{"action":"created","issue":{"url":"https://api.github.com/repos/hackgfw/openwrt-gfw/issues/37","labels_url":"https://api.github.com/repos/hackgfw/openwrt-gfw/issues/37/labels{/name}","comments_url":"https://api.github.com/repos/hackgfw/openwrt-gfw/issues/37/comments","events_url":"https://api.github.com/repos/hackgfw/openwrt-gfw/issues/37/events","html_url":"https://github.com/hackgfw/openwrt-gfw/issues/37","id":53835928,"number":37,"title":"怎么调试新版AntiDNSPoisoning？","user":{"login":"zhiyin-im","id":7808063,"avatar_url":"https://avatars.githubusercontent.com/u/7808063?v=3","gravatar_id":"","url":"https://api.github.com/users/zhiyin-im","html_url":"https://github.com/zhiyin-im","followers_url":"https://api.github.com/users/zhiyin-im/followers","following_url":"https://api.github.com/users/zhiyin-im/following{/other_user}","gists_url":"https://api.github.com/users/zhiyin-im/gists{/gist_id}","starred_url":"https://api.github.com/users/zhiyin-im/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhiyin-im/subscriptions","organizations_url":"https://api.github.com/users/zhiyin-im/orgs","repos_url":"https://api.github.com/users/zhiyin-im/repos","events_url":"https://api.github.com/users/zhiyin-im/events{/privacy}","received_events_url":"https://api.github.com/users/zhiyin-im/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-01-09T05:48:41Z","updated_at":"2015-01-12T16:28:08Z","closed_at":null,"body":"搜了下递归DNS，还是没明白原理。老版逐步安装配置PPTPVPN+新版AntiDNSPoisoning，会不停重连VPN。而老版逐步安装配置PPTPVPN本身可以单独正常运行。已经在/etc/ppp/ip-up.d/ip-up-wall添加了iptables -t mangle -A PREROUTING -p udp --dport 53 -m set ! --match-set whiteip src -m set ! --match-set whiteip dst -m set ! --match-set china dst -j MARK --set-mark 0xffff"},"comment":{"url":"https://api.github.com/repos/hackgfw/openwrt-gfw/issues/comments/69597539","html_url":"https://github.com/hackgfw/openwrt-gfw/issues/37#issuecomment-69597539","issue_url":"https://api.github.com/repos/hackgfw/openwrt-gfw/issues/37","id":69597539,"user":{"login":"zhiyin-im","id":7808063,"avatar_url":"https://avatars.githubusercontent.com/u/7808063?v=3","gravatar_id":"","url":"https://api.github.com/users/zhiyin-im","html_url":"https://github.com/zhiyin-im","followers_url":"https://api.github.com/users/zhiyin-im/followers","following_url":"https://api.github.com/users/zhiyin-im/following{/other_user}","gists_url":"https://api.github.com/users/zhiyin-im/gists{/gist_id}","starred_url":"https://api.github.com/users/zhiyin-im/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhiyin-im/subscriptions","organizations_url":"https://api.github.com/users/zhiyin-im/orgs","repos_url":"https://api.github.com/users/zhiyin-im/repos","events_url":"https://api.github.com/users/zhiyin-im/events{/privacy}","received_events_url":"https://api.github.com/users/zhiyin-im/received_events","type":"User","site_admin":false},"created_at":"2015-01-12T16:28:08Z","updated_at":"2015-01-12T16:28:08Z","body":"nslookup www.google.com返回的还是香港的IP，DNS没走通VPN？已经在/etc/ppp/ip-up.d/ip-up-wall添加了\r\niptables -t mangle -A PREROUTING -p udp --dport 53 -m set ! --match-set whiteip src -m set ! --match-set whiteip dst -m set ! --match-set china dst -j MARK --set-mark 0xffff\r\n没写对？\r\n\r\n/etc/ppp/ip-up.d/ip-up-wall\r\nPPP_IFACE=\"$1\";\r\nPPP_TTY=\"$2\";\r\nPPP_SPEED=\"$3\";\r\nPPP_LOCAL=\"$4\";\r\nPPP_REMOTE=\"$5\";\r\nPPP_IPPARAM=\"$6\";\r\n\r\nip_up_wall() {\r\n        ip route del default via $PPP_REMOTE\r\n\r\n        CHKIPSET=$(ipset -L china | wc -l)\r\n        if [ \"$CHKIPSET\" == \"0\" ]; then\r\n                ipset -N china nethash --hashsize 32768\r\n\r\n                # for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/cn.zone)\r\n                for IP in $(cat /etc/config/cn.zone)\r\n                do\r\n                        ipset -A china $IP\r\n                done\r\n\r\n                ipset -A china 10.0.0.0/8\r\n                ipset -A china 172.16.0.0/12\r\n                ipset -A china 192.168.0.0/16\r\n        fi\r\n\r\n        CHKIPSET=$(ipset -L whiteip | wc -l)\r\n        if [ \"$CHKIPSET\" == \"0\" ]; then\r\n                ipset -N whiteip iphash --hashsize 128\r\n                for IP in $(cat /etc/config/ip.whitelist)\r\n                do\r\n                        ipset -A whiteip $IP\r\n                done\r\n        fi\r\n\r\n        iptables -t mangle -A PREROUTING -p tcp -m set ! --match-set whiteip src -m set ! --match-set whiteip dst -m set ! --match-set china dst -m multiport --dports 80,443,1935 -j MARK --set-mark 0xffff\r\n        iptables -t mangle -A OUTPUT -p tcp -m set ! --match-set whiteip src -m set ! --match-set whiteip dst -m set ! --match-set china dst -m multiport --dports 80,443,1935 -j MARK --set-mark 0xffff\r\n        iptables -t mangle -A FORWARD -p tcp -m set ! --match-set whiteip src -m set ! --match-set whiteip dst -m set ! --match-set china dst -m multiport --dports 80,443,1935 -j MARK --set-mark 0xffff\r\n\tiptables -t mangle -A PREROUTING -p udp --dport 53 -m set ! --match-set whiteip src -m set ! --match-set whiteip dst -m set ! --match-set china dst -j MARK --set-mark 0xffff\r\n\r\n        CHKIPROUTE=$(grep wall /etc/iproute2/rt_tables)\r\n        if [ -z \"$CHKIPROUTE\" ]; then\r\n                echo \"11 wall\" >> /etc/iproute2/rt_tables\r\n        fi\r\n\r\n        ip route add table wall default via $PPP_LOCAL\r\n        ip rule add fwmark 0xffff table wall priority 1\r\n}\r\n\r\nif [ \"$PPP_IFACE\" == \"pptp-wall\" ]; then\r\n        ip_up_wall\r\nfi\r\n"}}