have some problems with geosite data through hev-socks5-tunnel

[zhenb12]

Hi, I use Xray-core as a proxy service for hev-socks5-tunnel. When I set routing rules there for IP ranges from geoip.dat file everything works fine. If I try to set rules for domains from geosite.dat these rules work as intended but only if I connect to proxy ports from a browser, connections through hev-socks5-tunnel don't work. It looks like hev-socks5-tunnel doesn't convey those domain names to the proxy. I wonder is it a bug or a feature?

[heiher]

You should enable the mapped DNS feature in hev-socks5-tunnel and use the DNS server 198.18.0.2 if you want to pass the domain name through to the SOCKS5 server.

mapdns:
  # Mapped DNS address
  address: 198.18.0.2
  # Mapped DNS port
  port: 53
  # Mapped IP network base
  network: 240.0.0.0
  # Mapped IP network mask
  netmask: 240.0.0.0
  # Mapped DNS cache size
  cache-size: 10000

[zhenb12]

Well, that didn't make things more clear. What is 'fake IP range' then?

[heiher]

In the context of fake DNS, a fake IP range refers to a block of IP addresses that are not real and do not correspond to any actual servers on the internet. These IPs are reserved and used internally by the proxy software to represent specific domain names.

When a client tries to resolve a domain name, the fake DNS module returns one of these fake IPs instead of the domain's real IP address. Later, when the client tries to connect to that fake IP, the proxy software maps it back to the original domain name and handles the connection properly (e.g., forwarding through a proxy).

This mechanism allows the proxy to apply rules or routing based on domain names even though the application only sees IPs.

[zhenb12]

Ah I see now how this mapped dns feature works. All the clients of the local network need to have this IP-address (198.18.0.2) as their only dns-server (instead of those they usually use). Yes, it does work this way. The only caution I see now is when or if the service hev-socks5-tunnel stopped or crashed - then all the clients won't be able to resolve anything. I need to think this over.

[heiher]

I do have a solution for this: in the mapped DNS configuration, set the DNS server address to a publicly available one (such as 1.1.1.1, or whichever DNS server you're currently using). When hev-socks5-tunnel is running normally, it will intercept the DNS queries. If hev-socks5-tunnel stops, the DNS address will simply resume normal communication with the original server.

[zhenb12]

Well I solved the problem with dns using 2 bind9 dns-servers and forwarding requsts to 198.18.0.2. And now everything looks fine regarding my linux pc. But I see some problems with windows hosts: they can't route to 240/4 net and utilities like tracert, telnet won't work:
telnet 240.0.0.80 443
Connecting To 240.0.0.80...Could not open connection to the host, on port 443: Connect failed
tracert -d 240.0.0.80
Tracing route to 240.0.0.80 over a maximum of 30 hops 1 Transmit error: code 1231.

In Linux these commands work just fine. Not sure if it's a windows' problem or mine. I tried to change settings "network: 240.0.0.0" and "netmask: 240.0.0.0" but all other address ranges caused crash of hev-socks5-tunnel. Is it possible to use some other private IP range like 192..., 10... and so on?

P.S. I've tried this range: 10.128.0.0/9 and now windows host works.