Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: 当前默认DNS配置可能导致DNS泄露 #6416

Closed
2 tasks done
CharlesWou opened this issue Jan 3, 2025 · 1 comment
Closed
2 tasks done

[Bug]: 当前默认DNS配置可能导致DNS泄露 #6416

CharlesWou opened this issue Jan 3, 2025 · 1 comment
Labels
bug Something isn't working

Comments

@CharlesWou
Copy link

CharlesWou commented Jan 3, 2025

预期情况

外网DNS解析,直接优先使用1.1.1.1解析

实际情况

外网DNS解析,会先尝试223.5.5.5解析,解析出IP不在geoip:cn后,才再次尝试使用1.1.1.1解析。
这样会导致:你向墙内通告你要访问外网了,DNS泄露【你要访问的网站以此发现你在用代理】(谷歌搜索任一“DNS泄露检测”网站,如果检测出DNS中有中国,则泄露,如果都是外国则不泄露)

复现方法

日志调成info
IPIfNonMatch或IPOnDemand
V3-绕过大陆(已移除最后一条兜底proxy)
访问国际网:apresolve.spotify.com

日志信息

日志会显示:先尝试223.5.5.5解析,解析出IP不在geoip:cn后,才再次尝试使用1.1.1.1解析
详情见链接中“客户端日志”

额外信息

按照下方贴的配置解决了,实现的效果是:

  1. 外网(!geosite:cn)直接用1.1.1.1解析
  2. 某些国内小众网址,虽不在geosite:cn,但会因为解析结果的IP是geoip:cn,而再次尝试223.5.5.5解析
  3. 国内(geosite:cn)用223.5.5.5解析。
  4. 且再次使用“DNS泄露检测”网址检测,不再出现中国DNS。
    {
    "hosts": {
    "dns.google": "8.8.8.8",
    "proxy.example.com": "127.0.0.1"
    },
    "servers": [
    {
    "address": "1.1.1.1",
    "domains": [
    "geosite:geolocation-!cn"
    ],
    "expectIPs": [
    "geoip:!cn"
    ]
    },
    {
    "address": "223.5.5.5",
    "domains": [
    "geosite:cn"
    ],
    "expectIPs": [
    "geoip:cn"
    ]
    },
    "https://dns.google/dns-query"
    ]
    }

我确认已更新至最新版本

我确认已查询历史issues

@CharlesWou CharlesWou added the bug Something isn't working label Jan 3, 2025
2dust added a commit that referenced this issue Jan 4, 2025
@2dust
Copy link
Owner

2dust commented Jan 4, 2025

https://github.com/2dust/v2rayN/releases/tag/7.5.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants