[Bug] 一个域名指向多个IP的情况下在访问过域名后再去ssh登录这几个IP会出现问题

jeanaio commented 1 month ago

Verify steps

[X] I have read the documentation and understand the meaning of all configuration items I have written, avoiding a large number of seemingly useful options or default values.
[X] I have not reviewed the documentation and resolve this issue.
[X] I have not searched the Issue Tracker for the problem I am going to raise.
[X] I have tested with the latest Alpha branch version, and the issue still persists.
[X] I have provided server and client configuration files and processes that can reproduce the issue locally, rather than a desensitized complex client configuration file.
[X] I have provided the simplest configuration that can reproduce the error I reported, rather than relying on remote servers, TUN, graphical client interfaces, or other closed-source software.
[X] I have provided complete configuration files and logs, rather than providing only parts that I believe are useful due to confidence in my own intelligence.

Operating System

Linux

System Version

Alpine Linux v3.20

Mihomo Version

v1.8.5 - v1.8.8 使用这几个都有问题，之前版本没测试

Configuration File

# 以下是部分配置文件

# 允许局域网的连接
allow-lan: true
bind-address: "*"
mode: rule

log-level: warning

ipv6: false

tcp-concurrent: true # TCP 并发连接所有 IP, 将使用最快握手的 TCP

# clash 的 RESTful API 监听地址
external-controller: 0.0.0.0:9090

external-ui: ui

global-client-fingerprint: chrome

#  TCP keep alive interval
keep-alive-interval: 15

# fwmark on Linux only
routing-mark: 6666

# 实验性功能
experimental:
  ignore-resolve-fail: true # 忽略 DNS 解析失败，默认值为 true

hosts:
  # '*.clash.dev': 127.0.0.1
  # '.dev': 127.0.0.1

profile:
  store-selected: false
  store-fake-ip: true

dns:
  enable: true
  prefer-h3: true # 开启 DoH 支持 HTTP/3，将并发尝试
  listen: 0.0.0.0:53
  ipv6: false # 当此选项为 false 时, AAAA 请求将返回空

  default-nameserver:
    - 101.226.4.6 # dnspai.com
    - 119.29.29.29 # dnspod.com
    - 223.5.5.5 # 阿里DNS

  enhanced-mode: redir-host # fake-ip/redir-host
  fake-ip-range: 198.18.0.1/16 # Fake IP 地址池 (CIDR 形式)，如果你不知道这个参数的作用，请勿修改
  # use-hosts: true # 查询 hosts 并返回 IP 记录

  # 在以下列表的域名将不会被解析为 fake ip，这些域名相关的解析请求将会返回它们真实的 IP 地址
  fake-ip-filter: # fake-ip 白名单列表
    # 以下域名列表参考自 vernesong/OpenClash 项目，并由 Hackl0us 整理补充
    # === LAN ===
    - '*.lan'

  nameserver-policy:
    "rule-set:direct,apple,icloud,private":
      - tls://223.5.5.5:853
      - tls://223.6.6.6:853
    "rule-set:gfw,greatfire,tld-not-cn,proxy,google":
      - tls://1.0.0.1:853

  nameserver:
    # dnspod
    # - tls://dot.pub:853
    - tls://1.12.12.12:853
    - tls://120.53.53.53:853

    # 阿里
    # - tls://dns.alidns.com:853
    - tls://223.5.5.5:853
    - tls://223.6.6.6:853

  fallback:
    # google
    - https://dns.google/dns-query # google 的 DoH
    - https://8.8.8.8/dns-query
    - https://8.8.4.4/dns-query

  fallback-filter:
    geoip: true
    geoip-code: CN
    # geosite:
    #   - gfw
    ipcidr:
      - 240.0.0.0/4
      - 0.0.0.0/32
    # domain:
    #   - '+.google.com'
    #   - '+.facebook.com'
    #   - '+.youtube.com'
tun:
  enable: true
  stack: system # system / gvisor / mixed
  auto-route: true # auto set global route
  auto-redir: true # or false
  auto-detect-interface: true

rules:

  # 最终规则
  - IP-CIDR,127.0.0.0/8,DIRECT
  # - GEOSITE,geolocation-!cn,proxy
  - GEOIP,LAN,DIRECT
  - GEOIP,CN,DIRECT
  - MATCH,proxy

Description

一个域名指向多个IP的情况下在访问过该域名后再去ssh登录这几个IP会出现问题

例如： abc.com 指向了一下IP 1.1.1.1 2.2.2.2 3.3.3.3

在通过浏览器访问过https://abc.com后，再通过ssh登录这几个IP会出现问题，比如我ssh登录1.1.1.1，有可能被路由到2.2.2.2这个IP

mihomo 是以 docker实例的方式运行，使用tun模式，当网关使用

在面板上查看是这样的

abc.com:443 TCP Tun proxy / auto / Proxy-LA Match abc.com:22 TCP Tun proxy / auto / Proxy-LA Match

但实际上我访问22端口用的是IP而非域名，访问443端口那个是用abc.com域名访问的

Reproduction Steps

解析域名到多个IP，最好3个以上比较容易发现问题先访问域名，然后在ssh登录这几个IP，会发现有可能访问A服务器的IP，实际上连接到B服务器上

Logs

No response

jeanaio commented 1 month ago

本机用 Clash Verge 内核 v1.8.7 TUN模式能复现上述问题使用容器中 mihomo 的 socks5 同时代理浏览器和ssh工具能复现上述问题

Skyxim commented 1 month ago

redir-host 天生缺陷，使用 fake-ip 解决

MetaCubeX / mihomo