分享 使用smartdns+nginx自建dns解锁

之前有用dnsmasq_sniproxy一键方案解锁，挺方便的，不过sniproxy原作者在23年底就表示不再更新。

smartdns由于是多dns并发查询，且足够轻量，而nginx的stream模块则充当sni嗅探和转发

以下为详细安装步骤，在解锁机原生支持chatgpt为前提的范例：
1.解锁机更新nginx官方源

sudo apt update
sudo apt install -y curl gnupg2 ca-certificates lsb-release
echo "deb http://nginx.org/packages/debian $(lsb_release -cs) nginx" | sudo tee /etc/apt/sources.list.d/nginx.list
curl -fsSL https://nginx.org/keys/nginx_signing.key | sudo apt-key add -
sudo apt update

2.解锁机安装nginx

sudo apt install nginx -y

3.修改/etc/nginx/nginx.conf添加Stream字段，这里的4个域名为chatgpt解锁域名，有其他解锁需求自行添加域名

stream {
    map $ssl_preread_server_name $filtered_sni_name {
        ~^(.*|)openai\.com$ $ssl_preread_server_name;
        ~^(.*|)chatgpt\.com$ $ssl_preread_server_name;
        ~^(.*|)oaistatic\.com$ $ssl_preread_server_name;
        ~^(.*|)oaiusercontent\.com$ $ssl_preread_server_name;
        default "127.255.255.255";  
    }

    server {
        resolver 1.1.1.1 1.0.0.1;
        listen 443;
        proxy_pass $filtered_sni_name:443;
        ssl_preread on;
    }
}

4.重启nginx

sudo systemctl restart nginx

5.安装smartdns
官网下载对应安装文件
https://github.com/pymumu/smartdns/releases
以debian系统为例

sudo wget https://github.com/pymumu/smartdns/releases/download/Release46/smartdns.1.2024.06.12-2222.x86_64-debian-all.deb && sudo dpkg -i smartdns.1.2024.06.12-2222.x86_64-debian-all.deb && rm -rf smartdns.1.2024.06.12-2222.x86_64-debian-all.deb && sudo systemctl enable smartdns

6.修改/etc/smartdns/smartdns.conf解锁机配置文件

bind :53 -no-dualstack-selection -no-speed-check
dualstack-ip-selection no
speed-check-mode none
#force-AAAA-SOA yes
server 1.1.1.1
server 1.0.0.1
# > Openai
address /chatgpt.com/解锁机IP
address /openai.com/解锁机IP
address /oaistatic.com/解锁机IP
address /oaiusercontent.com/解锁机IP

7.启动smartdns

sudo systemctl start smartdns

8.出于安全考虑可以添加只允许特定ip访问解锁机DNS，是否需要自行选择

sudo apt-get install iptables-persistent -y
iptables -A INPUT -i lo -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i lo -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -s 线路机IP -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 线路机IP -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
netfilter-persistent save

9.线路机安装smartdns并修改/etc/smartdns/smartdns.conf配置文件

bind :53@lo -no-dualstack-selection -no-speed-check
dualstack-ip-selection no
speed-check-mode none
#force-AAAA-SOA yes
server 1.1.1.1
server 1.0.0.1
server 解锁机IP -group nginx -exclude-default-group
# > Openai
nameserver /openai.com/nginx
nameserver /chatgpt.com/nginx
nameserver /oaistatic.com/nginx
nameserver /oaiusercontent.com/nginx

10.修改系统dns为127.0.0.1即全部完成

当然，依托nginx的嗅探与转发，也可以配合dnsmasq和DNSProxy使用