 DNS：

# If enabled, this directive will configure
# all clients to redirect their default
# network gateway through the VPN, causing
# all IP traffic such as web browsing and
# and DNS lookups to go through the VPN
# (The OpenVPN server machine may need to NAT
# or bridge the TUN/TAP interface to the internet
# in order for this to work properly).
push "redirect-gateway def1"

# Certain Windows-specific network settings
# can be pushed to clients, such as DNS
# or WINS server addresses.  CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
# The addresses below refer to the public
# DNS servers provided by opendns.com.
push "dhcp-option DNS 10.8.0.1"

/etc/hosts内容：

127.0.0.1 localhost
127.0.1.1 serv

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

我尝试在运行 DNS 服务器的计算机上禁用 IPV6，但是客户端无法在网络上搜索任何内容...

并且 filter-AAAA 不起作用，至少我不明白它在做什么。

最后我通过执行以下操作清除 DNS 缓存：

resolvectl flush-caches
pkill -HUP dnsmasq
pkill -USR1 dnsmasq
server

1 个回答

  1. Best Answer

    我使用了这个配置：https://github.com/blocklistproject/Lists/blob/master/dnsmasq-version/porn-dnsmasq.txt

    小预览：

    # ------------------------------------[FILTERS]-------------------------------------
server=/xxxxxx.com/
server=/xxxxxx.com/

    每个 xxxx 都是目标网站的主机名。

    我在 编写此文件/etc/dnsmasq.d/*.conf。

    最后，我重新启动了 DNS 服务器，它终于阻止了 hanime.tv 网站......

    • 0

相关问题