id: 1395ac10effa49d58c4ae288eeed8a5f
parent_id: 
item_type: 1
item_id: 115965b1f15e4393842f2286752f67ec
item_updated_time: 1764345477825
title_diff: "[{\"diffs\":[[1,\"Shadowsocks + GfwList 实现 OpenWRT 路由器自动翻墙\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":40}]"
body_diff: "[{\"diffs\":[[1,\"<html>\\\r\\\n<head>\\\r\\\n  <title>Shadowsocks + GfwList 实现 OpenWRT 路由器自动翻墙</title>\\\r\\\n  <basefont face=\\\"微软雅黑\\\" size=\\\"2\\\" />\\\r\\\n  <meta http-equiv=\\\"Content-Type\\\" content=\\\"text/html;charset=utf-8\\\" />\\\r\\\n  <meta name=\\\"exporter-version\\\" content=\\\"YXBJ Windows/608924 (zh-CN, DDL); Windows/10.0.0 (Win64); EDAMVersion=V2;\\\"/>\\\r\\\n  <meta name=\\\"application-data:2525275\\\" content=\\\"6692893/s30/7c32b552-7919-4a9f-bbe0-b7217f20030c/app.yinxiang.com\\\"/>\\\r\\\n  <style>\\\r\\\n\\tbody, td {\\\r\\\n\\t  font-family: 微软雅黑;\\\r\\\n\\t  font-size: 12pt;\\\r\\\n\\t}\\\r\\\n  </style>\\\r\\\n</head>\\\r\\\n<body>\\\r\\\n<a name=\\\"10279\\\"></a>\\\r\\\n<h1>Shadowsocks + GfwList 实现 OpenWRT 路由器自动翻墙</h1>\\\r\\\n\\\r\\\n<div><span><div style=\\\"-evernote-webclip:true\\\"><br/><div><div><div><div><h1> Shadowsocks + GfwList 实现 OpenWRT 路由器自动翻墙 </h1><div><div></div></div></div>\\\n\\\n  \\t\\t\\\n  \\t\\t\\\n  \\t\\t\\t\\\n\\\n\\t\\t\\t\\t\\\n\\t\\t\\t\\t\\\n  \\t\\t\\t<div>\\\n    \\t\\t\\t<p>本站发布的三种 shadowsocks 在 openwrt 上的自动翻墙方案：</p>\\\n<blockquote><p><a href=\\\"https://cokebar.info/archives/664\\\" target=\\\"_blank\\\" title=\\\"shadowsocks + chnroute 实现 OpenWRT 路由器自动翻墙\\\"><em> 1、Shadowsocks + ChnRoute 实现 OpenWRT / LEDE 路由器自动翻墙</em></a><br/>\\\n<em><del><a href=\\\"https://cokebar.info/archives/948\\\" target=\\\"_blank\\\" title=\\\"shadowsocks + redsocks 实现 OpenWRT 路由器自动翻墙\\\"> 2、Shadowsocks + Redsocks 实现 OpenWRT 路由器自动翻墙</a></del> (停止更新)</em><br/>\\\n<strong><em> 3、Shadowsocks + GfwList 实现 OpenWRT / LEDE 路由器自动翻墙</em></strong></p></blockquote>\\\n<p>本方案依靠GFWList，List中的域名站点走代理，不在List中的域名不走代理，根据域名判断。然而其实本质上依然是根据IP判断是否代理IP走代理，dnsmasq-full可以将解析域名得到的IP加到一个ipset中，利用这个ipset来判断走不走代理。实际是完成了gfwlist（域名列表）到dnsmasq的ipset规则再到IP地址的转换。同样，本方案依然可以搭配ChinaDNS搭配使用，也可以使用ss-tunnel，或者是自己的DNS服务器。</p>\\\n<p>本方案的优点明确，只有被墙的站点才走代理，但是gfwlist并不能100%涵盖被墙站点，而且有些国外站点直连速度远不如走代理，特别是你代理服务器速度较快，希望通过代理加速国外访问时，此方案就不是那么好用了。请酌情选择你所使用的方案。</p>\\\n\\\n<h5>一、安装</h5>\\\n<hr/>\\\n<p>首次安装的话，先安装必要的包，确保路由器联网，先更新软件包列表（下载有问题的请手动到openwrt.org下载所有需要的包并上传到路由器上使用opkg install XXX.ipk命令安装）：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>opkg update</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n<span style=\\\"x-evernote:highlighted;background-color:#F6EE96;\\\">shadowsocks有openssl（文件名是shadowsocks-libev-X.XX.ipk）和polarssl（文件名是shadowsocks-libev-polarssl-X.XX.ipk）两个版本选择，ROM空间吃紧的就选择后者吧。</span></p>\\\n<p>下载链接如下，请根据自己CPU型号和系统选取相应版本：</p>\\\n<p>shadowsocks-libev: <a href=\\\"https://dl.bintray.com/aa65535/opkg/shadowsocks-libev/\\\" target=\\\"_blank\\\"><span style=\\\"x-evernote:highlighted;background-color:#F6EE96;\\\">https://dl.bintray.com/aa65535/opkg/shadowsocks-libev/</span></a></p>\\\n<p>（注：作者放出预编译包的地址可能变动，如果以上地址找不到，请移步aa65535的github页面，找到对应的repo查看最新的地址： <span style=\\\"x-evernote:highlighted;background-color:#F6EE96;\\\"></span><a href=\\\"https://github.com/aa65535\\\" target=\\\"_blank\\\"><span style=\\\"x-evernote:highlighted;background-color:#F6EE96;\\\">https://github.com/aa65535</span></a>）</p>\\\n<p>先安装必要的包，如果要用openssl的shadowsocks，那么：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>opkg install iptables-mod-nat-extra ipset libopenssl</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n如果要用mbedtls版本的shadowsocks：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>opkg install iptables-mod-nat-extra ipset libmbedtls</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n期间可能遇到如下错误提示：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div><div>3</div><div>4</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>kmod:failed toinsert/lib/modules/3.10.44/ip_set.ko</div><div>kmod:failed toinsert/lib/modules/3.10.44/ip_set_bitmap_ip.ko</div><div>kmod:failed toinsert/lib/modules/3.10.44/ip_set_bitmap_ipmac.ko</div><div>...</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n没关系这是因为安装的包需要重启系统，等做完剩下的步骤最后再重启。</p>\\\n<p>然后卸载dnsmasq并安装dnsmasq-full以及剩下的包</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div><div>3</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>opkg remove dnsmasq&amp;&amp;opkg install dnsmasq-full</div><div>cd/tmp</div><div>opkg install shadowsocks-libev_x.x.x-x_ar71xx.ipk</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><h5>二、配置</h5>\\\n<hr/>\\\n<p><strong>1、配置</strong>\\\n\\\n\\\n\\t\\t\\t/etc/shadowsocks.json <strong>，格式如下：</strong></p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div><div>3</div><div>4</div><div>5</div><div>6</div><div>7</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>{</div><div>&quot;server&quot;:&quot;X.X.X.X&quot;,</div><div>&quot;server_port&quot;:&quot;443&quot;,</div><div>&quot;password&quot;:&quot;password&quot;,</div><div>&quot;local_port&quot;:&quot;1080&quot;,</div><div>&quot;method&quot;:&quot;rc4-md5&quot;</div><div>}</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n新建文件：\\\n\\\n\\\n\\t\\t\\t/etc/init.d/shadowsocks ：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div><div>3</div><div>4</div><div>5</div><div>6</div><div>7</div><div>8</div><div>9</div><div>10</div><div>11</div><div>12</div><div>13</div><div>14</div><div>15</div><div>16</div><div>17</div><div>18</div><div>19</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>#!/bin/sh /etc/rc.common</div><div>START=95</div><div>SERVICE_USE_PID=1</div><div>SERVICE_WRITE_PID=1</div><div>SERVICE_DAEMONIZE=1</div><div>SERVICE_PID_FILE=/var/run/shadowsocks.pid</div><div>CONFIG=/etc/shadowsocks.json</div><div>start(){</div><div># Proxy Mode</div><div>service_start/usr/bin/ss-redir-c$CONFIG-b0.0.0.0-f$SERVICE_PID_FILE</div><div>}</div><div>stop(){</div><div># Proxy Mode</div><div>service_stop/usr/bin/ss-redir</div><div>}</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n修改文件权限：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>chmod+x/etc/init.d/shadowsocks</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n然后启动shadowsocks，并设置开机运行：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>/etc/init.d/shadowsocks enable</div><div>/etc/init.d/shadowsocks start</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n<strong>2、配置dnsmasq和ipset</strong></p>\\\n<p>2.1. 将如下规则加入自定义防火墙规则中（最后的1080是shadowsocks的本地端口 酌情修改）：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>ipset-Ngfwlist iphash</div><div>iptables-tnat-APREROUTING-ptcp-mset--match-set gfwlist dst-jREDIRECT--to-port1080</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>2.2. 修改dnsmasq配置：</p>\\\n<p>OPENWRT:</p>\\\n<p>修改\\\n\\\n\\\n\\t\\t\\t/etc/dnsmasq.conf，在最后加入 \\\n\\\n\\\n\\t\\t\\tconf-dir=/etc/dnsmasq.d\\\n</p><p>LEDE:</p>\\\n<p>执行：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>uci getdhcp.@dnsmasq[0].confdir</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n如果返回值为\\\n\\\n\\\n\\t\\t\\tuci:Entry notfound 或者其他，则执行：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>uci add_list dhcp.@dnsmasq[0].confdir=/etc/dnsmasq.d</div><div>uci commit dhcp</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n2.3 添加gfwlist和China-List配置文件：</p>\\\n<p>新建并进入目录 \\\n\\\n\\\n\\t\\t\\t/etc/dnsmasq.d ，下载 <a href=\\\"https://gist.github.com/cokebar/7e29b65f26b112ded03fe3ead4fc535d/raw/774bcb24786824229c979c91fb90f426891b0747/dnsmasq_gfwlist_ipset.conf\\\" target=\\\"_blank\\\">dnsmasq_gfwlist_ipset.conf</a> 后放入该目录。</p>\\\n<p>自动生成dnsmasq_list.conf 的脚本本人放在这里：<a href=\\\"https://github.com/cokebar/gfwlist2dnsmasq\\\" target=\\\"_blank\\\" title=\\\"gfwlist2dnsmasq\\\">https://github.com/cokebar/gfwlist2dnsmasq</a></p>\\\n<p>你可能需要自行修改这个文件，格式如下：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div><div>3</div><div>4</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>#使用不受污染干扰的DNS解析该域名 可以将此IP改为自己使用的DNS服务器</div><div>server=/google.com/127.0.0.1#5353</div><div>#将解析出来的IP保存到名为gfwlist的ipset表中</div><div>ipset=/google.com/gfwlist</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n下面详细说一下DNS的方案，有三种：</p>\\\n<p><strong>方案一：</strong></p>\\\n<p>在代理服务器上搭建DNS服务来解析国外网站，可用<a href=\\\"https://cokebar.info/archives/699\\\" target=\\\"_blank\\\" title=\\\"利用dnsmasq搭建DNS服务器超简易教程\\\">dnsmasq</a>或者<a href=\\\"https://cokebar.info/archives/720\\\" target=\\\"_blank\\\" title=\\\"pdnsd搭建DNS服务器简易教程\\\">pdnsd</a>，监听非53端口。</p>\\\n<p>比如说DNS服务器IP是：3.4.5.6，端口是5050，那么使用替换功能将\\\n\\\n\\\n\\t\\t\\t/etc/dnsmasq.d/dnsmasq_list.conf 里面的\\\n\\\n\\\n\\t\\t\\t127.0.0.1#5353 全部替换成\\\n\\\n\\\n\\t\\t\\t3.4.5.6#5050 即可。</p>\\\n<p>最后重启路由器即可。</p>\\\n<p><strong>方案二：</strong></p>\\\n<p>使用ss-tunnel转发UDP的DNS请求，修改\\\n\\\n\\\n\\t\\t\\t/etc/init.d/shadowsocks 文件，如需修改上游DNS，请修改\\\n\\\n\\\n\\t\\t\\tDNS=8.8.8.8:53 字段，本地端口修改\\\n\\\n\\\n\\t\\t\\tTUNNEL_PORT=5353 ：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div><div>3</div><div>4</div><div>5</div><div>6</div><div>7</div><div>8</div><div>9</div><div>10</div><div>11</div><div>12</div><div>13</div><div>14</div><div>15</div><div>16</div><div>17</div><div>18</div><div>19</div><div>20</div><div>21</div><div>22</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>#!/bin/sh /etc/rc.common</div><div>START=95</div><div>SERVICE_DAEMONIZE=1</div><div>CONFIG=/etc/shadowsocks.json</div><div>DNS=8.8.8.8:53</div><div>TUNNEL_PORT=5353</div><div>start(){</div><div># Proxy Mode</div><div>service_start/usr/bin/ss-redir-c$CONFIG-b0.0.0.0</div><div># Tunnel</div><div>service_start/usr/bin/ss-tunnel-c$CONFIG-b0.0.0.0-u-l$TUNNEL_PORT-L$DNS</div><div>}</div><div>stop(){</div><div># Proxy Mode</div><div>service_stop/usr/bin/ss-redir</div><div># Tunnel</div><div>service_stop/usr/bin/ss-tunnel</div><div>}</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n最后重启路由器即可。</p>\\\n<p><strong>方案三：</strong></p>\\\n<p>此方案使用ChinaDNS来做防DNS污染，先下载并安装相应的包（请根据CPU型号选择）：</p>\\\n<p>OPENWRT:</p>\\\n<p>chinadns-openwrt: <a href=\\\"http://openwrt-dist.sourceforge.net/packages/OpenWrt/base/\\\" target=\\\"_blank\\\">http://openwrt-dist.sourceforge.net/packages/OpenWrt/base/</a></p>\\\n<p>luci-app-chinadns: <a href=\\\"http://openwrt-dist.sourceforge.net/packages/OpenWrt/luci/\\\" target=\\\"_blank\\\">http://openwrt-dist.sourceforge.net/packages/OpenWrt/luci/</a></p>\\\n<p>LEDE:</p>\\\n<p>chinadns-openwrt: <a href=\\\"http://openwrt-dist.sourceforge.net/packages/LEDE/base/\\\" target=\\\"_blank\\\">http://openwrt-dist.sourceforge.net/packages/LEDE/base/</a></p>\\\n<p>luci-app-chinadns: <a href=\\\"http://openwrt-dist.sourceforge.net/packages/LEDE/luci/\\\" target=\\\"_blank\\\">http://openwrt-dist.sourceforge.net/packages/LEDE/luci/</a></p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div><div>2</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>opkg install ChinaDNS_x.x.x-x_ar71xx.ipk</div><div>opkg install luci-app-chinadns_x.x.x-x_all.ipk</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n安装完成后，进到luci，指向服务，点击ChinaDNS，填入上游服务器地址，可以保留默认的114.114.114.114,8.8.4.4，确保本地端口是5353（也就是和dnsmasq_list.conf里面的127.0.0.1#5353保持一致），勾选“启用压缩指针”，然后保存并应用。</p>\\\n<p><a href=\\\"https://cokebar.info/wp-content/uploads/2014/11/method31.png\\\" target=\\\"_blank\\\"></a></p><div><a href=\\\"https://cokebar.info/wp-content/uploads/2014/11/method31.png\\\" target=\\\"_blank\\\"><img src=\\\":/71cfbf18dbfa4056aaa89085735b653c\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" alt=\\\"method3\\\" height=\\\"305\\\" width=\\\"474\\\"/></a></div><p></p>\\\n<p>或者不勾选“启用压缩指针”，但要酌情填写延迟时间，默认0.3秒：</p>\\\n<p><a href=\\\"https://cokebar.info/wp-content/uploads/2014/11/method3.png\\\" target=\\\"_blank\\\"></a></p><div><a href=\\\"https://cokebar.info/wp-content/uploads/2014/11/method3.png\\\" target=\\\"_blank\\\"><img src=\\\":/0cf6c7b5d7014fa4aecfdf88392110a7\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" alt=\\\"method3\\\" height=\\\"386\\\" width=\\\"442\\\"/></a></div><p></p>\\\n<p>最后重启路由器即可。对于特殊情况，如长宽用户无法使用方案一和方案二时（长宽用户不支持方案三），可以考虑换成TCP方式，参照《<a href=\\\"https://cokebar.info/archives/1053\\\" target=\\\"_blank\\\" title=\\\"TCP 方式查询解决 DNS 污染问题\\\">TCP 方式查询解决 DNS 污染问题</a>》</p>\\\n<p>PS1：发现有不少人之前用过chnroute方案，然后改成gfwlist方案，此时记得把忽略解析文件的勾选去掉并把原来的设置填回去：</p>\\\n<p><a href=\\\"https://cokebar.info/wp-content/uploads/2015/01/problem1.png\\\" target=\\\"_blank\\\"></a></p><div><a href=\\\"https://cokebar.info/wp-content/uploads/2015/01/problem1.png\\\" target=\\\"_blank\\\"><img src=\\\":/9f71b568aea244d69a8e11824c1851bc\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" alt=\\\"problem1\\\" height=\\\"111\\\" width=\\\"360\\\"/></a></div><p></p>\\\n<p>PS2：默认只有连接路由的设备翻了墙，为了让路由器自身也能够翻墙（如使用路由器获取gfwlist更新dnsmasq_list.conf时候，gfwlist的URL是被墙站点，此时需要路由器自身也要翻墙）做出如下配置，先在自定义防火墙规则中额外加一条：</p>\\\n\\\n\\\n\\t\\t<div>\\\n\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<table>\\\n\\t\\t\\t\\t\\t<tbody><tr>\\\n\\t\\t\\t\\t<td>\\\n\\t\\t\\t\\t\\t<div><div>1</div></div>\\\n\\t\\t\\t\\t</td>\\\n\\t\\t\\t\\t\\t\\t<td><div><div>iptables-tnat-AOUTPUT-ptcp-mset--match-set gfwlist dst-jREDIRECT--to-port1080</div></div></td>\\\n\\t\\t\\t\\t\\t</tr>\\\n\\t\\t\\t\\t</tbody></table>\\\n\\t\\t\\t</div>\\\n\\t\\t</div><p>\\\n然后再WAN口配置中如图所示，将DNS手动指定为127.0.0.1：</p>\\\n<p><a href=\\\"https://cokebar.info/wp-content/uploads/2015/01/ss222.png\\\" target=\\\"_blank\\\"></a></p><div><a href=\\\"https://cokebar.info/wp-content/uploads/2015/01/ss222.png\\\" target=\\\"_blank\\\"><img src=\\\":/b1fb3e71bad7408d87df42031734dc32\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" alt=\\\"ss222\\\" height=\\\"389\\\" width=\\\"471\\\"/></a></div><p></p>\\\n<p>最后在DHCP/DNS设置中将你的ISP的DNS填入（或者使用114DNS等公共DNS）</p>\\\n<p><a href=\\\"https://cokebar.info/wp-content/uploads/2015/01/dnsmasq_localdns.png\\\" target=\\\"_blank\\\"><img src=\\\":/492507512895448da93d84b24b82b9a0\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" alt=\\\"dnsmasq_localdns\\\" height=\\\"63\\\" width=\\\"517\\\"/></a></p>\\\n<hr/>\\\n<p>参考文章：<a href=\\\"https://kyonli.com/p/18\\\" target=\\\"_blank\\\">https://kyonli.com/p/18</a></p>\\\n\\t\\t\\t\\t\\t\\t\\t\\\n\\t\\t\\t\\t\\t\\t\\t  \\t\\t\\t</div>\\\n\\\n  \\t\\t\\t\\t\\t\\t\\\n\\t\\t\\\n<div>\\\n\\\n\\t\\\n\\t\\t\\t<h2>\\\n\\t\\t\\t387 条评论\\t\\t</h2>\\\n\\\n\\t\\t<ol>\\\n\\t\\t\\t\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/f4c1afbc8716423fad5f0055ba088b06\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"http://skywing.me/\\\" target=\\\"_blank\\\">skywing</a> </cite>\\t\\t\\t\\t<span>2016-11-03 于 23:19</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2874#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>之前用chnroute，现在改gfwlist，按步骤配置一切正常，用第二种方案防DNS混淆，最后无法翻墙<br/>\\\ndig @192.168.1.1 -p 5353 twitter.com 返回正常的IP，但无法ping通，请问是什么地方出问题了？</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/c24f2a9884d24f8abdae237992b957a6\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>theosoft </cite>\\t\\t\\t\\t<span>2016-12-02 于 17:38</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2882#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>我用了方案3，http的请求都能自动分流了，但是像google这种会强制重定向到https的请求都打不开。手动设置代理到路由的1080端口就没问题。prerouting和outing都设了，想问问是哪里出错了。</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/3ac7b736ca40496f969003ec5858170d\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2016-12-09 于 23:09</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2895#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>检查浏览器代理设置，请使用直接连接不要使用任何代理。DNS使用路由器IP。理论上能不能连和HTTP还是HTTPS没关系。</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t</li>\\\n</ol>\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/5c018fcfc60046c987c48f21a2ef146a\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>edward </cite>\\t\\t\\t\\t<span>2017-01-09 于 10:51</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2930#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>为什么安装完shadowsocks-libev openssl之后，没有/etc/init.d/shadowsocks这个配置文件啊…</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/e9fd3ae4fe784fc384af077547b6b432\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2017-01-09 于 11:07</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2931#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>aa65535新版本去掉了init.d脚本，只保留了二进制可执行文件。新建那个文件就行了。另：这篇文章提到的下载链接已经老了，目前已经更新新目录</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t\\\n</li>\\\n</ol>\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/337136f7572c429e8680257fa15a0f43\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>dover </cite>\\t\\t\\t\\t<span>2017-01-25 于 18:34</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2951#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>我是照到方案二来安装的，昨天tumblr的图片都能正常浏览，今天突然图片都打不开了，想问下博主会是什么情况呢？<br/>\\\n访问其它网站是正常的</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/901ecb20ca724230b8e9c77c638563b1\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>dover </cite>\\t\\t\\t\\t<span>2017-01-26 于 19:38</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2953#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>请问怎么开OTA？</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/1d8bbb7da9c548a692d5faa88f80c756\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2017-01-27 于 21:41</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2954#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>config.json中添加 “auth”:true</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t\\\n</li>\\\n</ol>\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/7eef006f84784df7848598213e6fccce\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>koklib </cite>\\t\\t\\t\\t<span>2017-01-30 于 05:26</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2959#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>求教：dns选择了方案三，但启用了chinadns以后始终是”未运行“状态，netstat查看过没有端口冲突，更换过阿里/google/114等上游服务器都启动不起来，该如何排查原因？</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/f80d8da8816443bf8d138edd2ba2fa7b\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2017-02-03 于 19:17</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2996#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>手动命令行运行chinadns +参数启动，看是否成功，报什么错，用法：<br/>\\\nusage: chinadns [-h] [-l IPLIST_FILE] [-b BIND_ADDR] [-p BIND_PORT]<br/>\\\n       [-c CHNROUTE_FILE] [-s DNS] [-v]<br/>\\\nForward DNS requests.</p>\\\n<p>-h, –help            show this help message and exit<br/>\\\n-l IPLIST_FILE        path to ip blacklist file<br/>\\\n-c CHNROUTE_FILE      path to china route file<br/>\\\n                      if not specified, CHNRoute will be turned off<br/>\\\n-d                    enable bi-directional CHNRoute filter<br/>\\\n-y                    delay time for suspects, default: 0.3<br/>\\\n-b BIND_ADDR          address that listens, default: 127.0.0.1<br/>\\\n-p BIND_PORT          port that listens, default: 53<br/>\\\n-s DNS                DNS servers to use, default:<br/>\\\n                      114.114.114.114,208.67.222.222:443,8.8.8.8<br/>\\\n-m                    Using DNS compression pointer mutation<br/>\\\n                      (backlist and delaying would be disabled)<br/>\\\n-v                    verbose logging</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t</li>\\\n</ol>\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/91547e33bdc747e9a62802048fbd8362\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>Pepsi hgr </cite>\\t\\t\\t\\t<span>2017-02-01 于 14:47</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2965#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>在 CHAOS CALMER (15.05.1, r48532) 有些变化。<br/>\\\n* dnsmasq<br/>\\\n需要在 dnsmasq.d 里面加入：<br/>\\\nconf-dir=/etc/dnsmasq.d<br/>\\\n这样不需要改动 /etc/config/dhcp</p>\\\n<p>* /etc/init.d/shadowsocks<br/>\\\n—<br/>\\\n#!/bin/sh /etc/rc.common</p>\\\n<p>START=95<br/>\\\nUSE_PROCD=1</p>\\\n<p>#SERVICE_USE_PID=1<br/>\\\n#SERVICE_WRITE_PID=1<br/>\\\n#SERVICE_DAEMONIZE=1<br/>\\\n#SERVICE_PID_FILE=/var/run/shadowsocks.pid</p>\\\n<p>CONFIG=/etc/shadowsocks.json<br/>\\\nDNS=8.8.8.8:53<br/>\\\nTUNNEL_PORT=5353</p>\\\n<p>start_service_ss_proxy() {<br/>\\\n    # Proxy Mode<br/>\\\n    procd_open_instance<br/>\\\n    procd_set_param command /usr/bin/ss-redir<br/>\\\n    procd_append_param command -c $CONFIG<br/>\\\n    procd_append_param command -b 0.0.0.0<br/>\\\n    procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}<br/>\\\n    procd_set_param file $CONFIG<br/>\\\n    procd_close_instance<br/>\\\n        #service_start /usr/bin/ss-redir -c $CONFIG -b 0.0.0.0 -f $SERVICE_PID_FILE<br/>\\\n}</p>\\\n<p>start_service_ss_udp() {<br/>\\\n    # Tunnel<br/>\\\n    procd_open_instance<br/>\\\n    procd_set_param command /usr/bin/ss-tunnel<br/>\\\n    procd_append_param command -c $CONFIG<br/>\\\n    procd_append_param command -b 0.0.0.0<br/>\\\n    procd_append_param command -u<br/>\\\n    procd_append_param command -l $TUNNEL_PORT<br/>\\\n    procd_append_param command -L $DNS<br/>\\\n    procd_set_param respawn ${respawn_threshold:-3600} ${respawn_timeout:-5} ${respawn_retry:-5}<br/>\\\n    procd_set_param file $CONFIG<br/>\\\n    procd_close_instance<br/>\\\n        #service_start /usr/bin/ss-tunnel -c $CONFIG -b 0.0.0.0 -u -l $TUNNEL_PORT -L $DNS -f $SERVICE_PID_FILE<br/>\\\n}</p>\\\n<p>reload_service()<br/>\\\n{<br/>\\\n    stop<br/>\\\n    start<br/>\\\n}</p>\\\n<p>start_service() {<br/>\\\n    start_service_ss_proxy<br/>\\\n    start_service_ss_udp<br/>\\\n}<br/>\\\n—</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/c5e632a05cde4f66b26697b3b660ca97\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2017-02-01 于 17:56</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2969#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>修改/etc/dnsmasq.conf也是可以的，但是我觉得还是尽量使用UCI比较好。<br/>\\\n然后就是没看懂你贴ss启动脚本要表达什么</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/4d9bbc227e4e42f8bdeae1a1d16c3e24\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>Pepsi hgr </cite>\\t\\t\\t\\t<span>2017-02-01 于 22:06</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2970#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>文章里面的脚本stop的时候不能结束掉ss-tunnel。我正好看了下 procd init script，在原来脚本的基础上改写了一下。贴出来给大家参考。</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/2d6565c95a544309a3b352c4b11b52df\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2017-02-02 于 02:06</span>\\t\\t\\t\\t\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>之前没注意过这个问题，回头我测试一下，不知道是不是PID FILE的问题。<br/>\\\nprocd貌似是前台运行。</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/eab0d927d0794ed981f173c189ba94b9\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>Pepsi hgr </cite>\\t\\t\\t\\t<span>2017-02-02 于 19:55</span>\\t\\t\\t\\t\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>应该是PID FILE的问题。我开始想应该可以通过调整service_start的参数指定pid文件，区分ss-redir和ss-tunnel。对这块不熟，在参考init.d的其它脚本时候，发现都在使用procd，所以直接看了下procd init script，发现这个很强大，可以自动监视服务状态，可以监视文件触发自动reload，就顺便改写了下。<br/>\\\n至于前台运行，好像没有什么坏处。</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t</li>\\\n\\t\\\n</ol>\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/9a1ac26c404e4635b68a11e2f5ec8859\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>Pepsi hgr </cite>\\t\\t\\t\\t<span>2017-02-01 于 23:29</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2971#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>在 dnsmasq-full – 2.73-1 里面按照文中的方法，使用 uci 向 /etc/config/dhcp 里面加入 ‘list confdir=/etc/dnsmasq.d’ 发现不起作用。google发现有直接修改 conf-dir 可以工作的。另外，安装的默认启动脚本 /etc/init.d/dnsmasq 设置的 ‘conf-dir=/tmp/dnsmasq.d’，所以我能想到的解决方法有2个：修改 /etc/dnsmasq.conf 覆盖默认的conf-dir，或者每次把 list config文件拷贝到 /tmp/dnsmasq.d。我采用了第一个方法。</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/9413c39426a3489e87079b3a945b4b5c\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2017-02-02 于 00:56</span>\\t\\t\\t\\t\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>看了一下Chaos calmer的init.d，确实uci 添加confdir没用，Lede是没有问题的</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t</li>\\\n</ol>\\\n</li>\\\n</ol>\\\n</li>\\\n</ol>\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/6b06de0be0c046719858c76adbfd207f\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>Pepsi hgr </cite>\\t\\t\\t\\t<span>2017-02-01 于 14:51</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2966#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>请问 ipset, iptables 的两条命令放在哪里比较合适？<br/>\\\n我是增加了一个启动脚本：<br/>\\\n/etc/init.d/gfwlist_ipset<br/>\\\n—<br/>\\\n#!/bin/sh /etc/rc.common<br/>\\\n# Copyright (C) 2006 OpenWrt.org</p>\\\n<p># Start *BEFORE* dnsmasq<br/>\\\nSTART=55</p>\\\n<p>start() {<br/>\\\n    ipset -N gfwlist iphash<br/>\\\n    iptables -t nat -A PREROUTING -p tcp -m set –match-set gfwlist dst -j REDIRECT –to-port 1080<br/>\\\n}<br/>\\\n—</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/fbfaece25e78499f97f14b0728282b2b\\\" type=\\\"image/jpeg\\\" data-filename=\\\"Image.jpg\\\" alt=\\\"cokebar\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite><a href=\\\"https://cokebar.info/\\\" target=\\\"_blank\\\">cokebar</a>  文章作者</cite>\\t\\t\\t\\t<span>2017-02-01 于 17:52</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2968#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>Luci防火墙规则中有一个自定义规则</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t<ol>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/a0ebb540e8a54fd8bf54cd20fe8c2bb5\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>Pepsi hgr </cite>\\t\\t\\t\\t<span>2017-02-01 于 23:33</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2972#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>试了一下，在Luci防火墙规则的自定义规则里面加入这2条命令，发现不起作用。不知道是不是和启动顺序有关。我的版本是 CHAOS CALMER (15.05.1, r48532) 。</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t\\\n</li>\\\n</ol>\\\n</li>\\\n\\t\\\n</ol>\\\n</li>\\\n\\t<li>\\\n\\t\\t<div>\\\n\\t\\t\\t<div><div>\\\n\\t\\t\\t\\t<img src=\\\":/9ec7759ef81e4fc8a309bb90d01b015f\\\" type=\\\"image/png\\\" data-filename=\\\"Image.png\\\" height=\\\"44\\\" width=\\\"44\\\"/><cite>Pepsi hgr </cite>\\t\\t\\t\\t<span>2017-02-01 于 14:55</span>\\t\\t\\t\\t<a href=\\\"https://cokebar.info/archives/962?replytocom=2967#respond\\\" target=\\\"_blank\\\">回复</a>\\t\\t\\t\\t\\\n\\t\\t\\t</div>\\\n\\\n\\\n\\t\\t\\t\\\n\\\n\\t\\t\\t\\\n\\t\\t\\t<div>\\\n\\t\\t\\t\\t<p>前面有个笔误。<br/>\\\n* dnsmasq<br/>\\\n需要在 /etc/dnsmasq.conf 里面加入：<br/>\\\nconf-dir=/etc/dnsmasq.d<br/>\\\n这样不需要改动 /etc/config/dhcp</p>\\\n\\t\\t\\t\\t\\t\\t\\t</div>\\\n\\\n\\t\\t</div></div>\\\n\\t</li>\\\n\\t\\t</ol>\\\n\\\n\\t\\t\\\n\\t\\\n\\t\\t<div>\\\n\\t\\t<h3>发表评论 <small><a href=\\\"https://cokebar.info/archives/962#respond\\\" target=\\\"_blank\\\">取消回复</a></small></h3>\\t\\t\\t\\\n\\t\\t\\t\\t<p>电子邮件地址不会被公开。 必填项已用*标注</p><p><span>评论</span> </p><p><span>姓名 *</span> </p>\\\n<p><span>电子邮件 *</span> </p>\\\n<p><span>站点</span> </p>\\\n<p>请输入验证码 *\\\n\\t\\t\\tTime limit is exhausted. Please reload CAPTCHA.\\\n\\t\\t\\t\\t<span>\\\n\\t\\t\\t\\t\\t五\\\n\\t\\t\\t\\t\\t × \\\n\\t\\t\\t\\t\\t7\\\n\\t\\t\\t\\t\\t = \\\n\\t\\t\\t\\t\\t\\\n\\t\\t\\t\\t\\t\\\n\\t\\t\\t\\t\\t\\\n\\t\\t\\t\\t\\t\\\n\\t\\t\\t\\t</span></p><p><span> 有新评论,请电子邮件通知我。你也不需要留评论就可以<a href=\\\"https://cokebar.info/comment-subscriptions/?srp=962&amp;srk=f4cb36d5d4b3d3411d7b455e358f0fce&amp;sra=s&amp;srsrc=f\\\" target=\\\"_blank\\\">订阅</a>。</span></p></div>\\\n\\t\\\n</div>\\\n\\t\\t</div></div></div><br/></div></span>\\\n</div></body></html>\\u0000\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":27665}]"
metadata_diff: {"new":{"id":"115965b1f15e4393842f2286752f67ec","parent_id":"061de1401cfc4cfaadf6e74e015970e9","latitude":"0.00000000","longitude":"0.00000000","altitude":"0.0000","author":"","source_url":"","is_todo":0,"todo_due":0,"todo_completed":0,"source":"joplin-desktop","source_application":"net.cozic.joplin-desktop","application_data":"","order":1764345762740,"markup_language":2,"is_shared":0,"share_id":"","conflict_original_id":"","master_key_id":"","user_data":"","deleted_time":0},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2025-11-28T16:12:58.272Z
created_time: 2025-11-28T16:12:58.272Z
type_: 13