Hi everyone,
I'm a Chinese user with Internet access polluted by the GFW (the Great
Firewall of China). To visit, e.g., the sites of Google, I have to setup a
proxy and then redirect related packets to the proxy server at 127.0.0.1.
Currently, I configure something like the following on my OpenWRT
router:
1. Add this line dnsmasq.conf (resolve Google's IP addresses via
8.8.4.4)
- server=/google.com/8.8.4.4
2. Add this line into the firewall script (make sure that the DNS reply
from 8.8.4.4 is not polluted)
- iptables -t nat -I PREROUTING -p udp -d 8.8.4.4/32 -j
REDIRECT --to-ports 8001
3. Add these lines into the firewall script (visit Google's sites via
proxy; there're a lot of addresses to be included)
- iptables -t nat -I PREROUTING -p tcp -d 173.194.127.0/24 -j
REDIRECT --to-ports 8001
- iptables -t nat -I PREROUTING -p tcp -d 216.58.221.0/24 -j
REDIRECT --to-ports 8001
- iptables ...
4. Add this line into the firewall script (start the shadowsocks proxy
at 127.0.0.1)
- ss-redir -s server -p server_port -k password -m
encryption_method -l local_port(8001) &
It works, but I find that I have to update the IP address list every few weeks.
Of course I can create a cron job that do this automatically, something like:
#!/bin/sh
nslookup www.google.com > 01.log
nslookup play.google.com > 02.log
nslookup code.google.com > 03.log
...
awk -f process_nslookup_result.awk 01.log > ip_list.txt
awk -f process_nslookup_result.awk 02.log >> ip_list.txt
awk -f process_nslookup_result.awk 03.log >> ip_list.txt
...
update_iptables_rules.sh ip_list.txt
A major problem of this scheme is that I have to create a lot of similar domain
items, and I cannot have *.google.com like the server option in dnsmasq.conf.
To find out the second-level domains I have missed, some packet tracing is
needed, which is rather boring for most users.
Is there a way to solve this problem? If dnsmasq is able to export the ip
addersses of specified hosts (e.g., *.google.com) to a file, or to execute an
external program when domain names resovled, I think that I will be able to
find a better solution.
Sincerely
Fengyu Gao_______________________________________________
Dnsmasq-discuss mailing list
[email protected]
http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss
