-
-
Save mba811/27ff7d06d20bbf144c98 to your computer and use it in GitHub Desktop.
安装 DNSMasq dnscrypt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Configuration file for dnsmasq. | |
| # | |
| # Format is one option per line, legal options are the same | |
| # as the long options legal on the command line. See | |
| # "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details. | |
| # Custom development domains | |
| address=/.dev/127.0.0.1 | |
| address=/.dom/127.0.0.1 | |
| # Upstream DNSCrypt | |
| server=127.0.0.1#40 | |
| #user= | |
| #group= | |
| # Don't read the hostnames in /etc/hosts. | |
| no-hosts | |
| # Do not go into the background at startup but otherwise run as | |
| # normal. | |
| keep-in-foreground | |
| # Do not provide DHCP or TFTP on the loopback interface. | |
| no-dhcp-interface=lo | |
| # Only listen on the loopback interface. | |
| listen-address=127.0.0.1 | |
| # Only bind to interfaces dnsmasq is listening on. | |
| bind-interfaces | |
| # Never forward addresses in the non-routed address spaces. | |
| bogus-priv | |
| # Don't read /etc/resolv.conf. | |
| no-resolv | |
| # Reject (and log) addresses from upstream nameservers which are in | |
| # the private IP ranges. This blocks an attack where a browser behind | |
| # a firewall is used to probe machines on the local network. | |
| stop-dns-rebind | |
| # Exempt 127.0.0.0/8 from rebinding checks. This address range is | |
| # returned by realtime black hole servers, so blocking it may disable | |
| # these services. | |
| rebind-localhost-ok | |
| # Never forward plain names (without a dot or domain part). | |
| # domain-needed | |
| # Set the cache size here. If you don't use spam blocking add-ons such | |
| # Adblock Plus or Ghostery, you may want to increase this value as you | |
| # will be resolving more domain names. | |
| cache-size=1000 | |
| #no-negcache | |
| #local-ttl= | |
| # Pass through DNSSEC validation results from dnscrypt-proxy. | |
| proxy-dnssec | |
| #mx-host=maildomain.com,servermachine.com,50 | |
| #mx-target=servermachine.com | |
| #localmx | |
| #selfmx | |
| #log-queries |
- Install DNSMasq
$ brew install dnsmasq- Install DNSCrypt-proxy
$ brew install dnscrypt-proxy-
Configure
-
/usr/local/etc/dnsmasq.conf
-
/Library/LaunchDaemons/homebrew.mxcl.dnscrypt-proxy.plist
-
/Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist
-
Reload
dnscrypt-proxyservice$ sudo launchctl stop homebrew.mxcl.dnscrypt-proxy && sudo launchctl start homebrew.mxcl.dnscrypt-proxy -
Reload
dnsmasqservice$ sudo launchctl stop homebrew.mxcl.dnsmasq && sudo launchctl start homebrew.mxcl.dnsmasq -
Set DNS IP: 127.0.0.1
$ scutil --dns...
resolver #1
search domain[0] : openvpn
nameserver[0] : 127.0.0.1
flags : Request A records, Request AAAA records
reach : Reachable,Local Address
...
$ nslookup -type=txt debug.opendns.comServer: 127.0.0.1
Address: 127.0.0.1#53
Non-authoritative answer:
debug.opendns.com text = "server 7.ams"
debug.opendns.com text = "flags 20 0 2f4 800000000000000"
debug.opendns.com text = "id 0"
debug.opendns.com text = "source xxx.xxx.xxx.xxx:xxxxx"
debug.opendns.com text = "dnscrypt enabled (xxxxxxxxxxxxxxxx)"
Authoritative answers can be found from:
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment