diff --git a/docs/config/ip-alias.md b/docs/config/ip-alias.md new file mode 100644 index 0000000..b4f1381 --- /dev/null +++ b/docs/config/ip-alias.md @@ -0,0 +1,100 @@ +--- +hide: + - toc +--- + +# IP别名 + +smartdns提供了IP地址别名映射功能，可以将查询结果中的IP或IP段映射为特定IP地址； +此特性可用用于具有anycast IP的CDN网络加速。比如Cloudflare的CDN加速。 + +## IP别名映射 + +映射指定的IP地址到目标地址，如将1.2.3.4的C类地址全部映射到192.168.1.1 + +``` +ip-alias 1.2.3.4/24 192.168.1.1 +``` + +## 设置特定域名忽略IP别名 + +某些情况下，需要设置特定域名的结果不进行IP别名转换，则可通过域名规则忽略IP别名。 + +``` +domain-rules /example.com/ -no-ip-alias +``` + + +## Cloudflare CDN加速 + +Cloudflare CDN的IP地址都是anycast IP地址，用户可通过任意Cloudflare的IP地址来访问其托管的网站。 +通过此特性，我们可以找到自己网络访问Cloudflare CDN最快的IP地址，并设置IP别名，来加速所有托管在Cloudflare上的网站。 + +其步骤如下： + +### 获取Cloudflare的IP地址范围并保持为IP列表文件 + +Cloudflare公开了其CDN的IP地址范围，具体范围在这里可以找到https://www.cloudflare.com/ips/ + +IPV4：https://www.cloudflare.com/ips-v4/# +IPV6：https://www.cloudflare.com/ips-v6/# + +将上述列表保存为文本，比如：`cloudflare-ipv4.txt`, `cloudflare-ipv6.txt` + +* cloudflare-ipv4.txt +``` +173.245.48.0/20 +103.21.244.0/22 +103.22.200.0/22 +103.31.4.0/22 +141.101.64.0/18 +108.162.192.0/18 +190.93.240.0/20 +188.114.96.0/20 +197.234.240.0/22 +198.41.128.0/17 +162.158.0.0/15 +104.16.0.0/13 +104.24.0.0/14 +172.64.0.0/13 +131.0.72.0/22 +``` + +* cloudflare-ipv6.txt +``` +2400:cb00::/32 +2606:4700::/32 +2803:f800::/32 +2405:b500::/32 +2405:8100::/32 +2a06:98c0::/29 +2c0f:f248::/32 +``` + +### 查找本网络访问Cloudflare最快的IP + +社区提供了找到最快Cloudflare IP地址的工具：[CloudflareSpeedTest](https://github.com/XIU2/CloudflareSpeedTest)，我们可以使用此工具找到最快的IP地址。 + +对应命令如下 + +``` +./CloudflareSpeedTest -url https://down.heleguo.top/download/100MB.zip +``` + +执行成功后，将会获得最快的IP地址。 +由于工具随机使用了一些IP地址测速，可以多执行几次上述命令，以确保获取到最快IP地址。 + +### 配置smartdns加速 + +原理是通过ip-alias命令将Cloudflare的整个anycast IP映射到CloudflareSpeedTest获取到的最快的IP地址上。 +配置smartdns如下 + +``` +# 设置Cloudflare IPV4别名映射 +ip-set -name cloudflare-ipv4 -file /path/to/cloudflare-ipv4.txt +ip-rules ip-set:cloudflare-ipv4 -ip-alias 162.159.58.17,162.159.58.124 + +# 设置Cloudflare IPV6别名映射 +ip-set -name cloudflare-ipv6 -file /path/to/cloudflare-ipv6.txt +ip-rules ip-set:cloudflare-ipv6 -ip-alias 2606:4700:17:d8e7:5e98:7d62:6674:c5a7 +``` diff --git a/docs/config/ip-rule.md b/docs/config/ip-rule.md index dbecbdc..69be2c4 100644 --- a/docs/config/ip-rule.md +++ b/docs/config/ip-rule.md @@ -9,10 +9,11 @@ smartdns提供了IP地址黑白名单和忽略相关的结果。 |参数|功能|使用场景| |---|---|---| -|whitelist-ip|白名单 IP 地址|接受在指定范围内的IP地址设置 -|blacklist-ip|黑名单 IP 地址|接受在指定范围外的IP地址设置 +|whitelist-ip|白名单 IP 地址|接受在指定范围内的IP地址设置。 +|blacklist-ip|黑名单 IP 地址|接受在指定范围外的IP地址设置。 |ignore-ip|忽略 IP 地址|不需要某个IP地址，或IP地址段时设置。 -|bogus-nxdomain|假冒 IP 地址过滤|请求结果包含对应IP地址时，返回SOA +|bogus-nxdomain|假冒 IP 地址过滤|请求结果包含对应IP地址时，返回SOA。 +|ip-alias|IP别名规则|IP地址映射，可用于具备Anycast IP的CDN加速，比如Cloudflare的CDN。参考[IP别名](../config/ip-alias.md)。 ## 白名单IP地址 diff --git a/docs/config/ip-set.md b/docs/config/ip-set.md new file mode 100644 index 0000000..827a041 --- /dev/null +++ b/docs/config/ip-set.md @@ -0,0 +1,29 @@ +--- +hide: + - toc +--- + +# IP地址集合的使用 + +为方便按集合配置IP地址，对于使用到`ip/subnet`的配置，可以指定IP地址集合，方便维护。具体方法为： + +1. 使用`ip-set`配置集合文件，如 + + ```shell + ip-set -name cloudflare -file /etc/smartdns/cloudflare-list.conf + ``` + + cloudflare-list.conf的格式为一个IP地址一行，如 + + ```shell + 1.2.3.4 + 192.168.1.1/24 + ``` + +1. 在有`ip/subnet`配置的选项使用IP地址集合，只需要将`ip/subnet`配置为`ip-set:[集合名称]/`即可，如： + + ```shell + ignore-ip ip-set:cloudflare + ip-rules ip-set:cloudflare -whitelist-ip + ip-alias ip-set:cloudflare 192.168.1.1 + ``` diff --git a/docs/configuration.md b/docs/configuration.md index b774606..d3377ee 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -64,12 +64,15 @@ hide: | nftset-timeout | 设置 nftset 超时功能启用 | no | [yes\|no] | nftset-timeout yes | | nftset-no-speed | 当测速失败时，将域名结果设置到nftset集合中 | 无 | nftset-no-speed [#4\|#6]:[family#nftable#nftset][,#[4\|6]:[family#nftable#nftset]]]
ipv4 地址的 family 只支持 inet 和 ip
ipv6 地址的 family 只支持 inet 和 ip6
由于 nft 限制，两种地址只能分开存放于两个 set 中。| nftset-no-speed #4:inet#tab#set4| | nftset-debug | 设置 nftset 调试功能启用 | no | [yes\|no] | nftset-debug yes | -| domain-rules | 设置域名规则 | 无 | domain-rules /domain/ [-rules...]
[-c\|-speed-check-mode]：测速模式，参考 speed-check-mode 配置
[-a\|-address]：参考 address 配置
[-n\|-nameserver]：参考 nameserver 配置
[-p\|-ipset]：参考ipset配置
[-t\|-nftset]：参考nftset配置
[-d\|-dualstack-ip-selection]：参考 dualstack-ip-selection
[-no-serve-expired]：禁用过期缓存
[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: 参考配置rr-ttl, rr-ttl-min, rr-ttl-max
[-no-cache]：不缓存当前域名
[-r\|-response-mode]：响应模式，参考 response-mode 配置
[-delete]：删除对应的规则 | domain-rules /www.example.com/ -speed-check-mode none | +| domain-rules | 设置域名规则 | 无 | domain-rules /domain/ [-rules...]
[-c\|-speed-check-mode]：测速模式，参考 speed-check-mode 配置
[-a\|-address]：参考 address 配置
[-n\|-nameserver]：参考 nameserver 配置
[-p\|-ipset]：参考ipset配置
[-t\|-nftset]：参考nftset配置
[-d\|-dualstack-ip-selection]：参考 dualstack-ip-selection
[-no-serve-expired]：禁用过期缓存
[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: 参考配置rr-ttl, rr-ttl-min, rr-ttl-max
[-no-cache]：不缓存当前域名
[-r\|-response-mode]：响应模式，参考 response-mode 配置
[-delete]：删除对应的规则
[no-ip-alias]: 忽略ip别名规则| domain-rules /www.example.com/ -speed-check-mode none | | domain-set | 设置域名集合 | 无 | domain-set [options...]
[-n\|-name]：域名集合名称
[-t\|-type]：域名集合类型，当前仅支持list，格式为域名列表，一行一个域名。
[-f\|-file]：域名集合文件路径。
选项需要配合address, nameserver, ipset, nftset等需要指定域名的地方使用，使用方式为 /domain-set:[name]/| domain-set -name set -type list -file /path/to/list
address /domain-set:set/1.2.4.8 | | bogus-nxdomain | 假冒 IP 地址过滤 | 无 | [ip/subnet]，可重复 | bogus-nxdomain 1.2.3.4/16 | | ignore-ip | 忽略 IP 地址 | 无 | [ip/subnet]，可重复 | ignore-ip 1.2.3.4/16 | | whitelist-ip | 白名单 IP 地址 | 无 | [ip/subnet]，可重复 | whitelist-ip 1.2.3.4/16 | | blacklist-ip | 黑名单 IP 地址 | 无 | [ip/subnet]，可重复 | blacklist-ip 1.2.3.4/16 | +| ip-alias | IP 地址别名 | 无 | [ip/subnet] ip1[,[ip2]...]，可重复 | ip-alias 1.2.3.4/16 4.5.6.7| +| ip-rules | IP 地址规则 | 无 | [ip/subnet] [-rules...]
[-blacklist-ip]: 参考 blacklist-ip
[-whitelist-ip]: 参考 whitelist-ip
[-bogus-nxdomain]: 参考 bogus-nxdomain
[-ignore-ip]: 参考 ignore-ip
[-ip-alias]: 参考 ip-alias
| ip-rules 1.2.3.4/16 -whitelist-ip| +| ip-set | 设置 IP 地址集合 | 无 | ip-set [options...]
[-n\|-name]：IP地址集合名称
[-t\|-type]：IP地址集合类型，当前仅支持list，格式为IP地址列表，一行一个IP地址。
[-f\|-file]：IP地址集合文件路径。
选项需要配合ip-rules, ip-alias等需要指定IP地址的地方使用，使用方式为 ip-set:[name]| ip-set -name set -type list -file /path/to/list
ip-rules ip-set:set -whitelist-ip| | force-AAAA-SOA | 强制 AAAA 地址返回 SOA | no | [yes\|no] | force-AAAA-SOA yes | | force-qtype-SOA | 强制指定 qtype 返回 SOA | qtype id | [qtypeid\|idstart-idend\|...] | force-qtype-SOA 65 28 128-256 | prefetch-domain | 域名预先获取功能 | no | [yes\|no] | prefetch-domain yes | diff --git a/en/docs/config/ip-alias.md b/en/docs/config/ip-alias.md new file mode 100644 index 0000000..2f93054 --- /dev/null +++ b/en/docs/config/ip-alias.md @@ -0,0 +1,100 @@ +--- +hide: + - toc +--- + +# IP Alias + +SmartDNS provides IP address alias mapping, which can map the IP or IP range in the query result to a specific IP address. +This feature can be used for CDN network acceleration with anycast IP, such as Cloudflare's CDN acceleration. + +## IP Alias Mapping + +Map the specified IP address to the target address, such as mapping the C class address of 1.2.3.4 to 192.168.1.1. + +``` +ip-alias 1.2.3.4/24 192.168.1.1 +``` + +## Ignore IP Alias for Specific Domains + +In some cases, it may be necessary to exclude specific domains from IP alias mapping. This can be achieved by using domain rules to ignore IP alias mapping for those domains. + +``` +domain-rules /example.com/ -no-ip-alias +``` + + +## Cloudflare CDN Acceleration + +Cloudflare CDN's IP addresses are all anycast IP addresses, and users can access websites hosted on Cloudflare through any Cloudflare IP address. +With this feature, we can find the fastest IP address for accessing Cloudflare CDN on our own network and set up IP aliases to speed up all websites hosted on Cloudflare. + +Here are the steps: + +### Get the IP address range of Cloudflare and save it as an IP list file + +Cloudflare has publicly disclosed the IP address range of its CDN, which can be found here: https://www.cloudflare.com/ips/ + +IPv4: https://www.cloudflare.com/ips-v4/# +IPv6: https://www.cloudflare.com/ips-v6/# + +Save the above list as a text file, such as: `cloudflare-ipv4.txt`, `cloudflare-ipv6.txt` + +* cloudflare-ipv4.txt +``` +173.245.48.0/20 +103.21.244.0/22 +103.22.200.0/22 +103.31.4.0/22 +141.101.64.0/18 +108.162.192.0/18 +190.93.240.0/20 +188.114.96.0/20 +197.234.240.0/22 +198.41.128.0/17 +162.158.0.0/15 +104.16.0.0/13 +104.24.0.0/14 +172.64.0.0/13 +131.0.72.0/22 +``` + +* cloudflare-ipv6.txt +``` +2400:cb00::/32 +2606:4700::/32 +2803:f800::/32 +2405:b500::/32 +2405:8100::/32 +2a06:98c0::/29 +2c0f:f248::/32 +``` + +### Find the Fastest IP Address to Access Cloudflare on Your Network + +The community provides a tool to find the fastest Cloudflare IP address: [CloudflareSpeedTest](https://github.com/XIU2/CloudflareSpeedTest). We can use this tool to find the fastest IP address. + +The corresponding command is as follows: + +``` +./CloudflareSpeedTest -url https://down.heleguo.top/download/100MB.zip +``` + +After successful execution, you will get the fastest IP address. +Since the tool randomly uses some IP addresses for testing, you can execute the above command multiple times to ensure that you get the fastest IP address. + +### Configure SmartDNS acceleration + +The principle is to use the ip-alias command to map the entire anycast IP of Cloudflare to the fastest IP address obtained from CloudflareSpeedTest. +Configure SmartDNS as follows: + +``` +# Set up Cloudflare IPV4 alias mapping +ip-set -name cloudflare-ipv4 -file /path/to/cloudflare-ipv4.txt +ip-rules ip-set:cloudflare-ipv4 -ip-alias 162.159.58.17,162.159.58.124 + +# Set up Cloudflare IPV6 alias mapping +ip-set -name cloudflare-ipv6 -file /path/to/cloudflare-ipv6.txt +ip-rules ip-set:cloudflare-ipv6 -ip-alias 2606:4700:17:d8e7:5e98:7d62:6674:c5a7 +``` diff --git a/en/docs/config/ip-rule.md b/en/docs/config/ip-rule.md index 319b7be..c1a915b 100644 --- a/en/docs/config/ip-rule.md +++ b/en/docs/config/ip-rule.md @@ -13,6 +13,7 @@ smartdns provides IP address whitelist, blacklist and ignore rules for filtering | blacklist-ip | Blacklist IP address | Accept IP addresses outside a specified range | | ignore-ip | Ignore IP address | Do not use a specific IP address, or range of IP addresses | | bogus-nxdomain | Spoof IP address filtering | Return SOA when the requested result contains a specified IP address | +| ip-alias |IP Alias|IP Address Mapping，Can be used for CDN acceleration with Anycast IP, such as Cloudflare's CDN. refer to [IP Alias](../config/ip-alias.md)。 ## Whitelist IP addresses diff --git a/en/docs/config/ip-set.md b/en/docs/config/ip-set.md new file mode 100644 index 0000000..f557583 --- /dev/null +++ b/en/docs/config/ip-set.md @@ -0,0 +1,29 @@ +--- +hide: + - toc +--- + +# Using IP Address Sets + +To facilitate the configuration of IP addresses according to sets, for configurations that use `ip/subnet`, IP address sets can be specified for easy maintenance. The specific method is as follows: + +1. Use ip-set to configure the set file, such as + + ```shell + ip-set -name cloudflare -file /etc/smartdns/cloudflare-list.conf + ``` + + The format of cloudflare-list.conf is one IP address per line, such as: + + ```shell + 1.2.3.4 + 192.168.1.1/24 + ``` + +1. Use IP address sets for options with `ip/subnet` configurations, simply configure `ip/subnet` as `ip-set:[set name]`, such as: + + ```shell + ignore-ip ip-set:cloudflare + ip-rules ip-set:cloudflare -whitelist-ip + ip-alias ip-set:cloudflare 192.168.1.1 + ``` diff --git a/en/docs/configuration.md b/en/docs/configuration.md index 4c0a7f0..e96e249 100644 --- a/en/docs/configuration.md +++ b/en/docs/configuration.md @@ -60,12 +60,15 @@ hide: |nftset-timeout|nftset timeout enable|no|[yes\|no]|nftset-timeout yes |nftset-no-speed|When speed check fails, set the ip address of the domain name to the nftset | None | nftset-no-speed [#4\|#6]:[family#nftable#nftset][,#[4\|6]:[family#nftable#nftset]]]
the valid families are inet and ip for ipv4 addresses while the valid ones are inet and ip6 for ipv6 addresses
due to the limitation of nftable
two types of addresses have to be stored in two sets| nftset-no-speed #4:inet#tab#set4| |nftset-debug|nftset debug enable|no|[yes\|no]|nftset-debug yes -|domain-rules|set domain rules|None|domain-rules /domain/ [-rules...]
[-c\|-speed-check-mode]: set speed check mode, same as parameter `speed-check-mode`
[-a\|-address]: same as parameter `address`
[-n\|-nameserver]: same as parameter `nameserver`
[-p\|-ipset]: same as parameter `nftset`
[-t\|-nftset]: same as parameter `nftset`
[-d\|-dualstack-ip-selection]: same as parameter `dualstack-ip-selection`
[-no-serve-expired]: disable serve expired
[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: same as parameter: `rr-ttl`, `rr-ttl-min`, `rr-ttl-max`
[-no-cache]：not cache this domain.
[-r\|-response-mode]：response mode, same as `response-mod`e
[-delete]: delete rule|domain-rules /www.example.com/ -speed-check-mode none +|domain-rules|set domain rules|None|domain-rules /domain/ [-rules...]
[-c\|-speed-check-mode]: set speed check mode, same as parameter `speed-check-mode`
[-a\|-address]: same as parameter `address`
[-n\|-nameserver]: same as parameter `nameserver`
[-p\|-ipset]: same as parameter `nftset`
[-t\|-nftset]: same as parameter `nftset`
[-d\|-dualstack-ip-selection]: same as parameter `dualstack-ip-selection`
[-no-serve-expired]: disable serve expired
[-rr-ttl\|-rr-ttl-min\|-rr-ttl-max]: same as parameter: `rr-ttl`, `rr-ttl-min`, `rr-ttl-max`
[-no-cache]：not cache this domain.
[-r\|-response-mode]：response mode, same as `response-mod`e
[-delete]: delete rule
[no-ip-alias]: ignore ip-alias rule|domain-rules /www.example.com/ -speed-check-mode none | domain-set | collection of domains|None| domain-set [options...]
[-n\|-name]: name of set
[-t\|-type] [list]: set type, only support list, one domain per line
[-f\|-file]: file path of domain set
used with address, nameserver, ipset, nftset, example: /domain-set:[name]/ | domain-set -name set -type list -file /path/to/list
address /domain-set:set/1.2.4.8 | |bogus-nxdomain|bogus IP address|None|[IP/subnet], Repeatable| bogus-nxdomain 1.2.3.4/16 |ignore-ip|ignore ip address|None|[ip/subnet], Repeatable| ignore-ip 1.2.3.4/16 |whitelist-ip|ip whitelist|None|[ip/subnet], Repeatable, When the filtering server responds IPs in the IP whitelist, only result in whitelist will be accepted| whitelist-ip 1.2.3.4/16 |blacklist-ip|ip blacklist|None|[ip/subnet], Repeatable, When the filtering server responds IPs in the IP blacklist, The result will be discarded directly| blacklist-ip 1.2.3.4/16 +| ip-alias | IP alias| None | [ip/subnet] ip1[,[ip2]...]，Repeatable | ip-alias 1.2.3.4/16 4.5.6.7| +| ip-rules | IP rules | None | [ip/subnet] [-rules...]
[-blacklist-ip]: same as parameter `blacklist-ip`
[-whitelist-ip]: same as parameter `whitelist-ip`
[-bogus-nxdomain]: same as parameter `bogus-nxdomain`
[-ignore-ip]: same as parameter `ignore-ip`
[-ip-alias]: same as parameter `ip-alias`
| ip-rules 1.2.3.4/16 -whitelist-ip| +| ip-set | collection of IPs | None | ip-set [options...]
[-n\|-name]：name of ip set
[-t\|-type]：set type, only support list, one domain per line
[-f\|-file]：file path of ip set。
used with ip-rules, ip-alias, example: ip-set:[name] | ip-set -name set -type list -file /path/to/list
ip-rules ip-set:set -whitelist-ip| |force-AAAA-SOA|force AAAA query return SOA|no|[yes\|no]|force-AAAA-SOA yes |force-qtype-SOA|force specific qtype return SOA|qtype id|[qtypeid \| idstart-id-end \| ...]|force-qtype-SOA 65 28 128-256 |prefetch-domain|domain prefetch feature|no|[yes\|no]|prefetch-domain yes diff --git a/en/mkdocs.yml b/en/mkdocs.yml index 385b1a0..688013a 100644 --- a/en/mkdocs.yml +++ b/en/mkdocs.yml @@ -96,6 +96,8 @@ nav: - Query through Proxy: 'config/proxy.md' - DNS64: 'config/dns64.md' - IP Rule: 'config/ip-rule.md' + - IP Set: 'config/ip-set.md' + - IP Alias: 'config/ip-alias.md' - Forwarding with IPSet: 'config/forwarding-with-ipset.md' - Edns Client Subnet: 'config/edns-client-subnet.md' - Configurations: 'configuration.md' diff --git a/mkdocs.yml b/mkdocs.yml index 4189068..645eb8b 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -96,6 +96,8 @@ nav: - 通过代理查询: 'config/proxy.md' - DNS64: 'config/dns64.md' - IP规则: 'config/ip-rule.md' + - IP地址集合: 'config/ip-set.md' + - IP别名: 'config/ip-alias.md' - 白名单分流请求: 'config/forwarding-with-ipset.md' - EDNS客户端子网: 'config/edns-client-subnet.md' - 更多指导: 'config/more.md'