Improve OpenVPN & OpenConnect interoperability
This commit is contained in:
世界
@@ -46,6 +46,8 @@ The type of the DNS server.
|
||||
| `mdns` | [mDNS](./mdns/) |
|
||||
| `fakeip` | [Fake IP](./fakeip/) |
|
||||
| `tailscale` | [Tailscale](./tailscale/) |
|
||||
| `openconnect` | [OpenConnect](./openconnect/) |
|
||||
| `openvpn` | [OpenVPN](./openvpn/) |
|
||||
| `resolved` | [Resolved](./resolved/) |
|
||||
|
||||
#### tag
|
||||
|
||||
@@ -46,6 +46,8 @@ DNS 服务器的类型。
|
||||
| `mdns` | [mDNS](./mdns/) |
|
||||
| `fakeip` | [Fake IP](./fakeip/) |
|
||||
| `tailscale` | [Tailscale](./tailscale/) |
|
||||
| `openconnect` | [OpenConnect](./openconnect/) |
|
||||
| `openvpn` | [OpenVPN](./openvpn/) |
|
||||
| `resolved` | [Resolved](./resolved/) |
|
||||
|
||||
#### tag
|
||||
|
||||
@@ -0,0 +1,97 @@
|
||||
---
|
||||
icon: material/new-box
|
||||
---
|
||||
|
||||
!!! question "Since sing-box 1.14.0"
|
||||
|
||||
# OpenConnect
|
||||
|
||||
### Structure
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "openconnect",
|
||||
"tag": "",
|
||||
|
||||
"endpoint": "oc-client",
|
||||
"accept_default_resolvers": false,
|
||||
"accept_search_domain": false
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Fields
|
||||
|
||||
#### endpoint
|
||||
|
||||
==Required==
|
||||
|
||||
The tag of the [OpenConnect Endpoint](/configuration/endpoint/openconnect).
|
||||
|
||||
DNS queries are sent to the resolvers pushed by the VPN server through the OpenConnect endpoint. Pushed split-DNS rules use their dedicated resolvers, while pushed split-DNS and search-domain suffixes use the general pushed resolvers. The most specific matching suffix takes precedence.
|
||||
|
||||
Pushed DNS settings are not installed into the operating system.
|
||||
|
||||
#### accept_default_resolvers
|
||||
|
||||
Accept the general resolvers pushed by the VPN server for unmatched queries.
|
||||
|
||||
When enabled, the general resolvers are used as the default only if the server requests all DNS through the tunnel, or if it does not provide split-DNS rules or suffixes. Otherwise, unmatched queries return `NXDOMAIN`.
|
||||
|
||||
#### accept_search_domain
|
||||
|
||||
When enabled and pushed search domains are available, single-label queries (for example, `intranet`) are retried with each search domain until one resolves.
|
||||
|
||||
If every search-domain expansion returns `NXDOMAIN`, the original unqualified name follows normal default-resolver behavior.
|
||||
|
||||
### Examples
|
||||
|
||||
=== "Split DNS only"
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "local",
|
||||
"tag": "local"
|
||||
},
|
||||
{
|
||||
"type": "openconnect",
|
||||
"tag": "oc",
|
||||
"endpoint": "oc-client"
|
||||
}
|
||||
],
|
||||
"rules": [
|
||||
{
|
||||
"preferred_by": "oc",
|
||||
"action": "route",
|
||||
"server": "oc"
|
||||
}
|
||||
],
|
||||
"final": "local"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
=== "Accept pushed default resolvers"
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "openconnect",
|
||||
"endpoint": "oc-client",
|
||||
"accept_default_resolvers": true,
|
||||
"accept_search_domain": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,97 @@
|
||||
---
|
||||
icon: material/new-box
|
||||
---
|
||||
|
||||
!!! question "自 sing-box 1.14.0 起"
|
||||
|
||||
# OpenConnect
|
||||
|
||||
### 结构
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "openconnect",
|
||||
"tag": "",
|
||||
|
||||
"endpoint": "oc-client",
|
||||
"accept_default_resolvers": false,
|
||||
"accept_search_domain": false
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 字段
|
||||
|
||||
#### endpoint
|
||||
|
||||
==必填==
|
||||
|
||||
[OpenConnect 端点](/zh/configuration/endpoint/openconnect) 的标签。
|
||||
|
||||
DNS 查询会通过 OpenConnect 端点发送到 VPN 服务器推送的解析器。推送的分流 DNS 规则使用各自的专用解析器，推送的分流 DNS 和搜索域后缀则使用通用推送解析器。匹配时优先使用最具体的后缀。
|
||||
|
||||
推送的 DNS 设置不会安装到操作系统中。
|
||||
|
||||
#### accept_default_resolvers
|
||||
|
||||
接受 VPN 服务器推送的通用解析器，用于未匹配的查询。
|
||||
|
||||
启用时，仅当服务器要求所有 DNS 通过隧道，或未提供分流 DNS 规则及后缀时，通用解析器才会作为默认解析器。否则，未匹配的查询将返回 `NXDOMAIN`。
|
||||
|
||||
#### accept_search_domain
|
||||
|
||||
启用且存在推送的搜索域时，单标签查询（例如 `intranet`）会依次附加各个搜索域进行重试，直到其中一个解析成功。
|
||||
|
||||
如果所有搜索域扩展均返回 `NXDOMAIN`，原始未限定名称将按普通默认解析器行为处理。
|
||||
|
||||
### 示例
|
||||
|
||||
=== "仅分流 DNS"
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "local",
|
||||
"tag": "local"
|
||||
},
|
||||
{
|
||||
"type": "openconnect",
|
||||
"tag": "oc",
|
||||
"endpoint": "oc-client"
|
||||
}
|
||||
],
|
||||
"rules": [
|
||||
{
|
||||
"preferred_by": "oc",
|
||||
"action": "route",
|
||||
"server": "oc"
|
||||
}
|
||||
],
|
||||
"final": "local"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
=== "接受推送的默认解析器"
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "openconnect",
|
||||
"endpoint": "oc-client",
|
||||
"accept_default_resolvers": true,
|
||||
"accept_search_domain": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,82 @@
|
||||
---
|
||||
icon: material/new-box
|
||||
---
|
||||
|
||||
!!! question "Since sing-box 1.14.0"
|
||||
|
||||
# OpenVPN
|
||||
|
||||
### Structure
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "openvpn",
|
||||
"tag": "",
|
||||
|
||||
"endpoint": "ovpn-client",
|
||||
"accept_default_resolvers": false,
|
||||
"accept_search_domain": false
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Fields
|
||||
|
||||
#### endpoint
|
||||
|
||||
==Required==
|
||||
|
||||
The tag of the [OpenVPN Client Endpoint](/configuration/endpoint/openvpn-client).
|
||||
|
||||
DNS queries are sent through the endpoint to resolvers pushed by the OpenVPN server. Modern OpenVPN `dns server` options support plain DNS, DNS over TLS, DNS over HTTPS, custom ports, SNI, and `resolve-domains`. Only the server group with the lowest priority number is active. Legacy `dhcp-option DNS`/`DNS6` and `DOMAIN-ROUTE` are used when no modern server group is present.
|
||||
|
||||
A modern server group overrides legacy DHCP DNS resolver and domain options. A standalone modern `dns search-domains` option does not remove legacy resolvers. Required DNSSEC validation (`dnssec yes`) is rejected because this transport does not provide DNSSEC validation.
|
||||
|
||||
Pushed DNS settings are not installed into the operating system.
|
||||
|
||||
#### accept_default_resolvers
|
||||
|
||||
Use pushed resolvers for queries that do not match a pushed `resolve-domains`, `DOMAIN-ROUTE`, or search-domain suffix.
|
||||
|
||||
When disabled, unmatched queries return `NXDOMAIN`.
|
||||
|
||||
#### accept_search_domain
|
||||
|
||||
When enabled and pushed search domains are available, single-label queries (for example, `intranet`) are retried with each search domain until one resolves.
|
||||
|
||||
If no search domain is available, the original single-label query follows normal default-resolver behavior.
|
||||
|
||||
### Example
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "local",
|
||||
"tag": "local"
|
||||
},
|
||||
{
|
||||
"type": "openvpn",
|
||||
"tag": "ovpn-dns",
|
||||
"endpoint": "ovpn-client",
|
||||
"accept_default_resolvers": true,
|
||||
"accept_search_domain": true
|
||||
}
|
||||
],
|
||||
"rules": [
|
||||
{
|
||||
"preferred_by": "ovpn-dns",
|
||||
"action": "route",
|
||||
"server": "ovpn-dns"
|
||||
}
|
||||
],
|
||||
"final": "local"
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,82 @@
|
||||
---
|
||||
icon: material/new-box
|
||||
---
|
||||
|
||||
!!! question "自 sing-box 1.14.0 起"
|
||||
|
||||
# OpenVPN
|
||||
|
||||
### 结构
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "openvpn",
|
||||
"tag": "",
|
||||
|
||||
"endpoint": "ovpn-client",
|
||||
"accept_default_resolvers": false,
|
||||
"accept_search_domain": false
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### 字段
|
||||
|
||||
#### endpoint
|
||||
|
||||
==必填==
|
||||
|
||||
[OpenVPN 客户端端点](/zh/configuration/endpoint/openvpn-client) 的标签。
|
||||
|
||||
DNS 查询会通过该端点发送到 OpenVPN 服务器推送的解析器。现代 OpenVPN `dns server` 选项支持普通 DNS、DNS over TLS、DNS over HTTPS、自定义端口、SNI 和 `resolve-domains`。只有优先级数字最低的服务器组会生效。没有现代服务器组时，使用传统的 `dhcp-option DNS`/`DNS6` 和 `DOMAIN-ROUTE`。
|
||||
|
||||
现代服务器组会覆盖传统 DHCP DNS 解析器及相关域选项。只有现代 `dns search-domains` 而没有现代服务器组时，不会移除传统解析器。由于此传输不提供 DNSSEC 验证，需要强制验证的 `dnssec yes` 会被拒绝。
|
||||
|
||||
推送的 DNS 设置不会安装到操作系统中。
|
||||
|
||||
#### accept_default_resolvers
|
||||
|
||||
对未匹配推送的 `resolve-domains`、`DOMAIN-ROUTE` 或搜索域后缀的查询使用推送解析器。
|
||||
|
||||
禁用时，未匹配查询返回 `NXDOMAIN`。
|
||||
|
||||
#### accept_search_domain
|
||||
|
||||
启用且存在推送的搜索域时，单标签查询（例如 `intranet`）会依次附加各个搜索域重试，直到其中一个解析成功。
|
||||
|
||||
不存在搜索域时，原始单标签查询按普通默认解析器规则处理。
|
||||
|
||||
### 示例
|
||||
|
||||
```json
|
||||
{
|
||||
"dns": {
|
||||
"servers": [
|
||||
{
|
||||
"type": "local",
|
||||
"tag": "local"
|
||||
},
|
||||
{
|
||||
"type": "openvpn",
|
||||
"tag": "ovpn-dns",
|
||||
"endpoint": "ovpn-client",
|
||||
"accept_default_resolvers": true,
|
||||
"accept_search_domain": true
|
||||
}
|
||||
],
|
||||
"rules": [
|
||||
{
|
||||
"preferred_by": "ovpn-dns",
|
||||
"action": "route",
|
||||
"server": "ovpn-dns"
|
||||
}
|
||||
],
|
||||
"final": "local"
|
||||
}
|
||||
}
|
||||
```
|
||||
Reference in New Issue
Block a user