DNSCrypt support for V2Ray

[MathNodes]

Currently all DNS and all traffic flow through the v2ray tunnel because of tun2socks. This is secure however may not be wanted as most node runners use google DNS or cloudflare DNS.

A way around this is to create a packet filter rule to send only DNS traffic through the localhost port 53 ONLY when DNscrypt is enabled.

On MacOS this can be achieved by creating a pf.conf file and reading it with the MacOS pfctl command as such

# Redirect all outbound DNS (TCP + UDP) to local DNS server on 127.0.0.1:53
rdr pass on !lo0 inet proto { tcp udp } from any to any port 53 -> 127.0.0.1 port 53

# Allow everything on loopback
pass quick on lo0 all

# Default pass rule for outbound traffic
pass out all keep state

sudo pfctl -f ~/.meile-gui/pf.conf
sudo pfctl -e

Windows & Linux is still TBD. Will update when testing is completed.

[freQniK]

Linux

iptables -t nat -A OUTPUT -p tcp --dport 53 -m owner --uid-owner <dns-resolver-uid> -j RETURN
iptables -t nat -A OUTPUT -p udp --dport 53 -m owner --uid-owner <dns-resolver-uid> -j RETURN
iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to-destination 127.0.0.1:53
iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination 127.0.0.1:53

Windows

$adapters = Get-NetAdapter | Where-Object {
    $_.Status -eq 'Up' -and
    $_.InterfaceDescription -notmatch 'Loopback|Tunnel|Virtual'
}

foreach ($adapter in $adapters) {
    $ifIndex = $adapter.ifIndex
    Set-DnsClientServerAddress -InterfaceIndex $ifIndex -ServerAddresses "127.0.0.1"
    Write-Output "Configured DNS for: $($adapter.Name)"
}

or

Get-NetAdapter | Where-Object Status -eq 'Up' | ForEach-Object {
    Set-DnsClientServerAddress `
        -InterfaceIndex $_.ifIndex `
        -ServerAddresses ("127.0.0.1", "::1")
}

then flush

Clear-DnsClientCache

[freQniK]

This is also applicable to the three new protocols there were added this past week.