v2.0.0-alpha3 #43
Replies: 5 comments 18 replies
-
|
Ok, lets see what's going on here... |
Beta Was this translation helpful? Give feedback.
-
oh yeah you're right. DoH's upstream should go back to |
Beta Was this translation helpful? Give feedback.
-
this is fixed in the latest commit. log is debug |
Beta Was this translation helpful? Give feedback.
-
this should also be fixed in the latest commit. |
Beta Was this translation helpful? Give feedback.
-
this screams "midbox" and MITM of DNS in ISP level. they don't do it on any other port other than 53 so it makes sense that the issue went away when you switched ports. they also don't do it on TCP either so you might benefit from trying that out. |
Beta Was this translation helpful? Give feedback.
-
Unfortunately it seems like that this is not the issue! I could able to setup other DNS servers (Technitium to be exact) which was working well with DoT only and even I was able to open censored websites, like twitter, youtube and etc., without any VPN connection while all IP location services was located me in IR. I think I lost my path to what I was looking for and now I am just running blindly to find my way out of this. |
Beta Was this translation helpful? Give feedback.
-
|
if your router works for ~60 seconds and stops working, but |
Beta Was this translation helpful? Give feedback.
-
|
I will test that. |
Beta Was this translation helpful? Give feedback.
-
|
DoH stopped working with this recent commit. SNI proxy log: DNS Client log: If I choose DNS Upstream rather than https type, tcp or udp for example, the output logs are: SNI Proxy log: |
Beta Was this translation helpful? Give feedback.
-
|
made some changes in DoQ, DoH and ACLs. it should be more stable now. check plese :) |
Beta Was this translation helpful? Give feedback.
-
|
thanks for you work @mosajjal First: the very basic setup seems to work! I query sniproxy on port 53 for netflix.com and get successfull Here are my issues:
see here my config: general:
# Upsteam DNS URI. examples: Upstream DNS URI. examples: udp://1.1.1.1:53, tcp://1.1.1.1:53, tcp-tls://1.1.1.1:853, https://dns.google/dns-query
upstream_dns: udp://8.8.8.8:53
# Use a SOCKS proxy for upstream HTTP/HTTPS traffic. Example: socks5://admin:
upstream_socks5: socks5://100.80.14.76:1080
# DNS Port to listen on. Should remain 53 in most cases
bind_dns_over_udp: "0.0.0.0:53"
# enable DNS over TCP. empty disables it. example: "127.0.0.1:53"
bind_dns_over_tcp:
# enable DNS over TLS. empty disables it. example: "127.0.0.1:853"
bind_dns_over_tls:
# enable DNS over QUIC. empty disables it. example: "127.0.0.1:8853"
bind_dns_over_quic:
# Path to the certificate for DoH, DoT and DoQ. eg: /tmp/mycert.pem
tls_cert:
# Path to the certificate key for DoH, DoT and DoQ. eg: /tmp/mycert.key
tls_key:
# HTTP Port to listen on. Should remain 80 in most cases
bind_http: "0.0.0.0:80"
# HTTPS Port to listen on. Should remain 443 in most cases
bind_https: "0.0.0.0:443"
# Enable prometheus endpoint on IP:PORT. example: 127.0.0.1:8080. Always exposes /metrics and only supports HTTP
bind_prometheus:
# Interface used for outbound TLS connections. uses OS prefered one if empty
interface:
# Public IPv4 of the server, reply address of DNS A queries
public_ipv4:
# Public IPv6 of the server, reply address of DNS AAAA queries
public_ipv6:
# log level for the application. choices: debug, info, warn, error
log_level: debug
acl:
geoip:
enabled: false
priority: 10
# strictly blocked countries
blocked:
# allowed countries
allowed:
# Path to the MMDB file. eg: /tmp/Country.mmdb, https://raw.githubusercontent.com/Loyalsoldier/geoip/release/Country.mmdb
path:
# Interval to re-fetch the MMDB file
refresh_interval: 24h0m0s
# domain filtering
domain:
enabled: true # false means ALL domains will be allowed to go through the proxy
# priority of the domain filter. lower priority means it's checked first. if multiple filters have the same priority, they're checked in random order
priority: 20
# Path to the domain list. eg: /tmp/domainlist.csv. Look at the example file for the format.
path: /root/sniproxy/domains.csv
# Interval to re-fetch the domain list
refresh_interval: 0h2m0s
# IP/CIDR filtering
cidr:
enabled: false
# priority of the cidr filter. lower priority means it's checked first. if multiple filters have the same priority, they're checked in random order
priority: 30
# Path to the CIDR list. eg: /tmp/cidr.csv. Look at the example file for the format.
path:
# Interval to re-fetch the domain list
refresh_interval: 1h0m0s
# FQDN override. This ACL is used to override the destination IP to not be the one resolved by the upstream DNS or the proxy itself, rather a custom IP and port
# if the destination is HTTP, it uses tls_cert and tls_key certificate to terminate the original connection.
override:
enabled: false
# priority of the override filter. lower priority means it's checked first. if multiple filters have the same priority, they're checked in random order
priority: 40the domain.csv only contains two entries: netflix.com.,suffix
netflix.de,suffixany ideas? |
Beta Was this translation helpful? Give feedback.
-
|
that's for checking @holygrolli! both issues acknowledged. in the latest commit (which is not a release yet) the DNS issue is fixed. as for the logging, I'm thinking of changing the logging platform back to a more standard one that doesn't have so many issues. planning to release 2.0.0-beta1 this week. both issues should be fixed by then. |
Beta Was this translation helpful? Give feedback.
-
|
let's close this and continue over at #45. please make sure you're using the latest version! |
Beta Was this translation helpful? Give feedback.
-
sniproxy v2 now has an official alpha release! there are a lot of changes since v1 and even since a few commits ago in v2. native DoH support is here!
Test and provide feedback. I'm sure this release is buggy af
Beta Was this translation helpful? Give feedback.
All reactions