安装后总是提示dns hijack，然后工作不正常，请问怎么解决，下面是详细信息 #111

my202 · 2024-03-22T02:25:50Z

my202
Mar 22, 2024

pao:~# docker exec paopaodns test.sh

images build time : 2024-03-17 02:18:17 UTC
check for the latest version ,
go to https://github.com/kkkgo/PaoPaoDNS/discussions
-> test start 1711075102

yy[DNS hijack]127.0.0.1[DNS hijack]"ns" "120.241.149.58" "ip" "120.241.149.58" "ecs" "120.231.232.1/32/24"yCN-5301 failed:yyyNOCN-5301 failed:yy
[INFO] TEST FAIL.

-> test end 1711075102

pao:~# docker exec paopaodns debug.sh

== debug.sh : docker exec -it paopaodns sh ==

-> debug start 1711075161

[INFO] images build time : 2024-03-17 02:18:17 UTC
[OK]DATA_writeable
[OK]DATA_readable
[INFO] NETWORK
*********************************************************************************

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    inet 127.0.0.1/8 scope host lo
13: eth0@if14: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue state UP 
    inet 172.17.0.2/16 brd 172.17.255.255 scope global eth0
default via 172.17.0.1 dev eth0 
172.17.0.0/16 dev eth0 scope link  src 172.17.0.2 
PING 223.5.5.5 (223.5.5.5): 56 data bytes
64 bytes from 223.5.5.5: seq=0 ttl=118 time=13.411 ms

--- 223.5.5.5 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 13.411/13.411/13.411 ms
PING 119.29.29.29 (119.29.29.29): 56 data bytes
64 bytes from 119.29.29.29: seq=0 ttl=52 time=13.372 ms

--- 119.29.29.29 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 13.372/13.372/13.372 ms
Server:         223.5.5.5
Address:        223.5.5.5#53

Non-authoritative answer:
www.taobao.com  canonical name = www.taobao.com.danuoyi.tbcache.com.
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 36.136.91.205
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 36.136.91.204
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 2409:8c5c:110:77:3::3e9
Name:   www.taobao.com.danuoyi.tbcache.com
Address: 2409:8c5c:110:77:3::3e8

Server:         119.29.29.29
Address:        119.29.29.29#53

Non-authoritative answer:
www.qq.com      canonical name = ins-r23tsuuf.ias.tencent-cloud.net.
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 112.53.42.114
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 112.53.42.52
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 2409:8c54:871:2::34
Name:   ins-r23tsuuf.ias.tencent-cloud.net
Address: 2409:8c54:871:1::73

*********************************************************************************

[INFO] ENV
*********************************************************************************

====ENV TEST====
[OK]DATA_writeable-
[OK]DATA_readable-
MEM:220m 450m 500000 750mb
prefPC:68
CORES:-2-
POWCORES:-2-
ulimit :-1048576-
FDLIM :-4096-
TZ:-Asia/Shanghai-
UPDATE:-weekly-
DNS_SERVERNAME:-PaoPaoDNS,blog.03k.org-
SERVER_IP:-none-
ETHIP:-172.17.0.2-
DNSPORT:-53-
SOCKS5:-no-
CNAUTO:-yes-
IPV6:-yes_only6-
CNFALL:-yes-
CUSTOM_FORWARD:-IP:PORT-
AUTO_FORWARD:-no-
AUTO_FORWARD_CHECK:-yes-
USE_MARK_DATA:-yes-
RULES_TTL:-0-
CUSTOM_FORWARD_TTL:-0-
SHUFFLE:-no-
CN_TRACKER:-yes-
USE_HOSTS:-no-
HTTP_FILE:-yes-
SAFEMODE:-no-
QUERY_TIME:-2000ms-
ADDINFO:-no-
PLATFORM:-Linux 7054e653f39a 6.6.21-0-virt #1-Alpine SMP PREEMPT_DYNAMIC Thu, 07 Mar 2024 10:55:08 +0000 x86_64 Linux-
====ENV TEST====
mosdns kkkgo/mosdns:240317.1
*********************************************************************************

[INFO] PS
*********************************************************************************

PID   USER     TIME  COMMAND
    1 root      0:00 {init.sh} /bin/sh /usr/sbin/init.sh
   23 root      0:00 crond
   54 root      0:00 redis-server unixsocket:/tmp/redis.sock
  154 root      0:00 dnscrypt-proxy -config /data/dnscrypt-resolvers/dnscrypt.toml
  171 root      0:00 unbound -c /tmp/unbound_forward.conf -p
  186 root      0:00 {watch_list.sh} /bin/sh /usr/sbin/watch_list.sh
  192 root      0:00 tail -f /dev/null
  203 root      0:00 unbound -c /tmp/unbound_raw.conf -p
  878 root      0:00 mosdns start -d /data -c /tmp/mosdns.yaml
  915 root      0:00 inotifywait -e modify,delete /etc/unbound/named.cache /data/Country-only-cn-private.mmdb /data/force_cn_list.txt /data/force_nocn_list.txt /data/custom_env.ini /data/global_mark.dat /data/trackerslist.txt
 1004 root      0:00 {debug.sh} /bin/sh /usr/sbin/debug.sh
 1024 root      0:00 ps -ef
*********************************************************************************

[INFO] TOP
*********************************************************************************

CPU:   0% usr   0% sys   0% nic 100% idle   0% io   0% irq   0% sirq
  PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
  203     1 root     S    1219m  40%   0   0% unbound -c /tmp/unbound_raw.conf -
  154     1 root     S    1210m  40%   0   0% dnscrypt-proxy -config /data/dnscr
  878   186 root     S    1210m  40%   1   0% mosdns start -d /data -c /tmp/mosd
   54     1 root     S    22200   1%   0   0% redis-server unixsocket:/tmp/redis
  171     1 root     S    20272   1%   0   0% unbound -c /tmp/unbound_forward.co
  186     1 root     S     1712   0%   0   0% {watch_list.sh} /bin/sh /usr/sbin/
    1     0 root     S     1632   0%   0   0% {init.sh} /bin/sh /usr/sbin/init.s
 1004     0 root     S     1628   0%   0   0% {debug.sh} /bin/sh /usr/sbin/debug
 1025  1004 root     R     1624   0%   1   0% top -n1
  192     1 root     S     1616   0%   1   0% tail -f /dev/null
 1026  1004 root     S     1612   0%   0   0% grep %
  915   186 root     S     1072   0%   1   0% inotifywait -e modify,delete /etc/
   23     1 root     S      860   0%   0   0% crond
*********************************************************************************

[INFO] REDIS
*********************************************************************************

used_memory_human:1010.80K
used_memory_rss_human:3.97M
used_memory_peak_human:1010.80K
total_system_memory_human:2.92G
used_memory_lua_human:31.00K
used_memory_vm_total_human:63.00K
used_memory_scripts_human:181B
maxmemory_human:750.00M
0
*********************************************************************************

[TEST] IP ROUTE
*********************************************************************************

CN IP URL:
120.231.232.17
-
120.231.232.17
--
120.231.232.17
CN RAW-IP URL:
------------------
Non-CN IP URL:
120.231.232.17
-
120.231.232.17
--
120.231.232.17
Non-CN RAW-IP URL:
120.231.232.17
-
120.231.232.17
--
120.231.232.17
---
120.231.232.17
------------------
IP INFO:
120.231.232.17
CN,Shenzhen,Guangdong
ASN9808/China Mobile
HTTP/1.1 
Mozilla/5.0 Gecko/20100101 Firefox/120.0 https://github.com/kkkgo/PaoPaoDNS
Asia/Shanghai Time: 3/22/2024, 10:24:00 AM
[INFO] force_cn_list
domain:whoami.ds.akahelp.net
domain:whoami.03k.org
MOSDNS WHOAMI :
akahelp: "ns" "118.27.108.140"
03k: UNBOUND WHOAMI:
akahelp: 03k: *********************************************************************************

[TEST] HIJACK
*********************************************************************************

ins-r23tsuuf.ias.tencent-cloud.net.
112.53.42.114
112.53.42.52
"ip" "120.241.149.58"
"ns" "120.241.149.58"
"ecs" "120.231.232.1/32/24"
HIJACK 127.0.0.1 = ;; Warning: Client COOKIE mismatch
127.0.0.1
*********************************************************************************

[TEST] DIG-CN [taobao]
*********************************************************************************

MOSDNS CN:
www.taobao.com.danuoyi.tbcache.com.
36.136.91.205
36.136.91.204
UNBOUND CN:
[TEST] DIG-NOCN [youtube]
MOSDNS NOCN:
youtube-ui.l.google.com.
142.250.207.110
172.217.25.174
DNSCRYPT-UNBOUND NOCN:
youtube-ui.l.google.com.
142.250.206.206
142.250.206.238
DNSCRYPT NOCN:
youtube-ui.l.google.com.
142.251.42.238
172.217.163.46
DNSCRYPT-SOCKS5 NOCN:
;; communications error to 127.0.0.1#5303: connection refused
;; no servers could be reached

*********************************************************************************

[TEST] DUAL CN [IPv6=YES will have aaaa,taobao]
*********************************************************************************

www.taobao.com.danuoyi.tbcache.com.
2409:8c5c:110:77:3::3e9
2409:8c5c:110:77:3::3e8
[TEST] DUAL NOCN [IPv6=YES will block aaaa,youtube]
[TEST] ONLY6 [IPv6=only6 will block aaaa if a ok]
checkipv6.synology.com : ddns-checkipv6.quickconnect.to.
checkipv6.digitalocean.synology.com.
2604:a880:2:d0::2049:2001
2604:a880:2:d0::220d:b001
2604:a880:2:d0::2252:d001
2604:a880:2:d0::17e8:4001
2604:a880:2:d0::230f:1
2604:a880:2:d0::2076:5001
2604:a880:2:d0::1700:7001
2604:a880:2:d0::4c0:2001
2604:a880:2:d0::2206:5001
2604:a880:2:d0::2245:7001
2604:a880:2:d0::209a:c001
ip6.03k.org : 2606:4700:3034::6815:15ef
2606:4700:3037::ac43:c96c
6.ipw.cn : 2402:4e00:1013:e500:0:9671:f018:4947

*********************************************************************************

[info] ALL TEST FINISH.

-> debug end 1711075169

然后运行nslookup得到如下结果：
pao:~# nslookup -type=TXT whoami.ds.akahelp.net 192.168.118.144
Server: 192.168.118.144
Address: 192.168.118.144:53

Non-authoritative answer:
whoami.ds.akahelp.net text = "ecs"
whoami.ds.akahelp.net text = "ip"
whoami.ds.akahelp.net text = "ns"

如果换一台同局域网的机器运行这个命令，得到了一个陌生的ip：
C:\Users\max>nslookup -type=TXT whoami.ds.akahelp.net 192.168.118.144
服务器: UnKnown
Address: 192.168.118.144

非权威应答:
whoami.ds.akahelp.net text =

    "ecs"
    "106.52.207.1/32/24"

whoami.ds.akahelp.net text =

    "ip"
    "106.52.230.148"

whoami.ds.akahelp.net text =

    "ns"
    "106.52.230.148"

106.52.230.148，并不是我本机的出口ip，求大神知道。

my202 · 2024-03-22T02:27:32Z

my202
Mar 22, 2024
Author

安装的参数如下：
docker run -d
--name paopaodns
--restart unless-stopped
-v /root/paopao:/data
-e CNAUTO=yes
-e IPV6=yes_only6
-e CNFALL=yes
-e USE_MARK_DATA=yes
-e AUTO_FORWARD=no
-e TZ=Asia/Shanghai
-e HTTP_FILE=yes
-e DNS_SERVERNAME=PaoPaoDNS,blog.03k.org
-e SOCKS5=no
-e CN_TRACKER=yes
-e SAFEMODE=no
--restart unless-stopped
-p 53:53/tcp
-p 53:53/udp
-p 5304:5304/tcp
-p 5304:5304/udp
-p 7889:7889/tcp
sliamb/paopaodns:latest

0 replies

kkkgo · 2024-03-22T02:34:10Z

kkkgo
Mar 22, 2024
Maintainer

参考 #104

3 replies

my202 Mar 22, 2024
Author

看过了，还是没找到原因，用的是深圳移动的宽带，没有ipv4的公网ip，但是有v6的公网ip。
内网没有部署dns劫持的软路由。
paopaodns的宿主机的resolv.conf内容：
pao:/etc# cat resolv.conf
nameserver 119.29.29.29
nameserver 120.196.165.24
求指导，是不是这个环境用不了呀

kkkgo Mar 22, 2024
Maintainer

1、局域网电脑直连路由器，执行nslookup qq.com 9.8.7.6如果有返回结果，说明DNS被劫持，因为9.8.7.6是一个不存在的DNS。
2、尝试使用host网络模式部署docker以获得更好的nat。

my202 Mar 22, 2024
Author

谢谢，确实是路由器劫持了，爱快有一个强制客户端dns代理打开了，关闭就好了。再次谢谢大佬

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

安装后总是提示dns hijack，然后工作不正常，请问怎么解决，下面是详细信息 #111

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

安装后总是提示dns hijack，然后工作不正常，请问怎么解决，下面是详细信息 #111

Uh oh!

my202 Mar 22, 2024

== debug.sh : docker exec -it paopaodns sh ==

Replies: 2 comments · 3 replies

Uh oh!

my202 Mar 22, 2024 Author

Uh oh!

kkkgo Mar 22, 2024 Maintainer

Uh oh!

my202 Mar 22, 2024 Author

Uh oh!

kkkgo Mar 22, 2024 Maintainer

Uh oh!

my202 Mar 22, 2024 Author

my202
Mar 22, 2024

Replies: 2 comments 3 replies

my202
Mar 22, 2024
Author

kkkgo
Mar 22, 2024
Maintainer

my202 Mar 22, 2024
Author

kkkgo Mar 22, 2024
Maintainer

my202 Mar 22, 2024
Author