使用域名规则匹配chatgpt.com

[Smoovsky]

chatgpt网站默认启用了http3，基于quic基于udp。因为v2ray/xray的域名嗅探不支持http3所以无法使用域名匹配。

推荐关闭浏览器的http3支持，以绕开这个问题：
edge://flags/#enable-quic
chrome://flags/#enable-quic

[mydogshitgold]

FakeDNS sniffer should not be affected by HTTP/3.

[Smoovsky]

What's your full configuration? (remember to mask sensitive information like IPs)

{
    "log": {
        "access": "/var/log/xray/access.log",
        "error": "/var/log/xray/error.log",
        "loglevel": "debug"
    },
    "dns": {
        "queryStrategy": "UseIPv4",
        "servers": [
            "223.5.5.5",
            {
                "address": "223.5.5.5",
                "domains": [
                    "domain:duckdns.org"
                ]
            },
            {
                "address": "fakedns",
                "domains": [
                    "geosite:gfw",
                    "geosite:greatfire"
                ]
            }
            // no need to setup a real DNS server for proxified sites, right?
            // ,{
            //     "address": "8.8.8.8",
            //     "domains": [
            //         "geosite:gfw",
            //         "geosite:greatfire"
            //     ]
            // }
        ]
    },
    "inbounds": [
        {
            "tag": "transparent",
            "port": 1088,
            "protocol": "dokodemo-door",
            "settings": {
                "network": "tcp,udp",
                "followRedirect": true
            },
            "sniffing": {
                "enabled": true,
                "destOverride": [
                    "fakedns+others"
                ],
                "metadataOnly": false
            },
            "streamSettings": {
                "sockopt": {
                    "tproxy": "tproxy"
                }
            }
        }
    ],
    "outbounds": [
        // default
        {
            "protocol": "freedom",
            "settings": {},
            "tag": "direct",
            "streamSettings": {
                "sockopt": {
                    "mark": 255
                }
            }
        },
        {
            "protocol": "vless",
            "tag": "proxy",
            "settings": {
                "vnext": [
                    {
                        "address": "<server-ip>",
                        "port": 443,
                        "users": [
                            {
                                "id": "<id>",
                                "encryption": "none"
                            }
                        ]
                    }
                ]
            },
            "streamSettings": {
                "network": "ws",
                "security": "tls",
                "tlsSettings": {
                    "allowInsecure": true
                },
                "wsSettings": {
                    "path": "/<path>"
                },
                "sockopt": {
                    "mark": 255
                }
            },
            "mux": {
                "enabled": true,
                "concurrency": 8
            }
        },
        {
            "tag": "dns-out",
            "protocol": "dns",
            "streamSettings": {
                "sockopt": {
                    "mark": 255
                }
            }
        },
        {
            "protocol": "blackhole",
            "settings": {},
            "tag": "blocked"
        }
    ],
    "routing": {
        "domainStrategy": "IPOnDemand",
        "rules": [
            {
                "type": "field",
                "inboundTag": [
                    "transparent"
                ],
                "port": 53,
                "network": "udp",
                "outboundTag": "dns-out",
                "ip": [
                    "<dns-configured-in-dhcp>"
                ]
            },
            // dunno why, duckdns.org is included in either geosite:greatfire or geosite:gfw, without this config, DDNS will be broken
            {
                "type": "field",
                "inboundTag": [
                    "transparent"
                ],
                "outboundTag": "direct",
                "domain": [
                    "domain:duckdns.org"
                ]
            },
            {
                "type": "field",
                "inboundTag": [
                    "transparent"
                ],
                "outboundTag": "proxy",
                "domain": [
                    "geosite:gfw",
                    "geosite:greatfire"
                ]
            }
            // ,
            // {
            //     "type": "field",
            //     "inboundTag": [
            //         "transparent"
            //     ],
            //     "outboundTag": "proxy",
            //     "ip": [
            //         "8.8.8.8/32"
            //     ]
            // }
        ]
    }
}

By the way, it also doesn't work with the commented-out section.

[Smoovsky]

BTW, your DNS server 223.5.5.5 is unreliable, 128.242.245.180 definitely does not belongs to Google. Sending DNS queries to malicious servers is bad for privacy, you should proxy DNS queries to more reputational servers or use DoH instead.

I'm not expecting it to send out that DNS query at all - If I don't get it wrong, the name should always be resolved as an ip from fakedns's ip pool.

And at least the proxy is still working - as the route is matched by tls sniffing which I assume the server will do the actual name resolution.

[mydogshitgold]

Try this

// vi: ft=jsonc
{
  "$schema": "https://cdn.jsdelivr.net/gh/EHfive/v2ray-jsonschema/v4-config.schema.json",
  "log": {
    "access": "/var/log/xray/access.log",
    "error": "/var/log/xray/error.log",
    "loglevel": "debug"
  },
  "inbounds": [
    {
      "tag": "transparent",
      "port": 1088,
      "protocol": "dokodemo-door",
      "settings": {
        "network": "tcp,udp",
        "followRedirect": true
      },
      "sniffing": {
        "enabled": true,
        // FakeDNS is a metadata matcher
        "metadataOnly": true,
        "destOverride": [
          // "fakedns" should be sufficient if you route all DNS queries to v2ray
          "fakedns"
        ]
      },
      "streamSettings": {
        "sockopt": {
          "tproxy": "tproxy",
          // you probably forgot this line
          "mark": 255
        }
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct",
      "protocol": "freedom",
      "settings": {
        // this line is required went using FakeDNS
        "domainStrategy": "UseIPv4"
      },
      "streamSettings": {
        "sockopt": {
          "mark": 255
        }
      }
    },
    {
      "tag": "dns-out",
      "protocol": "dns",
      "proxySettings": {
        // prevent DNS leaks
        "tag": "proxy"
      },
      "settings": {
        // fallback for non A, AAAA queries
        "address": "1.1.1.1",
        "port": 53
      },
      "streamSettings": {
        "sockopt": {
          "mark": 255
        }
      }
    },
    {
      "tag": "blocked",
      "protocol": "blackhole"
    }
  ],
  "routing": {
    // You should use "AsIs" when using FakeDNS
    "domainStrategy": "AsIs",
    // potentially better performance
    "domainMatcher": "mph",
    "rules": [
      {
        "outboundTag": "dns-out",
        "inboundTag": [
          "transparent"
        ],
        "port": 53,
        // some software uses DNS over TCP
        "network": "tcp,udp",
        "type": "field"
      },
      {
        "outboundTag": "direct",
        "domains": [
          "DOMAIN NAME OF YOUR PROXY SERVER",
          // do not proxy hosts like localhost
          "geosite:private",
          // do not expose your server to Big Brothers
          "geosite:cn",
          "domain:duckdns.org"
        ],
        "type": "field"
      },
      {
        "outboundTag": "direct",
        "ip": [
          "geoip:private",
          "geoip:cn",
          "223.5.5.5"
        ],
        "type": "field"
      },
      {
        "outboundTag": "direct",
        "inboundTag": [
          "transparent"
        ],
        "port": 123,
        "network": "udp",
        "type": "field"
      },
      {
        "outboundTag": "direct",
        // for local DoH
        "ip": [
          "1.1.1.1"
        ],
        "port": 443,
        "network": "tcp",
        "type": "field"
      },
      {
        "outboundTag": "proxy",
        "domains": [
          // make windows happy.
          "domain:msftncsi.com",
          "domain:msftconnecttest.com",
          "geosite:gfw",
          "geosite:greatfire"
        ],
        "type": "field"
      },
      // gatekeeping
      {
        "outboundTag": "proxy",
        "inboundTag": [
          "transparent"
        ],
        "ip": [
          "geoip:!cn"
        ],
        "type": "field"
      }
    ]
  },
  "dns": {
    "tag": "dns-in",
    "queryStrategy": "UseIPv4",
    "domainMatcher": "mph",
    "servers": [
      {
        "address": "fakedns",
        "domains": [
          "geosite:gfw",
          "geosite:greatfire"
        ]
      },
      // as a fallback
      {
        "address": "1.1.1.1",
        "domains": [
          // make windows happy again
          "domain:msftncsi.com",
          "domain:msftconnecttest.com"
        ]
      },
      // this is safe because DoH is encrypted
      "https+local://1.1.1.1/dns-query",
      {
        "address": "223.5.5.5",
        // you don't want to leak DNS queries
        "fallbackStrategy": "Disabled",
        "domains": [
          "domain:duckdns.org"
        ]
      }
    ]
  }
}

For sake of simplicity I removed proxy outbound.

[Smoovsky]

Spent another three hours on this but got no luck.
Used your config and just supply my server details;

In my case, the FakeDNS sniffing seems to be completely broken ever since the beginning:

2023/02/18 03:57:46 [Debug] app/dns: domain www.google.com matches following rules: [geosite:gfw(DNS idx:2) geosite:greatfire(DNS idx:2)]
2023/02/18 03:57:46 [Debug] app/dns: domain www.google.com will use DNS in order: [FakeDNS UDP:223.5.5.5:53 UDP:223.5.5.5:53]
2023/02/18 03:57:46 [Info] [2931918952] app/dispatcher: fake dns got domain: www.google.com for ip: 198.19.183.197
2023/02/18 03:57:46 [Info] [2931918952] app/dispatcher: default route for tcp:198.19.183.197:443
2023/02/18 03:57:46 [Info] [866264942] proxy/freedom: opening connection to tcp:198.19.183.197:443
2023/02/18 03:58:17 [Info] [866264942] transport/internet/tcp: dialing TCP to tcp:198.19.183.197:443
2023/02/18 03:58:17 [Debug] transport/internet: dialing to tcp:198.19.183.197:443
2023/02/18 03:58:18 [Info] [866264942] app/proxyman/outbound: failed to process outbound traffic > proxy/freedom: failed to open connection to tcp:198.19.183.197:443 > common/retry: [dial tcp 198.19.183.197:443: i/o timeout dial tcp 198.19.183.197:443: operation was canceled] > common/retry: all retry attempts failed

FakeDNS sniffing is totally absent and client just try to connect to 198.19.183.197 as it's a normal address.

[mydogshitgold]

This is strange. I tested this configuration and it works fine.

2023/02/18 15:26:08 [Debug] app/dns: domain google.com will use DNS in order: [fakedns(DNS idx:0) UDP:1.1.1.1:53 DOHL//1.1.1.1] [TypeA]
2023/02/18 15:26:08 [Info] app/dns: fakedns got answer: google.com -> [198.18.0.1]
2023/02/18 15:26:08 [Debug] [2493316714] proxy/dokodemo: processing connection from: 10.0.0.10:36178
2023/02/18 15:26:08 [Info] [2493316714] proxy/dokodemo: received request for 10.0.0.10:36178
2023/02/18 15:26:08 [Info] [2493316714] app/dispatcher: fake dns got domain: google.com for ip: 198.18.0.1
2023/02/18 15:26:08 [Info] [2493316714] app/dispatcher: sniffed domain: google.com for tcp:198.18.0.1:80
2023/02/18 15:26:08 [Info] [2493316714] app/dispatcher: taking detour [proxy] for [tcp:google.com:80]
2023/02/18 15:26:08 [Info] [2493316714] transport/internet/grpc: creating connection to tcp:127.0.0.1:10040
2023/02/18 15:26:08 10.0.0.10:36178 accepted tcp:198.18.0.1:80 [proxy]
2023/02/18 15:26:08 [Info] [2493316714] proxy/vmess/outbound: tunneling request to tcp:google.com:80 via 127.0.0.1:10040

[rurirei]

do you try quic sniffer

[Smoovsky]

Just noticed quic is also supported in as a sniffer type. Looks like my knowledge is quite outdated, thanks for the hint!

[SakuraSakuraSakuraChan]

系统代理的话Chrome系应该只会发起TCP连接