使用Use AdGuard browsing security web service功能导致DNS解析异常

[WindyCloudCute]

Prerequisites

Please answer the following questions for yourself before submitting an issue. YOU MAY DELETE THE PREREQUISITES SECTION.

• [ √] I am running the latest version
• [ √] I checked the documentation and found no answer
• [ √] I checked to make sure that this issue has not already been filed

Issue Details

AdGuardHome -v --version
AdGuard Home
Version: v0.106.3
Channel: release
Go version: go1.15.11
Build time: 2021-05-19T13:25:09Z+0000
GOOS: linux
GOARCH: amd64
Race: false
Main module:
github.com/AdguardTeam/AdGuardHome (devel)
Dependencies：

    github.com/AdguardTeam/[email protected] (sum: h1:YIoJkIp828LKmmmgxXvZHUKfGLsqTQAK8g+4DXbDbyU=)
    github.com/AdguardTeam/[email protected] (sum: h1:qwhEKjDrT0UcwDnHrNU2Yg/DLR9b/GsUncnXYW6VzAU=)
    github.com/AdguardTeam/[email protected] (sum: h1:WyF0hg0MwKevsqNPkoaZFH8f5WRi/yuy/7qePtYt5Ts=)
    github.com/NYTimes/[email protected] (sum: h1:ZUDjpQae29j0ryrS0u/B8HZfJBtBQHjqw2rQ2cqUQ3I=)
    github.com/aead/[email protected] (sum: h1:KjTM2ks9d14ZYCvmHS9iAKVt9AyzRSqNU1qabPih5BY=)
    github.com/aead/[email protected] (sum: h1:52m0LGchQBBVqJRyYYufQuIbVqRawmubW3OFGqK1ekw=)
    github.com/ameshkov/dnscrypt/[email protected] (sum: h1:DG4Uf7LSDg6XDj9sp3maxh3Ur26jeGQaP5MeYosn6v0=)
    github.com/ameshkov/[email protected] (sum: h1:Srzik+J9mivH1alRACTbys2xOxs0lRH9qnTA7Y1OYVo=)
    github.com/beefsack/[email protected] (sum: h1:M57m0xQqZIhx7CEJgeLSvRFKEK1RjzRuIXiA3HfYU7g=)
    github.com/cheekybits/[email protected] (sum: h1:uGGa4nei+j20rOSeDeP5Of12XVm7TGUd4dJA9RDitfE=)
    github.com/digineo/go-ipset/[email protected] (sum: h1:k6skY+0fMqeUjjeWO/m5OuWPSZUAn7AucHMnQ1MX77g=)
    github.com/fsnotify/[email protected] (sum: h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=)
    github.com/go-ping/[email protected] (sum: h1:2opwLSXqxE0Za64PdpskXuvLYDj/XHQAD8tLcYpSlvY=)
    github.com/gobuffalo/[email protected] (sum: h1:eZR0DuEgVLfeIb1zIKt3bT4YovIMf9O9LXQeCZLXpqE=)
    github.com/gobuffalo/[email protected] (sum: h1:6ERZvJHfe24rfFmA9OaoKBdC7+c9sydrytMg8SdFGBM=)
    github.com/gobuffalo/[email protected] (sum: h1:hu1fuVR3fXEZR7rXNW3h8rqSML8EVAf6KNm0NKO/wKg=)
    github.com/google/[email protected] (sum: h1:vvZyWjAX9oDB+DWpMsZMyv6Q3NZtim2C5Zcdh+H0OmQ=)
    github.com/AdguardTeam/[email protected] (sum: h1:M6YnFP12o0/SjBEPt6b2r8ZkIy/wsV14TK8X9Tb6DEE=)
    github.com/joho/[email protected] (sum: h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=)
    github.com/joomcode/[email protected] (sum: h1:3e1mi0u7/HTPNdg6d6DYyKGBhA5l9XpsfuVE29NxnWw=)
    github.com/josharian/[email protected] (sum: h1:uhL5Gw7BINiiPAo24A2sxkcDI0Jt/sqp1v5xQCniEFA=)
    github.com/kardianos/[email protected] (sum: h1:bGuZ/epo3vrt8IPC7mnKQolqFeYJb7Cs8Rk4PSOBB/g=)
    github.com/lucas-clemente/[email protected] (sum: h1:hb5m76V8QS/8Nw/suHvXqo3BMHAozvIkcnzpJdpanSk=)
    github.com/marten-seemann/[email protected] (sum: h1:RehYMOyRW8hPVEja1KBVsFVNSm35Jj9Mvs5yNoZZ28A=)
    github.com/mdlayher/[email protected] (sum: h1:lez6TS6aAau+8wXUP3G9I3TGlmPFEq2CTxBaRqY6AGE=)
    github.com/mdlayher/[email protected] (sum: h1:n3ARR+Fm0dDv37dj5wSWZXDKcy+U0zwcXS3zKMnSiT0=)
    github.com/mdlayher/[email protected] (sum: h1:aFkJ6lx4FPip+S+Uw4aTegFMct9shDvP+79PsSxpm3w=)
    github.com/miekg/[email protected] (sum: h1:pyyPFfGMnciYUk/mXpKkVmeMQjfXqt3FAJ2hy7tPiLA=)
    github.com/patrickmn/[email protected]+incompatible (sum: h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=)
    github.com/pkg/[email protected] (sum: h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=)
    github.com/rogpeppe/[email protected] (sum: h1:3qqXGV8nn7GJT65debw77Dzrx9sfWYgP0DDo7xcMFRk=)
    github.com/satori/[email protected] (sum: h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=)
    github.com/ti-mo/[email protected] (sum: h1:rTN1nBYULDmMfDeBHZpKuNKX/bWEXQUhe02a/10orzg=)
    github.com/u-root/[email protected]+incompatible (sum: h1:u+KSS04pSxJGI5E7WE4Bs9+Zd75QjFv+REkjy/aoAc8=)
    go.etcd.io/[email protected] (sum: h1:XAzx9gjCb0Rxj7EoqcClPD1d5ZBxZJk0jbuoPHenBt0=)
    golang.org/x/[email protected] (sum: h1:/ZScEX8SfEmUGRHs0gxpqteO5nfNW6axyZbBdw9A12g=)
    golang.org/x/[email protected] (sum: h1:4nGaVu0QrbjT/AK2PRLuQfQuh6DJve+pELhqTdAj3x0=)
    golang.org/x/[email protected] (sum: h1:Bli41pIlzTzf3KEY06n+xnzK/BESIg2ze4Pgfh/aI8c=)
    golang.org/x/[email protected] (sum: h1:i6eZZ+zk0SOf0xgBpEpPD18qWcJda6q1sxt3S0kzyUQ=)
    gopkg.in/natefinch/[email protected] (sum: h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=)
    gopkg.in/[email protected] (sum: h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=)
    howett.net/[email protected] (sum: h1:QDxUo/w2COstK1wIBYpzQlHX/NqaQTcf9jyz347nI58=)

• Version of AdGuard Home server:
  v0.106.3
• How did you install AdGuard Home:
  GitHub releases
• How did you setup DNS configuration:
  Router
• If it's a router or IoT, please write device model:
  Intel
• CPU architecture:
  AMD64
• Operating system and version:
  linux ,Windows10

Expected Behavior

需要启用Use AdGuard browsing security web service

Actual Behavior

在启用Use AdGuard browsing security web service功能后，DNS出现无法解析，网页无法访问但IP连接不会被阻断。

[Hill-98]

这个问题是由于局域网的全局代理造成的，因为代理软件也需要解析域名，但是代理软件解析时 AdGraud 也会检查，但是这时由于检查请求被转发到代理软件，所以无法请求成功，就会一直死循环，可通过 AdGraud 的 DNS 重写将代理软件用到的域名直接返回解析结果。

[ameshkov]

我不懂解析怎么异常？你看，AdGuard browsing security内它其实用 AdGuard DNS 服务器检查域名。如果 AdGuard DNS 被拦截，无法用 browsing security。

[Hill-98]

我不懂解析怎么异常？你看，AdGuard browsing security内它其实用 AdGuard DNS 服务器检查域名。如果 AdGuard DNS 被拦截，无法用 browsing security。

This problem is common in China, where people often need proxies to access IP addresses around the world because of GFW.

So many people will set up transparent proxies in their routers via iptables to forward requests to proxy software (like V2ray), but the proxy software also needs to resolve the domain name, so it creates a dead end.

[ameshkov]

Ah, makes sense indeed.

[Hill-98]

The best practice is to use the DNS rewrite feature to assign an IP to the proxyer's domain name, which will jump out of the dead loop.

[WindyCloudCute]

你能使AdGuard写verbose水平日志，然后检查日志文件，它是否有死循环。

https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#verboselog

这太难了 : (

[WindyCloudCute]

我发现了一个办法，在代理软件里设置强代理adguard.com及其所有子域名，然后在AdGuard里设置自定义规则，@@||adguard.com^貌似就可以让功能发挥正常。

[Hill-98]

本质上还是让 dns-family.adguard.com 走代理，可能是因为你用的是 gfwlist 模式。

[Hill-98]

@ameshkov Speaking of gfwlist, I'd also like to add to the FAQ solution that if a user is using gfwlist mode (a mode that only proxies domains that are blocked by GFW), be sure to force the proxy to dns-family.adguard.com.

[WindyCloudCute]

嗯我用的是绕过chinalist，但是我没有去看list里面是否包含adguard的域名，不过这个也可以作为一个社区面对中国用户的经验吧，毕竟我觉得出现这个问题的人应该不会很少，而且几乎搜索不到任何相关的资料。

[Hill-98]

@ameshkov I would suggest introducing this question in the FAQ, which is probably common among Chinese users.

[ameshkov]

What kind of setup would you suggest to add to FAQ?

[Hill-98]

Suggested steps:

Turn off secure browsing related services and check if you can access https://dns-family.adguard.com.

If it doesn't work, your firewall or carrier may be blocking access to it.
If so, you should be able to use it normally, or you can continue with the following checks.(emphasis on Chinese users)

If your LAN deploys proxy software and forwards some of the requests to the proxy software through your router,
it may be normal for the security service to not work. because the proxy software you are using may also need to
do DNS resolution, but before the proxy software can resolve successfully, AdGuard needs access to the security
service and that access request is forwarded to the proxy software, and you are stuck in a dead end.

Solution.
1. Use AdGuard's DNS rewrite to assign the proxy software's domain name to the corresponding IP
2. Proxy software uses IP for connection

My English is not very good and there may be areas that I need to improve.

[ameshkov]

Thank you! I've created a task about that: #3716