Great job! And thanks for sharing!
I didn't understand what I was able to get around that could be reported to the sing-box developer. I think that the sing-box developer is not interested in such things in principle. He has created and is developing an excellent application for many platforms. I, with the help of chatGPT, just wrote a script that allows us to use its huge potential on our routers with Merlin firmware. There are only a couple of minor flaws in this script that perhaps real programmers can fix.
wget -O /jffs/scripts/sb-script-install https://raw.githubusercontent.com/Dr4tez/sing-box4asus/main/sb-script-install && chmod 775 /jffs/scripts/sb-script-install && /jffs/scripts/sb-script-installiptables -I FORWARD -i sbtun -j ACCEPT
iptables -I FORWARD -o sbtun -j ACCEPT
iptables -I INPUT -i sbtun -j ACCEPT
iptables -I OUTPUT -o sbtun -j ACCEPTsleep 30
/mnt/entware/entware/sing-box/sing-box-script-ru startwget -O /jffs/scripts/sb-script-install https://raw.githubusercontent.com/Dr4tez/sing-box4asus/main/sb-script-install && chmod 775 /jffs/scripts/sb-script-install && /jffs/scripts/sb-script-installwget -O /jffs/scripts/sbs https://raw.githubusercontent.com/Dr4tez/sing-box4asus/main/sbs && chmod 775 /jffs/scripts/sbs && /jffs/scripts/sbs installsbs setupsbs editsbs updatesbs removewget -O /jffs/scripts/sbs https://raw.githubusercontent.com/Dr4tez/sing-box4asus/main/sbs && chmod 775 /jffs/scripts/sbs && /jffs/scripts/sbs installsbs setupUsually router itself uses "exclusive" mode, which means dns redirection via firewall rules. It could look something like this:
#create new chain and flush it
iptables -t nat -N SINGBOXDNS
iptables -t nat -F SINGBOXDNS 2>/dev/null
#create record for dns to jump to this chain:
iptables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -j SINGBOXDNS
iptables -t nat -I PREROUTING -p udp -m tcp --dport 53 -j SINGBOXDNS
#setup source ip rules for redirect dns:
iptables -t nat -A SINGBOXDNS -s 192.168.50.45 -j DNAT --to-destination 8.8.8.8
iptables -t nat -A SINGBOXDNS -s 192.168.50.102 -j DNAT --to-destination 8.8.8.8You probably haven't used sing-box on other platforms where it is fully supported without any extra manipulations with the system. Here is a sample configuration file that works fully on Android, iOS, Windows and Ubuntu server. In this configuration file, there is a DNS settings section at the beginning. In it, I can set different DNS resolvers for different domains, different inbounds, different clash mods, and with different Wi-Fi SSIDs I can make different rules.
{
"log": {
"level": "error",
"timestamp": true
},
"dns": {
"servers": [
{
"tag": "dns-google",
"address": "8.8.8.8",
"strategy": "ipv4_only"
},
{
"tag": "dns-quad9",
"address": "9.9.9.9"
}
],
"rules": [
{
"outbound": "any",
"server": "dns-quad9"
},
{
"clash_mode": "Global",
"server": "dns-quad9"
},
{
"clash_mode": "Direct",
"server": "dns-google"
},
{
"rule_set": "my_domains",
"server": "dns-quad9"
},
{
"inbound": "mixed-in-global",
"server": "dns-quad9"
}
],
"independent_cache": true
},
"inbounds": [
{
"type": "tun",
"tag": "tun-in",
"interface_name": "sbtun",
"mtu": 1492,
"inet4_address": "172.19.0.1/28",
"auto_route": false,
"endpoint_independent_nat": true,
"stack": "mixed",
"sniff": true
},
{
"type": "mixed",
"tag": "mixed-in-rule",
"listen": "0.0.0.0",
"listen_port": 2080,
"sniff": true
},
{
"type": "mixed",
"tag": "mixed-in-global",
"listen": "0.0.0.0",
"listen_port": 2081,
"sniff": true
}
],
"outbounds": [
{
"type": "direct",
"tag": "direct"
},
{
"type": "selector",
"tag": "Proxy",
"outbounds": [
"1. VLESS-AEZA",
"2. WG-AEZA"
],
"interrupt_exist_connections": true
},
{
"type": "vless",
"tag": "1. VLESS-AEZA",
"server": "XX.XX.XX.XX",
"server_port": 443,
"uuid": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"flow": "xtls-rprx-vision",
"tls": {
"enabled": true,
"server_name": "discord.com",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"short_id": "XXXXXXXXX"
}
}
},
{
"type": "wireguard",
"tag": "2. WG-AEZA",
"local_address": "10.73.105.11/32",
"private_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=",
"server": "XX.XX.XX.XX",
"server_port": XXXX,
"peer_public_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=",
"pre_shared_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=",
"mtu": 1376
},
{
"type": "dns",
"tag": "dns-out"
}
],
"route": {
"rules": [
{
"protocol": "dns",
"outbound": "dns-out"
},
{
"clash_mode": "Global",
"outbound": "Proxy"
},
{
"clash_mode": "Direct",
"outbound": "direct"
},
{
"ip_cidr": "31.131.253.250",
"rule_set": "my_domains",
"outbound": "Proxy"
},
{
"inbound": "mixed-in-global",
"outbound": "Proxy"
}
],
"rule_set": [
{
"type": "remote",
"tag": "my_domains",
"format": "binary",
"url": "https://github.com/Dr4tez/my_domains/raw/main/my_domains.srs"
}
],
"auto_detect_interface": true
},
"experimental": {
"cache_file": {
"enabled": true,
"path": "/opt/root/sing-box/cache.db"
},
"clash_api": {
"external_controller": "0.0.0.0:9090",
"external_ui": "/opt/root/sing-box/ui",
"secret": "3194"
}
}
}{
"log": {
"level": "error",
"timestamp": true
},
"inbounds": [
{
"type": "tun",
"tag": "tun-in",
"interface_name": "sbtun",
"mtu": 1492,
"inet4_address": "172.19.0.1/28",
"auto_route": false,
"endpoint_independent_nat": true,
"stack": "mixed",
"sniff": true
},
{
"type": "mixed",
"tag": "mixed-in-rule",
"listen": "0.0.0.0",
"listen_port": 2080,
"sniff": true
},
{
"type": "mixed",
"tag": "mixed-in-global",
"listen": "0.0.0.0",
"listen_port": 2081,
"sniff": true
}
],
"outbounds": [
{
"type": "direct",
"tag": "direct"
},
{
"type": "selector",
"tag": "Proxy",
"outbounds": [
"1. VLESS-AEZA",
"2. WG-AEZA"
],
"interrupt_exist_connections": true
},
{
"type": "vless",
"tag": "1. VLESS-AEZA",
"server": "XX.XX.XX.XX",
"server_port": 443,
"uuid": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"flow": "xtls-rprx-vision",
"tls": {
"enabled": true,
"server_name": "discord.com",
"utls": {
"enabled": true,
"fingerprint": "chrome"
},
"reality": {
"enabled": true,
"public_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"short_id": "XXXXXXXXX"
}
}
},
{
"type": "wireguard",
"tag": "2. WG-AEZA",
"local_address": "10.73.105.11/32",
"private_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=",
"server": "XX.XX.XX.XX",
"server_port": XXXX,
"peer_public_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=",
"pre_shared_key": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=",
"mtu": 1376
},
{
"type": "dns",
"tag": "dns-out"
}
],
"route": {
"rules": [
{
"protocol": "dns",
"outbound": "dns-out"
},
{
"clash_mode": "Global",
"outbound": "Proxy"
},
{
"clash_mode": "Direct",
"outbound": "direct"
},
{
"ip_cidr": "31.131.253.250",
"rule_set": "my_domains",
"outbound": "Proxy"
},
{
"inbound": "mixed-in-global",
"outbound": "Proxy"
}
],
"rule_set": [
{
"type": "remote",
"tag": "my_domains",
"format": "binary",
"url": "https://github.com/Dr4tez/my_domains/raw/main/my_domains.srs"
}
],
"auto_detect_interface": true
},
"experimental": {
"cache_file": {
"enabled": true,
"path": "/opt/root/sing-box/cache.db"
},
"clash_api": {
"external_controller": "0.0.0.0:9090",
"external_ui": "/opt/root/sing-box/ui",
"secret": "3194"
}
}
}You are right, I haven't. Just trying to help. A router is abit different since it serves many devices and various systems are put in to prevent dnsleaks. Things any single device don't have to care about.
I'm grateful for your help. DNS director is disabled on the router. Probably something at the system level is interfering here. The question is whether it is possible to bypass this. If possible, how. Here I need the help of someone who knows the capabilities and limitations of the router firmware and, perhaps, has encountered a similar issue himself. Maybe everything is simple here, or maybe it’s impossible, I’m not strong in such matters. And ChatGPT cannot help me in this matter, I tried its suggestions. This question is too specific.
Most certainly.
You could always enable it and setup custom dns to whatever dns ip (like 8.8.8.8) interface and setup a rule for the device is using singbox. It would let the dns request be forwarded instead of executed.
All clients are assigned DNS via the router's dhcp. This is the IP address of the home Linux server with Adguard Home installed on it. For the router itself, the DNS server is the same Adguard Home. On it, I record DNS requests from each client separately, and that's how I find out that the requests go through it, and not directly to the public DNS servers specified in the sing-box configuration file. Well, I also check with dnsleaktest. Of course, if i can specify other DNS servers in the client settings, and if i specify them, then the requests go through them, and not through adguard home.
In the dns director i can only assign a specific ip address of the dns server to a specific mac address of the device. This is too thick. Well, I tried to assign the ip address of the tun interface as a dns server to certain clients, and all the same, dns requests for them are processed in Adguard Home.
As I said, there can only be one instance on the router listening to port 53 (dns). I don't know how AGH does this, it may use a different port and have dnsmasq forward to this port (like Unbound)or it may also be that AGH disables dnsmasq dns and listens to port 53 itself.
I haven't tried setting up a sing-box to accept DNS requests on a different port, but it seems possible. Can you show me the commands to create the necessary firewall rules? Redirecting requests from Adguard Home may not suit everyone, many simply do not use this tool.
It's the same, you just add the port to translate to:
#create new chain and flush it
iptables -t nat -N SINGBOXDNS
iptables -t nat -F SINGBOXDNS 2>/dev/null
#create record for dns to jump to this chain:
iptables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -j SINGBOXDNS
iptables -t nat -I PREROUTING -p udp -m udp --dport 53 -j SINGBOXDNS
#setup source ip rules for redirect dns:
iptables -t nat -A SINGBOXDNS -s 192.168.50.45 -j DNAT --to-destination <singbox_tun_ip>:portnr
iptables -t nat -A SINGBOXDNS -s 192.168.50.102 -j DNAT --to-destination <singbox_tun_ip>:portnr
#more rules from different source ips could be added here.I don't understand what is meant by SINGBOXDNS?
<singbox_tun_ip>:portnrIt's the name of the new firewall chain we are creating. It's more convenient to create a new chain (rule list) and have all udp and tcp port 53 to be sent to this new chain. Then simpler rules could be made in this chain since we know only dns requests come here.
iptables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -s 192.168.50.102 -j DNAT --to-destination <singbox_tun_ip>:portnr
iptables -t nat -I PREROUTING -p udp -m udp --dport 53 -s 192.168.50.102 -j DNAT --to-destination <singbox_tun_ip>:portnrYep, looks right.
Thank you. I haven't tried it yet. When I have time, I'll definitely try it and let you know the result.
Great idea. This trick worked with Adguard Home. I'll try with iptables.
But with iptables this number does not work. DNS requests after executing the commands you have given go to Adguard Home.
iptables -t nat -N SINGBOXDNS
iptables -t nat -F SINGBOXDNS 2>/dev/null
iptables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -j SINGBOXDNS
iptables -t nat -I PREROUTING -p udp -m udp --dport 53 -j SINGBOXDNS
iptables -t nat -A SINGBOXDNS -s 192.168.50.33 -p tcp -j DNAT --to-destination 172.19.0.1:5553
iptables -t nat -A SINGBOXDNS -s 192.168.50.33 -p udp -j DNAT --to-destination 172.19.0.1:5553
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
