dns over https客戶端搭建
dnscrypt-proxy是一個開源的DNSCrypt與DNS over HTTPS客戶端，項目地址：https://github.com/dnscrypt/dnscrypt-proxy。程序是用go語言寫的，下載release即可，沒有任何依賴庫，找到自己平臺對應(yīng)的版本下載即可。MT7620/MT7621平路由器臺下載linux-mipsle版本的build，一般的Linux服務(wù)器或NAS下載amd64的build。
下載解壓完成后，示例配置文件為example-dnscrypt-proxy.toml。把這個文件復(fù)制一份，重命名為dnscrypt-proxy.toml。以下為配置文件前面部分修改樣例。
#這個列表用于指定將要使用的服務(wù)器。有ipv6網(wǎng)絡(luò)時建議優(yōu)先使用ipv6服務(wù)器。
#服務(wù)器名稱能在 https://dnscrypt.info/public-servers 找到。
#server_names = ['dnswarden-doh2-ipv6','cloudflare-ipv6','gridns-jp-ipv6','jp.tiar.app-doh-ipv6']
server_names = ['dnswarden-doh2','cloudflare','doh-jp-blahdns','jp.tiarap.org']
#程序監(jiān)聽地址。如果要對所有地址服務(wù)，可以監(jiān)聽'0.0.0.0:53'或'[::]:53'.
#也可以監(jiān)聽多個地址，例如 listen_addresses = ['127.0.0.1:53', '192.168.1.2:53']
listen_addresses = ['127.0.0.1:53']
max_clients = 250
# Use servers reachable over IPv4
ipv4_servers = true
# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity
ipv6_servers = true
# Use servers implementing the DNSCrypt protocol
dnscrypt_servers = false
# Use servers implementing the DNS-over-HTTPS protocol
doh_servers = true
## Require servers defined by remote sources to satisfy specific properties
# Server must support DNS security extensions (DNSSEC)
#服務(wù)器支持DNSSEC
require_dnssec = false
# Server must not log user queries (declarative)
#服務(wù)器不會記錄查詢
require_nolog = true
# Server must not enforce its own blacklist (for parental control, ads blocking...)
#服務(wù)器不會過濾結(jié)果
require_nofilter = true
# Server names to avoid even if they match all criteria
#服務(wù)器黑名單
disabled_server_names = []
修改這些配置就可以正常使用了，運行dnscrypt-proxy文件即可。程序會在前臺運行，Linux及OpenWrt用戶推薦在screen里運行，以免ssh斷開導(dǎo)致程序停止運行。運行后，會輸出類似下面的文本。程序會先對所有服務(wù)器進(jìn)行測速，自動選擇響應(yīng)時間最低的服務(wù)器，并過一段時間再對服務(wù)器進(jìn)行測速。
root@1m6js5Z:~/linux-x86_64# ./dnscrypt-proxy
[2020-01-16 19:09:51] [NOTICE] dnscrypt-proxy 2.0.36
[2020-01-16 19:09:51] [NOTICE] Network connectivity detected
[2020-01-16 19:10:05] [NOTICE] Source [public-resolvers] loaded
[2020-01-16 19:10:05] [NOTICE] Source [relays] loaded
[2020-01-16 19:10:05] [NOTICE] Firefox workaround initialized
[2020-01-16 19:10:05] [NOTICE] Now listening to 0.0.0.0:5353 [UDP]
[2020-01-16 19:10:05] [NOTICE] Now listening to 0.0.0.0:5353 [TCP]
[2020-01-16 19:10:05] [NOTICE] [doh-jp-blahdns] OK (DoH) - rtt: 61ms
[2020-01-16 19:10:07] [NOTICE] [cloudflare] OK (DoH) - rtt: 172ms
[2020-01-16 19:10:08] [NOTICE] [jp.tiarap.org] OK (DoH) - rtt: 180ms
[2020-01-16 19:10:08] [NOTICE] Sorted latencies:
[2020-01-16 19:10:08] [NOTICE] - 61ms doh-jp-blahdns
[2020-01-16 19:10:08] [NOTICE] - 172ms cloudflare
[2020-01-16 19:10:08] [NOTICE] - 180ms jp.tiarap.org
[2020-01-16 19:10:08] [NOTICE] Server with the lowest initial latency: doh-jp-blahdns (rtt: 61ms)
[2020-01-16 19:10:08] [NOTICE] dnscrypt-proxy is ready - live servers: 3
搭建chinadns-ng服務(wù)加速查詢
項目地址 https://github.com/zfl9/chinadns-ng
將上一步中搭建的doh服務(wù)監(jiān)聽5353端口。
git clone或下載zip并解壓到本地，進(jìn)入項目目錄并編譯。
更新chnroute并運行。推薦在screen里運行。
git clone https://github.com/zfl9/chinadns-ng
cd chinadns-ng
make
./update-chnroute.sh
./update-chnroute6.sh
./chinadns-ng -b 0.0.0.0 -l 53 -c 1.2.4.8 -t 127.0.0.1#5353 -g gfwlist.txt -m chnlist.txt
chinadns-ng會同時查詢兩個上游dns，對于可信結(jié)果就直接返回，不可信結(jié)果就等待可信dns返回結(jié)果。
