Pro100x3mal
commented
9 months ago { "dns": { "servers": [ { "address": "127.0.0.1", "port": 53 } ] }, "routing": { "domainStrategy": "IPIfNonMatch", "rules": [ { "type": "field", "inboundTag": ["dns-in"], "outboundTag": "dns-out" }, // your other rules here ] }, "inbounds": [ { "port": 53, "tag": "dns-in", "protocol": "dokodemo-door", "settings": { "address": "127.0.0.1", "port": 53, "network": "tcp,udp" } }, // your other inbounds here ], "outbounds": [ { "tag": "dns-out", "protocol": "dns", "settings": { "network": "tcp,udp", "address": "127.0.0.1", "port": 53 } }, // your other outbounds here ] }the "dns" section is set to use your local Unbound DNS resolver (127.0.0.1 on port 53). An inbound with the "dokodemo-door" protocol is set up to listen for DNS requests on port 53, and a corresponding outbound is set up to handle these requests. The routing rules are set to route all DNS requests (tagged with "dns-in") through the "dns-out" outbound.
Thanks for the help! I will make changes to the Xray server configuration based on your example. But it didn't work, xray starts but clients don't get internet access. Here is the final server configuration:
{
"api": {
"services": [
"HandlerService",
"LoggerService",
"StatsService"
],
"tag": "api"
},
"dns": {
"servers": [
{
"address": "127.0.0.1",
"port": 53
}
]
},
"fakeDns": null,
"inbounds": [
{
"listen": null,
"port": 53,
"protocol": "dokodemo-door",
"settings": {
"address": "127.0.0.1",
"network": "tcp,udp",
"port": 53
},
"sniffing": null,
"streamSettings": null,
"tag": "dns-in"
},
{
"listen": "127.0.0.1",
"port": 62789,
"protocol": "dokodemo-door",
"settings": {
"address": "127.0.0.1"
},
"sniffing": null,
"streamSettings": null,
"tag": "api"
},
{
"listen": null,
"port": 443,
"protocol": "vless",
"settings": {
"clients": [
{
"email": "111",
"flow": "xtls-rprx-vision",
"id": "111"
},
{
"email": "222",
"flow": "xtls-rprx-vision",
"id": "222"
},
{
"email": "333",
"flow": "xtls-rprx-vision",
"id": "333"
},
{
"email": "444",
"flow": "xtls-rprx-vision",
"id": "444"
}
],
"decryption": "none",
"fallbacks": []
},
"sniffing": {
"destOverride": [
"http",
"tls",
"quic",
"fakedns"
],
"enabled": true
},
"streamSettings": {
"network": "tcp",
"realitySettings": {
"dest": "www.microsoft.com:443",
"maxClient": "",
"maxTimediff": 0,
"minClient": "",
"privateKey": "000",
"serverNames": [
"microsoft.com",
"www.microsoft.com"
],
"settings": {
"fingerprint": "firefox",
"publicKey": "000",
"serverName": "",
"spiderX": "/"
},
"shortIds": [
"111",
"222",
"333",
"444"
],
"show": false,
"xver": 0
},
"security": "reality",
"tcpSettings": {
"acceptProxyProtocol": false,
"header": {
"type": "none"
}
}
},
"tag": "inbound-443"
}
],
"log": {
"loglevel": "warning"
},
"outbounds": [
{
"protocol": "dns",
"settings": {
"address": "127.0.0.1",
"network": "tcp,udp",
"port": 53
},
"tag": "dns-out"
},
{
"protocol": "freedom",
"settings": {
"domainStrategy": "AsIs"
}
},
{
"protocol": "blackhole",
"settings": {},
"tag": "blocked"
}
],
"policy": {
"levels": {
"0": {
"statsUserDownlink": true,
"statsUserUplink": true
}
},
"system": {
"statsInboundDownlink": true,
"statsInboundUplink": true
}
},
"reverse": null,
"routing": {
"domainStrategy": "IPIfNonMatch",
"rules": [
{
"inboundTag": [
"dns-in"
],
"outboundTag": "dns-out",
"type": "field"
},
{
"inboundTag": [
"api"
],
"outboundTag": "api",
"type": "field"
}
]
},
"stats": {},
"transport": null
}Here are the xray server logs:
Nov 12 20:47:15 ubuntu /usr/local/x-ui/x-ui[756]: INFO - web server run http on 127.0.0.1:5000
Nov 12 20:47:15 ubuntu /usr/local/x-ui/x-ui[756]: INFO - Tg notify enabled,run at @weekly
Nov 12 20:47:15 ubuntu /usr/local/x-ui/x-ui[756]: INFO - Sub server run https on [::]:5001
Nov 12 20:47:15 ubuntu x-ui[756]: Tgbot connected!
Nov 12 20:47:15 ubuntu /usr/local/x-ui/x-ui[756]: INFO - Starting Telegram receiver ...
Nov 12 20:47:16 ubuntu x-ui[756]: 2023/11/12 20:47:16 Conflict: terminated by other getUpdates request; make sure that only one bot instance is running
Nov 12 20:47:16 ubuntu x-ui[756]: 2023/11/12 20:47:16 Failed to get updates, retrying in 3 seconds...PS: Server: x-ui v1.6.0 by alireza0 + xray 1.8.4 Clients: Shadowrocket, Streisand (ios)
Hello. I want to use my own DNS resolver in xray. On the vps with Ubuntu, an xray server and the reality protocol (x-ui panel by alireza0) are installed and configured, and it also has the Unbound caching dns resolver installed. Unbound is configured as a system DNS resolver (127.0.0.1 in /etc/resolv.conf), access is allowed from 127.0.0.1/32 and the private network 10.0.0.0/8, port 53 is open to the private subnet 10.0.0.0/8. Wireguard server (10.10.10.0) is also installed on the vps. Wireguard client configurations indicate to use dns = 10.10.10.0. It turns out that all clients (ios, android, win, linux) are protected from DNS leaks, since domain name resolution occurs on the vps using Unbound. Please tell me how I can configure the xray-reality configuration so that all clients (ios, android, win, linux) also use my own Unbound dns resolver? At the same time, it is important that routing works with my configured routing rules on clients! At the moment, tests for dns leaks show that domain name resolution is not happening on the IP of my vps. I tried adding xray to the configuration:
"dns": { "servers": [ "127.0.0.1" ] },
but it doesn't work as it should