Repository navigation
nft: never TPROXY a client DNS query redirected to the router - #6
Merged
Merged
Conversation
mangle (priority -149) marks the first packet of a flow before dns_redirect (-101) rewrites it. A LAN query to a resolver inside a captured list (8.8.8.8 via the Google lists) reached the proxy chain redirected to the router's :53 (or :1603) and still marked, so sing-box answered it from a transparent socket bound to 192.168.1.1:53. That socket then took the LAN's queries meant for dnsmasq and never read them: DNS for every client except the source-aware ones timed out until the socket expired, and phones fell back to real IPs outside Prokop. The proxy chain now returns for DNAT packets before any TPROXY rule.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Andrei
Описание изменений
Before: when any LAN device sent a DNS query to a resolver whose IP is in a captured list (for example 8.8.8.8 through the Google lists), the router's own DNS on 192.168.1.1:53 stopped answering everyone except the source-aware DNS clients. Wi-Fi phones then used real IPs and their traffic bypassed Prokop "sometimes".
After: a query redirected to the router is never sent to TPROXY, and dnsmasq keeps answering the LAN.
Что изменено
prokop/files/usr/lib/nft/apply.uc:ct status dnat returnis now the first rule of theproxychain.mangle(priority -149) marks the first packet of a flow beforedns_redirect(-101) rewrites it. The redirected query reachedproxy(-100) addressed to the router's :53 (or :1603) and still marked. sing-box answered it from a transparent socket bound to 192.168.1.1:53, and that socket then took the LAN queries meant for dnsmasq and never read them.mangle's ownct status dnat return.tests/nft_apply.sh: new check thatproxystarts withct status dnat return. It fails on origin/main and passes with the fix.nslookupto 192.168.1.1 from the router: 10 of 10 timed out; to 127.0.0.1: 10 of 10 answered.nft -c insert rule inet ProkopTable proxy ct status dnat returnpasses the router's nft check. The rule was not applied.*_realnft tests (WSL nft has nofib),device_traffic,urltest_override_validation, and the aggregaterun.ucode -cpasses on all.ucfiles;git diff --checkis clean.