-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add client-rules, group-begin, group-end
- Loading branch information
Showing
8 changed files
with
248 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| --- | ||
| hide: | ||
| - toc | ||
| --- | ||
|
|
||
| # 客户端规则 | ||
|
|
||
| smartdns支持根据客户端IP地址，对客户端设置不同的规则，可以实现： | ||
|
|
||
| * 家长控制：限制特定客户端可访问的网站。 | ||
| * 访问控制：禁止未经允许的客户端查询。 | ||
| * 基于客户端域名分流查询：设置规则组和上游组绑定，不同的客户端查询不同的上游。 | ||
|
|
||
| ## 家长控制 | ||
|
|
||
| 设置smartdns针对特定的客户端使用特定的上游查询，也可以设置禁止访问特定的域名或IP地址，来实现家长控制。 | ||
|
|
||
| ``` | ||
| # 启用规则组 | ||
| group-begin child | ||
| # 设置规则组对应的客户端IP | ||
| client-rules 192.168.1.13 | ||
| # 设置规则组使用的上游服务器 | ||
| server 1.2.3.4 -e | ||
| # 禁止特定域名 | ||
| address /block.com/# | ||
| # 禁止特定IP | ||
| ignore-ip 2.2.2.2 | ||
| group-end | ||
| ``` | ||
|
|
||
| 为方便管理，也可采用多配置文件的方式，如 | ||
|
|
||
| 1. 主配置文件 | ||
| ``` | ||
| conf-file child.conf -group child | ||
| ``` | ||
|
|
||
| 1. 包含的配置文件 | ||
| ``` | ||
| # 设置规则组对应的客户端IP | ||
| client-rules 192.168.1.13 | ||
| # 设置规则组使用的上游服务器 | ||
| server 1.2.3.4 -e | ||
| # 禁止特定域名 | ||
| address /block.com/# | ||
| # 禁止特定IP | ||
| ignore-ip 2.2.2.2 | ||
| ``` | ||
|
|
||
| 其中group-begin和group-end的配置块，等价于conf-file -group 包含的配置文件， | ||
|
|
||
| ## 访问控制 | ||
|
|
||
| smartdns支持基本的ACL功能，可以通过如下参数开启和设置允许访问的主机。 | ||
|
|
||
| ``` | ||
| # 启用ACL | ||
| acl-enable yes | ||
| # 设置允许访问的主机 | ||
| client-rules 192.168.1.2/24 | ||
| ``` | ||
|
|
||
| ## 基于客户端域名分流查询 | ||
|
|
||
| 类似家长控制，smartdns可以将特定需要分流和配合ipset/nftset访问的主机，进行分流。 | ||
|
|
||
| 1. 主配置文件 | ||
| ``` | ||
| conf-file oversea.conf -group oversea | ||
| ``` | ||
|
|
||
| 1. 包含的配置文件 | ||
| ``` | ||
| # 设置规则组对应的客户端IP | ||
| client-rules 192.168.1.13 | ||
| # 设置规则组使用的上游服务器 | ||
| server-https https://1.2.3.4 -e | ||
| server-tls tls://1.2.3.4 -e | ||
| # 禁止测速 | ||
| speed-check-mode none | ||
| # 禁止IPV6和HTTPS记录 | ||
| force-qtype-SOA 28 65 | ||
| # 设置ipset | ||
| ipset oversea | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| --- | ||
| hide: | ||
| - toc | ||
| --- | ||
|
|
||
| # 域名规则 | ||
|
|
||
| 为方便对同一个域名设置多个规则，smartdns提供了`domain-rules`参数，可以对域名设置多个规则。 | ||
|
|
||
| 1. 使用`domain-rules`设置多个规则，如： | ||
|
|
||
| ``` | ||
| domain-rules /a.com/ -g group -address #6 -ipset ipset | ||
| ``` | ||
|
|
||
| domain-rules的选项请阅读配置选项。 | ||
|
|
||
| 1. 在有/domain/配置的选项使用域名集合，只需要将`/domain/`配置为`/domain-set:[集合名称]/`即可，如： | ||
|
|
||
| ```shell | ||
| domain-set -name ad -file /etc/smartdns/ad-list.conf | ||
| domain-rules /domain-set:ad/ -a # | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,90 @@ | ||
| --- | ||
| hide: | ||
| - toc | ||
| --- | ||
|
|
||
| # Client Rules | ||
|
|
||
| smartdns supports setting different rules for clients based on their IP addresses, allowing for: | ||
|
|
||
| * Parental control: Restricting access to specific websites for certain clients. | ||
| * Access control: Prohibiting unauthorized clients from making queries. | ||
| * Client-based domain-based query routing: Binding rule groups with upstream groups, so that different clients can query different upstream servers. | ||
|
|
||
| ## Parental Control | ||
|
|
||
| By configuring smartdns to use specific upstream queries for certain clients, you can implement parental control by restricting access to specific domains or IP addresses. | ||
|
|
||
| ``` | ||
| # Enable Rule Group | ||
| group-begin child | ||
| # Set client IP for the rule group | ||
| client-rules 192.168.1.13 | ||
| # Set upstream server for the rule group | ||
| server 1.2.3.4 -e | ||
| # Block specific domain | ||
| address /block.com/# | ||
| # Block specific IP | ||
| ignore-ip 2.2.2.2 | ||
| group-end | ||
| ``` | ||
|
|
||
| For convenience in management, multiple configuration files can also be used, such as: | ||
|
|
||
| 1. Main configuration file | ||
|
|
||
| ``` | ||
| conf-file child.conf -group child | ||
| ``` | ||
| 1. Included Configuration File | ||
| ``` | ||
| # Set client IP for the rule group | ||
| client-rules 192.168.1.13 | ||
| # Set upstream server for the rule group | ||
| server 1.2.3.4 -e | ||
| # Block specific domain | ||
| address /block.com/# | ||
| # Block specific IP | ||
| ignore-ip 2.2.2.2 | ||
| ``` | ||
| The configuration blocks of group-begin and group-end are equivalent to the configuration files included with conf-file -group. | ||
| ## Access Control | ||
| smartdns supports basic ACL functionality, which allows you to enable and set the hosts that are allowed to access. | ||
| ``` | ||
| # Enable ACL | ||
| acl-enable yes | ||
| # Set allowed hosts | ||
| client-rules 192.168.1.2/24 | ||
| ``` | ||
| ## Client-based Domain-based Query Forwarding | ||
| Similar to parental control, smartdns can route specific hosts that require redirection and are accessed with ipset/nftset. | ||
| 1. Main Configuration File | ||
| ``` | ||
| conf-file oversea.conf -group oversea | ||
| ``` | ||
| 1. Included Configuration File | ||
| ``` | ||
| # Set the client IP for the rule group | ||
| client-rules 192.168.1.13 | ||
| # Set the upstream servers for the rule group | ||
| server-https https://1.2.3.4 -e | ||
| server-tls tls://1.2.3.4 -e | ||
| # Disable speed check | ||
| speed-check-mode none | ||
| # Disable IPV6 and HTTPS logging | ||
| force-qtype-SOA 28 65 | ||
| # Set ipset | ||
| ipset group-tv | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| --- | ||
| hide: | ||
| - toc | ||
| --- | ||
|
|
||
| # Domain Rules | ||
|
|
||
| To facilitate setting multiple rules for the same domain, smartdns provides the `domain-rules` parameter, which allows you to set multiple rules for a domain. | ||
|
|
||
| 1. Use the `domain-rules` parameter to set multiple rules, for example: | ||
|
|
||
| ``` | ||
| domain-rules /a.com/ -g group -address #6 -ipset ipset | ||
| ``` | ||
| Please refer to the configuration options for more information on the `domain-rules` options. | ||
| 1. When using domain sets in options with `/domain/` configuration, you only need to replace `/domain/` with `/domain-set:[set name]/`, for example: | ||
| ```shell | ||
| domain-set -name ad -file /etc/smartdns/ad-list.conf | ||
| domain-rules /domain-set:ad/ -a # | ||
| ``` | ||
| ```shell | ||
| domain-set -name ad -file /etc/smartdns/ad-list.conf | ||
| domain-rules /domain-set:ad/ -a # | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.