求助这样的情况算是有泄露吗？[网关导致的泄露检测异常案例]

[upbeat-backbone-bose]

最初列表是没有中国ip的，参数也没调整，近期发现有cn ip了

[kkkgo]

重启容器等待10分钟，数据检查更新后，再尝试测试一下。
确保mark_data功能已开启，谢谢反馈。

[upbeat-backbone-bose]

重启容器，开启mark_data情况依旧。
启动命令为：
docker run -d --name paopaodns -v /root/paopao-dns-data:/data -e CNAUTO=yes -e UPDATE=weekly -e USE_MARK_DATA=yes -e ADDINFO=yes --restart always -p 5353:53/tcp -p 5353:53/udp dockerproxy.com/sliamb/paopaodns:latest

[kkkgo]

是重启容器，不是再开一个，用docker start和stop。重启容器能正常查询DNS后等待10分钟数据检查更新后再测试。确保容器日志有出现global_mark.dat Update OK.

[upbeat-backbone-bose]

确认情况依旧，已经补贴了日志。

[upbeat-backbone-bose]

使用了有2个月了应该，最初是完全不漏得，最近发现突然漏了，自己排查了很久没找到原因，删除了所有images,volume重新部署还是一样，所以过来反馈求助取取经。

[upbeat-backbone-bose]

Debug.sh执行诊断日志如下。 @kkkgo

`/data # debug.sh
=====PaoPaoDNS docker debug=====
[info] images build time : 2023-10-05 16:09:23 UTC
[info] ========== env info ==========
====ENV TEST====
MEM:220m 450m 500000 750mb
prefPC:68
CORES:-2-
POWCORES:-2-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux e2f3ca60e1ef 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 Linux-
====ENV TEST====
[info] ========== process info ==========
PID USER TIME COMMAND
1 root 0:00 {init.sh} /bin/sh /usr/sbin/init.sh
21 root 0:00 crond
124 root 0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
127 root 0:00 mosdns start -d /tmp -c mosdns.yaml
139 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
140 root 0:00 {data_update.sh} /bin/sh /usr/sbin/data_update.sh
145 root 0:00 sleep 230
152 root 0:00 redis-server unixsocket:/tmp/redis.sock
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
180 root 0:00 inotifywait -e modify,delete /etc/unbound/named.cache /data/Country-only-cn-private.mmdb /data/force_cn_list.txt /data/force_nocn_list.txt /data/global_mark.dat /data/trackerslist.txt
185 root 0:00 sh
191 root 0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
196 root 0:00 ps -ef
[info] ========== cn list info ==========
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
[info] ========== reids info ==========
used_memory_human:1.11M
used_memory_rss_human:7.07M
used_memory_peak_human:1.11M
total_system_memory_human:3.82G
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:750.00M
(integer) 874
[test] IP test, you will see that all the following IPs are your public network exit IP !
[test] ========== IP TEST START ==========
CN IP URL:
117.*
117.*

Non-CN IP URL:
117.*
117.*
117.*
117.*
117.*

IP INFO:
117.*
CN,Zhejiang
ASN56041/China Mobile
HTTP/1.1
curl/8.3.0
Asia/Shanghai Time: 10/26/2023, 2:28:46 PM

----mosdns whoami aka dig:
"ns" "117.."

----local-unbound whoami aka dig:
"ns" "117.."

----mosdns whoami 03k dig:
117..

----local-unbound whoami 03k dig:
117..
[test] ========== IP TEST END ==========

[test] The DNS hijacking test, you will see timed out message !
[test] ========== DNS HIJACK START ==========
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; no servers could be reached

[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
112.48.141.202
112.48.141.203

----local-unbound CN dig:
www.taobao.com.danuoyi.tbcache.com.
112.48.141.203
112.48.141.202
[test] ========== CN DOMAIN TEST END ==========
[test] Non-CN domain test, you will see that the DNS resolution result is correct IP !
[test] ========== Non-CN DOMAIN TEST START ==========
----mosdns Non-CN dig:
youtube-ui.l.google.com.
64.233.176.91
64.233.177.91

----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
216.58.203.78
142.251.220.14

----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
142.250.67.14
172.217.167.110

----dnscrypt-socks5 Non-CN dig:
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
[test] ========== Non-CN DOMAIN TEST END ==========
[test] IPv6 Dual CN test: you will see that IPv6 is OK !
[test] ========== IPV6 CN DOMAIN TEST START ==========
[test] ========== IPV6 CN DOMAIN TEST END ==========
[test] IPv6 Dual Non-CN test: you will see that IPv6 is empty !
[test] ========== IPV6 Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 Non-CN DOMAIN TEST END ==========
[test] IPv6 only Non-CN test: you will see that IPv6 is ok !
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST END ==========

[info] ALL TEST FINISH.
`

[kkkgo]

你这是刚重启容器还没到10分钟吧。进程有sleep 230。

[upbeat-backbone-bose]

30分钟后我再重新跑一次debug，贴上来。

[upbeat-backbone-bose]

容器运行信息：

Debug.sh执行日志信息：

`/data # debug.sh
=====PaoPaoDNS docker debug=====
[info] images build time : 2023-10-05 16:09:23 UTC
[info] ========== env info ==========
====ENV TEST====
MEM:220m 450m 500000 750mb
prefPC:68
CORES:-2-
POWCORES:-2-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux e2f3ca60e1ef 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 Linux-
====ENV TEST====
[info] ========== process info ==========
PID USER TIME COMMAND
1 root 0:00 {init.sh} /bin/sh /usr/sbin/init.sh
21 root 0:00 crond
124 root 0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
139 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
152 root 0:03 redis-server unixsocket:/tmp/redis.sock
395 root 0:00 unbound -c /tmp/unbound_raw.conf
397 root 0:00 unbound -c /tmp/unbound_forward.conf
771 root 0:01 mosdns start -d /tmp -c mosdns.yaml
807 root 0:00 inotifywait -e modify,delete /etc/unbound/named.cache /data/Country-only-cn-private.mmdb /data/force_cn_list.txt /data/force_nocn_list.txt /data/global_mark.dat /data/trackerslist.txt
814 root 0:00 sh
822 root 0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
827 root 0:00 ps -ef
[info] ========== cn list info ==========
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
[info] ========== reids info ==========
used_memory_human:1.17M
used_memory_rss_human:7.12M
used_memory_peak_human:1.19M
total_system_memory_human:3.82G
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:750.00M
(integer) 881
[test] IP test, you will see that all the following IPs are your public network exit IP !
[test] ========== IP TEST START ==========
CN IP URL:
117.....*
117.....*

Non-CN IP URL:
58.84.52.74
117.....*
117.....*
117.....*
117.....*

IP INFO:
117.....*
CN,Zhejiang
ASN56041/China Mobile
HTTP/1.1
curl/8.4.0
Asia/Shanghai Time: 10/26/2023, 3:16:59 PM

----mosdns whoami aka dig:
"ns" "117.....*"

----local-unbound whoami aka dig:
"ns" "117.....*"

----mosdns whoami 03k dig:
117.....*

----local-unbound whoami 03k dig:
117.....*
[test] ========== IP TEST END ==========

[test] The DNS hijacking test, you will see timed out message !
[test] ========== DNS HIJACK START ==========
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; communications error to 9.8.7.6#53: timed out
;; no servers could be reached

[test] ========== DNS HIJACK END ==========
[test] CN domain test, you will see that the DNS resolution result is CN IP !
[test] ========== CN DOMAIN TEST START ==========
----mosdns CN dig:
www.taobao.com.danuoyi.tbcache.com.
111.1.164.217
111.1.164.218

----local-unbound CN dig:
www.taobao.com.danuoyi.tbcache.com.
111.1.164.217
111.1.164.218
[test] ========== CN DOMAIN TEST END ==========
[test] Non-CN domain test, you will see that the DNS resolution result is correct IP !
[test] ========== Non-CN DOMAIN TEST START ==========
----mosdns Non-CN dig:
youtube-ui.l.google.com.
142.250.199.78
142.250.204.46

----dnscrypt-unbound NOCN dig:
youtube-ui.l.google.com.
172.217.12.142
142.250.72.238

----dnscrypt Non-CN dig:
youtube-ui.l.google.com.
142.250.189.14
142.250.217.142

----dnscrypt-socks5 Non-CN dig:
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
;; communications error to 127.0.0.1#5303: connection refused
[test] ========== Non-CN DOMAIN TEST END ==========
[test] IPv6 Dual CN test: you will see that IPv6 is OK !
[test] ========== IPV6 CN DOMAIN TEST START ==========
[test] ========== IPV6 CN DOMAIN TEST END ==========
[test] IPv6 Dual Non-CN test: you will see that IPv6 is empty !
[test] ========== IPV6 Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 Non-CN DOMAIN TEST END ==========
[test] IPv6 only Non-CN test: you will see that IPv6 is ok !
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST START ==========
[test] ========== IPV6 ONLY Non-CN DOMAIN TEST END ==========

[info] ALL TEST FINISH.
`

[upbeat-backbone-bose]

挂载卷文件信息，未作任何变更配置

[kkkgo]

看你容器启动日志。docker logs

[upbeat-backbone-bose]

看你容器启动日志。docker logs

root@debian:~/paopao-dns-data# docker logs paopaodns
=====PaoPaoDNS docker start=====
images build time : 2023-10-05 16:09:23 UTC
New version install ! Try clean...
ulimit adbove 1000000.
total used free shared buff/cache available
Mem: 3915 501 2205 1 1210 3181
Swap: 980 0 980
total used free shared buff/cache available
Mem: 3.8G 500.8M 2.2G 588.0K 1.2G 3.1G
Swap: 980.0M 0 980.0M
MEMSIZE:3181
====ENV TEST====
MEM:220m 450m 500000 750mb
prefPC:68
CORES:-2-
POWCORES:-2-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-IP:PORT-
CNAUTO:-yes-
IPV6:-no-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-0-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-no-
SAFEMODE:--
QUERY_TIME:-2000ms-
ADDINFO:-yes-
PLATFORM:-Linux e2f3ca60e1ef 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 Linux-
====ENV TEST====
Apply trackerslist...
load_mark_data
dat size pass.
1203940+0 records in
1203940+0 records out
1203940 bytes (1.1MB) copied, 7.828672 seconds, 150.2KB/s
1024+0 records in
1024+0 records out
1024 bytes (1.0KB) copied, 0.006858 seconds, 145.8KB/s
global_mark hash: OK.
/data
2023-10-26T14:27:30.427+0800 INFO working directory changed {"path": "/tmp"}
2023-10-26T14:27:30.430+0800 INFO main config loaded {"file": "mosdns.yaml"}
PID USER TIME COMMAND
1 root 0:00 {init.sh} /bin/sh /usr/sbin/init.sh
21 root 0:00 crond
124 root 0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
126 root 0:00 unbound -c /tmp/unbound_forward.conf -p
127 root 0:00 mosdns start -d /tmp -c mosdns.yaml
138 root 0:00 unbound -c /tmp/unbound_raw.conf -p
139 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
140 root 0:00 {data_update.sh} /bin/sh /usr/sbin/data_update.sh
145 root 0:00 sleep 230
150 root 0:00 ps
151 root 0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
152:C 26 Oct 2023 14:27:30.483 # WARNING Memory overcommit must be enabled! Without it, a background save or replication may fail under low memory condition. To fix this issue add 'vm.overcommit_memory = 1' to /etc/sysctl.conf and then reboot or run the command 'sysctl vm.overcommit_memory=1' for this to take effect.
152:C 26 Oct 2023 14:27:30.484 # systemd supervision requested or auto-detected, but Redis is compiled without libsystemd support!
Setting up watches.
Watches established.
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/main: Permission denied
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/community: could not connect to server (check repositories file)
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/main: could not connect to server (check repositories file)
WARNING: updating and opening https://mirrors.zju.edu.cn/alpine/edge/community: could not connect to server (check repositories file)
2023-10-26 14:31:34 CST
/etc/unbound/named.cache diff sha256sum, update...
newsum:fa5ffa04c78f8d3fc170c978e9ff55d4
oldsum:a2e668cca45d931a1cacd8e42cff8a52
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 3313 100 3313 0 0 3132 0 0:00:01 0:00:01 --:--:-- 3134
/tmp/named.cache Download OK.
/etc/unbound/named.cache MODIFY
/etc/unbound/named.cache Update OK.
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
165 root 0:00 unbound -c /tmp/unbound_raw.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
164 root 0:00 unbound -c /tmp/unbound_forward.conf -p
unbound reload...
killall: unbound: no process killed
395 root 0:00 unbound -c /tmp/unbound_raw.conf
397 root 0:00 unbound -c /tmp/unbound_forward.conf
Setting up watches.
Watches established.
used_memory_human:1.17M
2023-10-26 14:31:44 CST
/usr/sbin/Country-only-cn-private.mmdb.xz diff sha256sum, update...
newsum:c01d0a06f11aee3be0adb0f323155515d2c0aac3a92860563a9a7e8a2c7c4cfc
oldsum:c955bd2fe611321ca7b02e28ed72988f056233924b5d73180c0b54c40d9248c2
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 51572 100 51572 0 0 4909 0 0:00:10 0:00:10 --:--:-- 12587
/tmp/Country-only-cn-private.mmdb Download OK.
/usr/sbin/Country-only-cn-private.mmdb.xz Update OK.
/data/Country-only-cn-private.mmdb MODIFY
2023-10-26 14:35:26 CST
127 root 0:00 mosdns start -d /tmp -c mosdns.yaml
127 root 0:00 [mosdns]
killall: mosdns: no process killed
mosdns reload...
killall: mosdns: no process killed
508 root 0:00 mosdns start -d /tmp -c mosdns.yaml
Setting up watches.
Watches established.
Network error: https://raw.githubusercontent.com/kkkgo/all-tracker-list/main/trackerslist.txt.xz.sha256sum
2023-10-26 14:35:36 CST
/usr/sbin/trackerslist.txt.xz diff sha256sum, update...
newsum:8896ce0578419b1e56ddf8a52fb018712050dbc70fc491f480b980073134e448
oldsum:649d8ddd99c770303498c0e475c69d1be378181eef2134db9a5c9a0c446c909d
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:10 --:--:-- 0
curl: (28) SSL connection timeout
sha256sum: can't open '/tmp/trackerslist.txt.xz.download': No such file or directory
/tmp/trackerslist.txt.xz.download Download error.
rm: can't remove '/tmp/trackerslist.txt.xz.download': No such file or directory
Download failed. Attempting to change the download link...
https://cdn.jsdelivr.net/gh/kkkgo/all-tracker-list/trackerslist.txt.xz.sha256sum
2023-10-26 14:35:57 CST
/usr/sbin/trackerslist.txt.xz diff sha256sum, update...
newsum:8896ce0578419b1e56ddf8a52fb018712050dbc70fc491f480b980073134e448
oldsum:649d8ddd99c770303498c0e475c69d1be378181eef2134db9a5c9a0c446c909d
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 2348 100 2348 0 0 956 0 0:00:02 0:00:02 --:--:-- 956
/tmp/trackerslist.txt.xz.download Download OK.
/usr/sbin/trackerslist.txt.xz Update OK.
/data/trackerslist.txt MODIFY
2023-10-26 14:36:07 CST
Setting up watches.
Watches established.
/data/global_mark.dat diff sha256sum, update...
newsum:9e14d89403fb21e906b06af4c43f383b3c6f215f4d41cf83d4cacbf6ce683e2f
oldsum:00b3fd44696d11154fbb69d51221b359f9eaa1f92f81da0a4fc87a2969cf6aa7
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:10 --:--:-- 0
curl: (28) SSL connection timeout
sha256sum: can't open '/tmp/global_mark.dat.download': No such file or directory
/tmp/global_mark.dat.download Download error.
rm: can't remove '/tmp/global_mark.dat.download': No such file or directory
2023-10-26 14:40:48 CST
/data/global_mark.dat diff sha256sum, update...
newsum:9e14d89403fb21e906b06af4c43f383b3c6f215f4d41cf83d4cacbf6ce683e2f
oldsum:00b3fd44696d11154fbb69d51221b359f9eaa1f92f81da0a4fc87a2969cf6aa7
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
53 1206k 53 642k 0 0 1053 0 0:19:33 0:10:24 0:09:09 49596
curl: (92) HTTP/2 stream 1 was not closed cleanly: PROTOCOL_ERROR (err 1)
/tmp/global_mark.dat.download Download error.
Download failed. Attempting to change the download link...
https://cdn.jsdelivr.net/gh/kkkgo/PaoPao-Pref/global_mark.dat.sha256sum
2023-10-26 14:51:17 CST
/data/global_mark.dat diff sha256sum, update...
newsum:9e14d89403fb21e906b06af4c43f383b3c6f215f4d41cf83d4cacbf6ce683e2f
oldsum:00b3fd44696d11154fbb69d51221b359f9eaa1f92f81da0a4fc87a2969cf6aa7
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 1206k 100 1206k 0 0 4822 0 0:04:16 0:04:16 --:--:-- 5437
/tmp/global_mark.dat.download Download OK.
/data/global_mark.dat MODIFY
/data/global_mark.dat Update OK.
load_mark_data
dat size pass.
1234488+0 records in
1234488+0 records out
1234488 bytes (1.2MB) copied, 8.842805 seconds, 136.3KB/s
1024+0 records in
1024+0 records out
1024 bytes (1.0KB) copied, 0.007270 seconds, 137.6KB/s
global_mark hash: OK.
/data
508 root 0:00 mosdns start -d /tmp -c mosdns.yaml
508 root 0:00 [mosdns]
killall: mosdns: no process killed
mosdns reload...
killall: mosdns: no process killed
771 root 0:00 mosdns start -d /tmp -c mosdns.yaml
Setting up watches.
Watches established.

[upbeat-backbone-bose]

你电脑是用的PaoPaoDNS的IP做DNS吗，还是作为其他的DNS上游

paopao监听端口5353，作为adg的上游，adg关闭缓存，不启用备用，不启用edns，只为了看面板和拦截广告。

裸paopaodns直接监听53裸连也是一样的情况，最初部署的时候是完全没问题的

[upbeat-backbone-bose]

你电脑是用的PaoPaoDNS的IP做DNS吗，还是作为其他的DNS上游

paopao监听端口5353，作为adg的上游，adg关闭缓存，不启用备用，不启用edns，只为了看面板和拦截广告。

裸paopaodns直接监听53裸连也是一样的情况，最初部署的时候是完全没问题的

网关v2rayA，xray内核，tproxy，排除cn

[upbeat-backbone-bose]

又做了个实验，网关改为主路由默认网关，不走旁路网关v2rayA。
dns依然adghome，配置一致，paopaodns作为上游就不漏了。如果想配合旁路网关使用是还需要增加什么配置参数吗？目前控制变量法是查出这样一个情况。

[kkkgo]

你应该是配置v2的《排除CN》功能泄漏了，这个你检查v2的配置。或者可以考虑使用PaoPaoGateway。

[upbeat-backbone-bose]

又做了个实验，网关改为主路由默认网关，不走旁路网关v2rayA。
dns依然adghome，配置一致，paopaodns作为上游就不漏了。如果想配合旁路网关使用是还需要增加什么配置参数吗？目前控制变量法是查出这样一个情况。

重新切换回旁路网关v2rayA，将“透明代理/系统代理实现方式”从tproxy，调整为redirect之后也不泄露了，看起来问题还是在网关上，影响了paopaodns的解析结果。我再翻阅资料研究一下两个实现方式的区别，盲猜是代理模式劫持了？这个现象也提供大佬知晓。

[kkkgo]

解析结果其实可能没有影响，只是在PaoPaoDNS解析之前v2自己去查了一次DNS而已。

[kkkgo]

也不存在劫持，DNS泄漏检测原理就是有DNS请求过去

[upbeat-backbone-bose]

解析结果其实可能没有影响，只是在PaoPaoDNS解析之前v2自己去查了一次DNS而已。

可以断定的是与旁路网关有关，非paopaodns的问题，关联因素是代理模式和网关分流规则。不同代理模式有些是首次有漏，后续n-1都不漏。

[wdnb]

我的paopaodns代理使用单独的xray专门给paopaodns服务,都部署在docker里
之前也泄露,xray这样配置后就不泄露了

{
  "log": { "loglevel": "warning" },
  "inbounds": [
    {
      "tag": "socks-in",
      "port": 10808,
      "listen": "0.0.0.0",
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "tag": "proxy",
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "xxxxxxxxxx",
            "port": 555,
            "users": [
              {
                "id": "xxxxxxxxxxxxxxx",
                "encryption": "none",
                "flow": "xtls-rprx-vision"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "serverName": "xxxxxxxx",
          "fingerprint": "chrome", 
          // 建议显式指定 fingerprint，通常 reality 需要配合它
          "publicKey": "xxxxxxxxxxxx",
          "shortId": ""
        }
      },
      // --- 新增优化部分 ---
      "sockopt": {
        "tcpFastOpen": true, // 如果内核支持，极大降低首包延迟
        "tcpKeepAliveInterval": 30, // 保持连接活跃
        "tcpNoDelay": true // 禁用 Nagle 算法，对小包（DNS）非常重要
      }
    },
    // 添加一个 block 出站，用于兜底
    {
      "tag": "block",
      "protocol": "blackhole",
      "settings": {}
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      // 1. 必须阻断私有地址，防止通过代理扫描局域网
      {
        "type": "field",
        "ip": ["geoip:private"],
        "outboundTag": "block"
      },
      // 2. 修正：对于来自 PaoPaoDNS (socks-in) 的流量，无条件走代理
      // 不要在这里阻断 geoip:cn，因为 PaoPaoDNS 已经做过分流了。
      // 如果你担心其他软件误用这个端口，可以保留 block cn，但对 DNS 来说有风险。
      {
        "type": "field",
        "inboundTag": ["socks-in"],
        "outboundTag": "proxy"
      },
      // 3. 默认兜底（如果没有匹配到上面，默认走第一个 outbound，即 proxy）
      // 也可以显式写一条
      {
        "type": "field",
        "network": "tcp,udp",
        "outboundTag": "proxy"
      }
    ]
  }
}

部分docker配置

  # --- Xray Client ---
  xray:
    container_name: xray
    image: ghcr.io/xtls/xray-core:latest
    restart: unless-stopped
    volumes:
      # 必须先在宿主机创建此文件
      - ./data/xray/config.json:/usr/local/etc/xray/config.json
    environment:
      - TZ=Asia/Shanghai
    networks:
      default:
        ipv4_address: 172.20.0.10

  # --- PaoPaoDNS (智能递归 DNS) ---
  paopaodns:
    container_name: paopaodns
    image: sliamb/paopaodns:latest
    restart: unless-stopped
    ulimits:
      nofile: 2097152
    environment:
      - TZ=Asia/Shanghai
      - CNFALL=yes  # Fallback forwarding in poor networks to prevent query failures leading to system DNS leaks.
      - UPDATE=daily  # Daily updates for fresh GEOIP/root data, ensuring high accuracy against IP changes and pollution.
      - IPV6=raw  
      - CNAUTO=yes  # Essential for CN smart routing, optimizing speed and accuracy in China.
      - CN_TRACKER=yes  # Encrypts trackers via DNSCrypt for privacy/accuracy, with minor latency trade-off.
      - USE_MARK_DATA=yes  # Speeds up domain classification for accurate routing.
      - EXPIRED_FLUSH=yes  # Actively purges stale caches for fresh, accurate resolutions.
      - SHUFFLE=lite  # Lightweight round-robin for balanced, faster responses.
      # --- 代理设置 ---
      # 指向 Xray 容器的内部 IP 和端口 (假设 Xray 监听 10808)
      # paopaodns 容器内部/etc/resolv.conf 没有使用docker魔术 DNS 地址
      # 不能用xray:108080
      - SOCKS5=172.20.0.10:10808
    volumes:
      - ./data/paopaodns:/data
    networks:
      - default