使用DNSMASQ搭建清澈DNS系统

Rank: 1

2^#

發表於 2018-12-29 19:18 | 只看該作者

第一部分的列表获取:

#!/usr/bin/env python
#coding=utf-8
import urllib2
import re
import os
import datetime
import base64
import shutil
# 指定外部纯净DNS地址与端口, 此地址用香港或台湾任意无污染DNS即可, 与服务器之间通信确保加密或送入隧道
mydnsip = 'A.B.C.D'
mydnsport = '53'
#墙LIST, 获取可能需要送入隧道, 大陆有可能访问不正常
baseurl = 'https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt'
# match comments/title/whitelist/ip address
comment_pattern = '^\!|\[|^@@|^\d+\.\d+\.\d+\.\d+'
domain_pattern = '([\w\-\_]+\.[\w\.\-\_]+)[\/\*]*'
tmpfile = 'glisttmp'
# do not write to router internal flash directly
outfile = 'glist.conf'
rulesfile = '/etc/dnsmasq.d/glist.conf'
fs = file(outfile, 'w')
fs.write('# glist ipset rules for dnsmasq\n')
fs.write('# updated on ' + datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S") + '\n')
fs.write('#\n')
print 'fetching list...'
content = urllib2.urlopen(baseurl, timeout=15).read().decode('base64')
# write the decoded content to file then read line by line
tfs = open(tmpfile, 'w')
tfs.write(content)
tfs.close()
tfs = open(tmpfile, 'r')
print 'page content fetched, analysis...'
# remember all blocked domains, in case of duplicate records
domainlist = []
for line in tfs.readlines():
if re.findall(comment_pattern, line):
print 'this is a comment line: ' + line
#fs.write('#' + line)
else:
domain = re.findall(domain_pattern, line)
if domain:
try:
found = domainlist.index(domain[0])
print domain[0] + ' exists.'
except ValueError:
print 'saving ' + domain[0]
domainlist.append(domain[0])
fs.write('server=/.%s/%s#%s\n'%(domain[0],mydnsip,mydnsport))
else:
print 'no valid domain in this line: ' + line
tfs.close()
fs.close();
print 'moving generated file to dnsmasg directory'
shutil.move(outfile, rulesfile)
print 'restart dnsmasq...'
print os.popen('/etc/init.d/dnsmasq restart').read()
print 'done!'

複製代碼

Rank: 1

3^#

發表於 2018-12-29 19:30 | 只看該作者

第四部分苹果相关服务域名列表:
splist.conf

server=/a1.mzstatic.com/114.114.114.114
server=/a2.mzstatic.com/114.114.114.114
server=/a3.mzstatic.com/114.114.114.114
server=/a4.mzstatic.com/114.114.114.114
server=/a5.mzstatic.com/114.114.114.114
server=/adcdownload.apple.com/114.114.114.114
server=/appldnld.apple.com/114.114.114.114
server=/apps.mzstatic.com/114.114.114.114
server=/cdn-cn1.apple-mapkit.com/114.114.114.114
server=/cdn-cn2.apple-mapkit.com/114.114.114.114
server=/cdn-cn3.apple-mapkit.com/114.114.114.114
server=/cdn-cn4.apple-mapkit.com/114.114.114.114
server=/cdn.apple-mapkit.com/114.114.114.114
server=/cdn1.apple-mapkit.com/114.114.114.114
server=/cdn2.apple-mapkit.com/114.114.114.114
server=/cdn3.apple-mapkit.com/114.114.114.114
server=/cdn4.apple-mapkit.com/114.114.114.114
server=/cds.apple.com/114.114.114.114
server=/cl1.apple.com/114.114.114.114
server=/cl2.apple.com.edgekey.net.globalredir.akadns.net/114.114.114.114
server=/cl2.apple.com/114.114.114.114
server=/cl3.apple.com/114.114.114.114
server=/cl4-cn.apple.com/114.114.114.114
server=/cl4.apple.com/114.114.114.114
server=/cl5.apple.com/114.114.114.114
server=/configuration.apple.com/114.114.114.114
server=/gs-loc.apple.com/114.114.114.114
server=/gsp11-cn.ls.apple.com/114.114.114.114
server=/gsp12-cn.ls.apple.com/114.114.114.114
server=/gsp13-cn.ls.apple.com/114.114.114.114
server=/gsp4-cn.ls.apple.com.edgekey.net.globalredir.akadns.net/114.114.114.114
server=/gsp4-cn.ls.apple.com.edgekey.net/114.114.114.114
server=/gsp4-cn.ls.apple.com/114.114.114.114
server=/gsp5-cn.ls.apple.com/114.114.114.114
server=/gspe19-cn.ls-apple.com.akadns.net/114.114.114.114
server=/gspe19-cn.ls.apple.com/114.114.114.114
server=/gspe21-ssl.ls.apple.com/114.114.114.114
server=/gspe21.ls.apple.com/114.114.114.114
server=/gspe35-ssl.ls.apple.com/114.114.114.114
server=/icloud.cdn-apple.com/114.114.114.114
server=/images.apple.com/114.114.114.114
server=/init-p01md.apple.com/114.114.114.114
server=/init-p01st.push.apple.com/114.114.114.114
server=/iphone-ld.apple.com/114.114.114.114
server=/is1-ssl.mzstatic.com/114.114.114.114
server=/is1.mzstatic.com/114.114.114.114
server=/is2-ssl.mzstatic.com/114.114.114.114
server=/is2.mzstatic.com/114.114.114.114
server=/is3-ssl.mzstatic.com/114.114.114.114
server=/is3.mzstatic.com/114.114.114.114
server=/is4-ssl.mzstatic.com/114.114.114.114
server=/is4.mzstatic.com/114.114.114.114
server=/is5-ssl.mzstatic.com/114.114.114.114
server=/is5.mzstatic.com/114.114.114.114
server=/itunes-apple.com.akadns.net/114.114.114.114
server=/itunes.apple.com/114.114.114.114
server=/itunesconnect.apple.com/114.114.114.114
server=/mesu-cdn.apple.com.akadns.net/114.114.114.114
server=/mesu-china.apple.com.akadns.net/114.114.114.114
server=/mesu.apple.com/114.114.114.114
server=/s.mzstatic.com/114.114.114.114
server=/s2.mzstatic.com/114.114.114.114
server=/s3.mzstatic.com/114.114.114.114
server=/s4.mzstatic.com/114.114.114.114
server=/s5.mzstatic.com/114.114.114.114
server=/store.apple.com/114.114.114.114
server=/store.storeimages.cdn-apple.com/114.114.114.114
server=/support.apple.com/114.114.114.114
server=/swcdn.apple.com/114.114.114.114
server=/swdist.apple.com/114.114.114.114
server=/updates-http.cdn-apple.com.akadns.net/114.114.114.114
server=/updates-http.cdn-apple.com/114.114.114.114
server=/www.apple.com.edgekey.net/114.114.114.114
server=/www.apple.com/114.114.114.114

複製代碼

如果微软的某些云服务在大陆访问或同步不正常, 那么也可以在这里进行特殊照顾.

Rank: 1

4^#

發表於 2018-12-29 19:46 | 只看該作者

第三部的列表获取:
adlist.conf

#!/bin/bash
outlist='/etc/dnsmasq.d/adlist.conf'
tempoutlist="$outlist.tmp"
# 这里列表自行添加, 这里用了ADP的easylist
echo "Getting adblockplus easylistchina + easylist..."
curl -s https://easylist-downloads.adblockplus.org/easylistchina+easylist.txt | grep ^\|\|[^\*]*\^$ | sed 's/^||//' | cut -d'^' -f-1 >> $tempoutlist
echo "Removing duplicates and formatting the list of domains..."
cat $tempoutlist | sed s/\r$//' | sed '/thisisiafakedomain123\.com/d;/www\.anotherfakedomain123\.com/d' | sort -u | sed '/^$/d' | sed -e 's:^:address\=\/:' -e 's:$:/127\.0\.0\.1:' > $outlist
rm $tempoutlist
numberOfAdsBlocked=$(cat $outlist | wc -l | sed 's/^[ \t]*//')
echo "$numberOfAdsBlocked ad domains blocked."

複製代碼

Rank: 1

5^#

發表於 2018-12-30 19:41 | 只看該作者

本帖最後由 moses 於 2018-12-31 09:19 編輯

效果与后期处理:

root@raspberrypi:~ $ dig google.com
; <<>> DiG 9.10.3-P4-Raspbian <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56412
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com. IN A
;; ANSWER SECTION:
google.com. 106 IN A A.B.C.D
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Dec 30 18:53:39 CST 2018
;; MSG SIZE rcvd: 55

複製代碼

确认这里的A.B.C.D与你特殊指定的DNS解析得到的地址相同, 也就满足了无污染DNS的需求.

如果你使用RB, 那么取消自动从你的运营商获取DNS, 将RB的查询DNS指向这台DNSMASQ, 我这里是用了几台raspberrypi, 分别放在不同的子网. 后台用crontab每个月更新一次列表也就ok了.

至此纯净DNS系统搭建完毕, 如果你有多区域, 那么RB之间跑个隧道用OSPF处理下站点间子网路由, 将其他站点的DNS解析也指向这台PI, 有条件的话可以搭建多个, RB的DNS互指一下做个备份, 效果更棒.

角色

註冊會員

Rank: 2

6^#

發表於 2019-1-20 22:20 | 只看該作者

真的要好好消化CHing的scripts。