182 lines
5.2 KiB
Markdown
182 lines
5.2 KiB
Markdown
# MosDNS + MikroTik Amazon 域名处理部署指南
|
||
|
||
## 功能说明
|
||
|
||
这个配置会在解析 Amazon 相关域名时，自动将解析到的 IP 地址添加到 MikroTik 路由器的 address list 中，用于防火墙规则控制。
|
||
|
||
## 部署步骤
|
||
|
||
### 1. 上传文件到 Debian 12 服务器
|
||
|
||
```bash
|
||
# 上传编译好的 mosdns 可执行文件
|
||
scp mosdns-linux-amd64 user@your-server:/usr/local/bin/mosdns
|
||
|
||
# 上传配置文件
|
||
scp config.yaml user@your-server:/usr/local/mosdns/
|
||
scp dns.yaml user@your-server:/usr/local/mosdns/
|
||
|
||
# 设置执行权限
|
||
ssh user@your-server "chmod +x /usr/local/bin/mosdns"
|
||
```
|
||
|
||
### 2. 创建必要的目录和文件
|
||
|
||
```bash
|
||
# 创建配置目录
|
||
sudo mkdir -p /usr/local/mosdns/config
|
||
|
||
# 下载 Amazon 域名列表
|
||
sudo wget -O /usr/local/mosdns/config/geosite_amazon.txt https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/amazon
|
||
sudo wget -O /usr/local/mosdns/config/geosite_amazon-ads.txt https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/amazon-ads
|
||
sudo wget -O /usr/local/mosdns/config/geosite_amazontrust.txt https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/amazontrust
|
||
sudo wget -O /usr/local/mosdns/config/amazon.txt https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/amazon
|
||
|
||
# 下载其他必要的域名和 IP 文件
|
||
sudo wget -O /usr/local/mosdns/config/geosite_tiktok.txt https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/tiktok
|
||
sudo wget -O /usr/local/mosdns/config/gfwlist.out.txt https://raw.githubusercontent.com/gfwlist/gfwlist/master/gfwlist.txt
|
||
sudo wget -O /usr/local/mosdns/config/domains.txt https://raw.githubusercontent.com/v2fly/domain-list-community/master/data/category-games
|
||
sudo wget -O /usr/local/mosdns/config/cn.txt https://raw.githubusercontent.com/Loyalsoldier/v2ray-rules-dat/release/geoip.dat
|
||
```
|
||
|
||
### 3. 在 MikroTik 中创建 address list
|
||
|
||
```bash
|
||
# 通过 SSH 连接到 MikroTik 路由器
|
||
ssh admin@192.168.1.1
|
||
|
||
# 创建 IPv4 和 IPv6 address list
|
||
/ip firewall address-list add list=amazon_ips
|
||
/ip firewall address-list add list=amazon_ips6
|
||
|
||
# 创建防火墙规则（可选）
|
||
/ip firewall filter add chain=forward src-address-list=amazon_ips action=drop comment="Block Amazon IPs"
|
||
/ip firewall filter add chain=forward src-address-list=amazon_ips6 action=drop comment="Block Amazon IPv6 IPs"
|
||
```
|
||
|
||
### 4. 修改配置文件中的 MikroTik 连接信息
|
||
|
||
编辑 `/usr/local/mosdns/dns.yaml` 文件，修改 mikrotik_amazon 插件的配置：
|
||
|
||
```yaml
|
||
# 修改为你的 MikroTik 实际信息
|
||
args: "192.168.1.1:8728:admin:your-password:false:10:amazon_ips:amazon_ips6:24:32:amazon_domain:86400"
|
||
```
|
||
|
||
参数说明：
|
||
- `192.168.1.1`: MikroTik 路由器 IP
|
||
- `8728`: API 端口
|
||
- `admin`: 用户名
|
||
- `your-password`: 密码
|
||
- `false`: 不使用 TLS
|
||
- `10`: 连接超时时间
|
||
- `amazon_ips`: IPv4 address list 名称
|
||
- `amazon_ips6`: IPv6 address list 名称
|
||
- `24`: IPv4 掩码
|
||
- `32`: IPv6 掩码
|
||
- `amazon_domain`: 注释
|
||
- `86400`: 地址超时时间（24小时）
|
||
|
||
### 5. 创建 systemd 服务
|
||
|
||
```bash
|
||
sudo tee /etc/systemd/system/mosdns.service > /dev/null <<EOF
|
||
[Unit]
|
||
Description=MosDNS DNS Server
|
||
After=network.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=root
|
||
ExecStart=/usr/local/bin/mosdns -c /usr/local/mosdns/config.yaml
|
||
Restart=always
|
||
RestartSec=3
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
|
||
# 重新加载 systemd 配置
|
||
sudo systemctl daemon-reload
|
||
|
||
# 启用并启动服务
|
||
sudo systemctl enable mosdns
|
||
sudo systemctl start mosdns
|
||
|
||
# 检查服务状态
|
||
sudo systemctl status mosdns
|
||
```
|
||
|
||
### 6. 配置 DNS 转发
|
||
|
||
修改 `/etc/systemd/resolved.conf`：
|
||
|
||
```ini
|
||
[Resolve]
|
||
DNS=127.0.0.1
|
||
#FallbackDNS=8.8.8.8 8.8.4.4
|
||
#Domains=
|
||
#DNSSEC=no
|
||
#DNSOverTLS=no
|
||
#MulticastDNS=yes
|
||
#LLMNR=yes
|
||
#Cache=yes
|
||
#DNSStubListener=no
|
||
```
|
||
|
||
重启 systemd-resolved：
|
||
|
||
```bash
|
||
sudo systemctl restart systemd-resolved
|
||
```
|
||
|
||
### 7. 测试配置
|
||
|
||
```bash
|
||
# 测试 Amazon 域名解析
|
||
nslookup amazon.com 127.0.0.1
|
||
nslookup aws.amazon.com 127.0.0.1
|
||
|
||
# 检查 MikroTik address list 是否更新
|
||
ssh admin@192.168.1.1 "/ip firewall address-list print where list=amazon_ips"
|
||
|
||
# 查看 mosdns 日志
|
||
sudo journalctl -u mosdns -f
|
||
```
|
||
|
||
## 配置说明
|
||
|
||
### 工作流程
|
||
|
||
1. **域名匹配**：当查询 Amazon 相关域名时，匹配 `amazon_domains` 集合
|
||
2. **DNS 解析**：使用国外 DNS 服务器解析域名
|
||
3. **IP 提取**：从 DNS 响应中提取 A 和 AAAA 记录
|
||
4. **地址添加**：通过 MikroTik API 将 IP 添加到 address list
|
||
5. **超时管理**：IP 地址会在 24 小时后自动过期
|
||
|
||
### 监控和调试
|
||
|
||
```bash
|
||
# 查看实时日志
|
||
sudo journalctl -u mosdns -f
|
||
|
||
# 查看服务状态
|
||
sudo systemctl status mosdns
|
||
|
||
# 测试 MikroTik 连接
|
||
curl -k https://192.168.1.1:8729/api/rest/ip/firewall/address-list
|
||
```
|
||
|
||
### 故障排除
|
||
|
||
1. **连接失败**：检查 MikroTik IP、端口和认证信息
|
||
2. **权限不足**：确保 MikroTik 用户具有管理 address list 的权限
|
||
3. **域名文件缺失**：确保所有域名列表文件都已下载
|
||
4. **DNS 解析失败**：检查上游 DNS 服务器配置
|
||
|
||
## 安全注意事项
|
||
|
||
1. 不要在配置文件中使用明文密码，考虑使用环境变量
|
||
2. 限制对 MikroTik API 端口的访问
|
||
3. 定期更新域名列表文件
|
||
4. 监控 address list 大小，避免过多条目影响性能 |