‌Bypass unblocked domains as much as possible (minimize proxy usage)

[patterniha]

I've had requests recently about how to only pass blocked websites through the proxy and bypass (route direct) the rest.

So the server is only used when it is really needed.

The problem is that we don't have a complete list of blocked or unblocked domains.
I've seen a few lists for China for example, but those lists are definitely not complete because there are so many domains and also GFW is updated every day.

In Iran/Russia, GFW return specific-and-fixed-IPs/NXDOMAIN for blocked domains, but in China GFW return random incorrect IPs, so I'm considering implementing the following way that will work in China as well:

///

Fact-A: if GFW does not spoof DNS for a domain -> in 99% cases, GFW also didn't block tls-sni/http-host for that domain. also, the returned-IPs are not blocked.

///

So the idea is that we check return IPs for a non-block-DNS with a domestic-DNS, if both returned-IPs are equal, then GFW definitely didn't spoof the IPs, so according to fact-A, we can bypass that domain.

///

How to implement in Xray-core?

I thought about it and the following idea came to mind:

we can add checkServerTag option for DNS-server-objects, this is the tag of other DNS-server that use for check IPs.

{     
  "tag": "non-block-dns",  // remote-DNS
  "address": "any",
  "checkServerTag": "domestic-dns-tag" // for example DNS-server-tag with "localhost" / "223.5.5.5" address.
}

if "non-block-dns" is used, it get IPs from "checkServer" too, if both have same IPs, then the domain is added to global "checkedDomains" list, and in any case, the original IP addresses will be returned.

and in routing we can add special word checked to the domain list:

{
  "outboundTag": "direct",
  "domain": ["checked", "geosite:china", "geosite:private"]
}

So if a domain exists in "checkedDomains" list then it route to direct.
Also, since this is only used in client-side, the size of the "checkedDomains" list will not be very large.
Also, if a domain is in "checkedDomains" list, there is no need to check again.

///

P1: it is still possible that GFW doesn't spoof DNS for a domain but tls-sni/http-host is blocked for that domain, or returned-IPs are blocked at all.

P2: there are many domains that have many IPs, but each time, (for example) two of them are returned, for example, cloudflare-domains returns two different IPs based on nearest-location,... each time.
so if the IPs are different, the domain is not necessarily blocked, but if the IPs are the same, the IPs is definitely not spoofed.

P3: in Iran some websites are not blocked, but they sanctioned Iran.

///

P1 is not a big problem, there are very few domains that don't follow fact-A, at least in the case of Iran, I don't know a single domain that doesn't follow fact-A!

P2 is not a big problem either, It only allows a number of domains that are not blocked to pass through the proxy.

P3 is not a big problem for Iran either, we have a nearly complete list of sanctioned domains in the "chocolate4u" list ("geosite:sanctioned")

@RPRX @Fangliding @yuhan6665 @Meo597

Regardless of how it's implemented, I think it's worth it and it takes a lot of load off the servers, what do you think?

update:

we can also collect RST-ACK-received-domain/IPs to be more accurate, although we may not receive RST-ACK for some IPs.

[MoRanYue]

I think what you need is a series of DNS configurations:

https://xtls.github.io/document/level-1/routing-with-dns.html

Group 1:
Overseas DNS for Google and Google China.

Group 2:
Domestic DNS for possible China domains, expecting China IP;
Overseas DNS for possible China domains, expecting China IP.

Group 3:
Overseas DNS for possible non-geographically-China domains, expecting non-China IP;

Group 4:
Overseas DNS for unknown domains, expecting China IP:

Fallback groups:
Overseas DNS.

[patterniha]

I think what you need is a series of DNS configurations:

https://xtls.github.io/document/level-1/routing-with-dns.html

No, you didn't understand the issue correctly, there is no such feature in Xray-core, i talk about blocked/unblocked domains.

[MoRanYue]

I think what you need is a series of DNS configurations:

https://xtls.github.io/document/level-1/routing-with-dns.html

No, you didn't understand the issue correctly, There is no such feature in Xray-core.

Ive read your text, then considered you just have a demand that you want to bypass domains which has China IP perfectly. However, the article link I placed seemed to do the same things as yours.

[patterniha]

Ive read your text, then considered you just have a demand that you want to bypass domains which has China IP perfectly

No, China-IPs/China-domains are easily bypassed by "geoip:cn"/"geosite:cn" rules, i talk about other non-blocked domains.

also, i want to know if this is acceptable then i start implementing it.

[yuhan6665]

If user don't care about DNS/SNI leaks, you might as well try connect directly (somehow), it give you more accurate result than DNS record match.

[patterniha]

If user don't care about DNS/SNI leaks, you might as well try connect directly (somehow), it give you more accurate result than DNS record match.

this is not about privacy, just for ordinary users that want to access blocked sites such as socials,...

try connect directly

We may not have RST-ACK for the spoofed-IP, or spoofed-IP belongs to a redirected-website and TCP-handshake completed successfully. It is also more difficult to implement.

also, at least in Iran we don't have P1-problem and this is accurate.

[MoRanYue]

Ive read your text, then considered you just have a demand that you want to bypass domains which has China IP perfectly

No, China-IPs/China-domains are easily bypassed by "geoip:cn"/"geosite:cn" rules, i talk about other non-blocked domains.

also, i want to know if this is acceptable then i start implementing it.

If you are discussing about unblocked overseas domains, you may ignored a factor: what if the domains is partially blocked? For an instance: in China, GitHub is partially blocked, gov sometimes interferes connections to it and sometimes not (see Blocky's statistics), your idea is to structure a caching mechanism for discovered unblocked domains, it will be inexact if ones are blocked again——According to officials' mood.

[patterniha]

what if the domains is partially blocked?

I don't know what exactly "partially blocked" means, but certainly few websites have this problems and we can separate them.

[MoRanYue]

what if the domains is partially blocked?

I don't know what exactly "partially blocked" means, but certainly few websites have this problems and we can separate them.

"Partially blocked" means "sometimes blocked, but sometimes not", according GFW itself. If you still insist on your idea, what we want is a heuristic method, not hard-coding them (such as intercepting TCP reset and remove this domain from that list).

[RememberOurPromise]

The problem is that we don't have a complete list of blocked or unblocked domains.

问题都找到了啊，都得维护列表的，代理软件怎么可能单凭DNS精准判断有没有墙，或者用户想要怎么分流

You've already identified the problem yourself. Everything needs a list to be maintained. How can proxy software accurately determine whether a website is blocked based solely on DNS without a list?

您要找的是不是：

[RememberOurPromise]

确定要使用代理，那就按环境分流最省事，按不同环境配置代理，或直连没墙网站

省得分流出问题或者各种切IP触发风控，等下你号没了浪费更多时间呢

If you've decided to use a proxy, the easiest way is to distribute traffic according to your environment. Either configure proxies for different environments, or connect directly to websites that are not blocked.

This avoids issues with traffic distribution or triggering various IP switching restrictions, which could lead to your account being banned and wasting even more time.

[patterniha]

@RememberOurPromise don't send AI answers, i talk about Xray-core.
@MoRanYue #10 (comment)

[patterniha]

@MoRanYue
yeah, we can also collect RST-ACK-received-domain/IPs to be more accurate, although as i said we may not receive RST-ACK for some IPs.

[Meo597]

靠 dns 识别被牆的话你这么设计会有问题，因为有些域比如 github 是间歇性阻断，没污染 dns 在中国

然后不考虑这个问题的话

你提出的客户端和服务器去比较 dns 解析结果是否一致行不通得略作修改（其实没有必要，有更简单的办法我最后会说）

1. 因为 cdn 导致解析结果大概率不一致，而且不是所有权威都支持 ecs 所以也没法靠 ecs 去修
2. 如果境内外都请求同一个递归也不行，因为它们分布式的，除非你自建一个递归（xray暴露53出去就行），这样你的方案就行的通了

中国的国际出口被 isp 故意劣化，只要是境外 ip 无论是否被牆都应该走代理。
因此楼上提到的我那篇文章只是用 dns 试探解析结果在国内外就满足中国用户的需求了

中国的 gfw 污染 ip 是固定范围内随机的，如果伊朗也是这样你应该收集它们做判定

gfw 抢答 dns 的行为有很多手段可以识别
但在它没升级前不应该过早提醒他们
你先试试看上面的办法，不行再说

[Meo597]

目前的 geoip/site 库有诸多缺陷：

• 没有任播段，维护者明确说过无意优化
• 没有上面提到的 dns 污染用 ip 段
• 非中国 ip 不准，至少应保证 ru 和 ir 的准确度
• geosite:cn 移除了所有 attr 为 @!cn @ads 的域，这对 xray 来说是不必要的

或许我们应该让
https://github.com/XTLS/Xray-rules-dat
不要仅停留在新建文件夹阶段