如何构建一个防污染DNS

DNS 污染，GFW 三板斧第一招，对付起来相对容易，直接将 GFW 伪造的 DNS 抢答包丢弃即可解决。

tl;rd

添加下如 iptables 规则后，然后将主机DNS指向墙外DNS（如8.8.8.8）（或本地自建递归DNS）即可。

iptables -t raw -A PREROUTING -m bpf --bytecode '38,48 0 0 0,84 0 0 240,21 34 0 96,48 0 0 0,84 0 0 240,21 0 31 64,48 0 0 9,21 0 29 17,40 0 0 6,69 27 0 8191,177 0 0 0,72 0 0 0,21 0 24 53,40 0 0 2,37 22 0 128,72 0 0 12,21 0 20 1,72 0 0 14,21 0 18 1,72 0 0 16,21 0 16 0,72 0 0 18,21 0 14 1,72 0 0 4,20 0 0 8,12 0 0 0,7 0 0 0,64 0 0 0,21 0 8 268435456,177 0 0 0,72 0 0 4,20 0 0 4,12 0 0 0,7 0 0 0,64 0 0 0,21 0 1 0,6 0 0 65535,6 0 0 0' -j DROP
iptables -t raw -A PREROUTING -m bpf --bytecode '27,48 0 0 0,84 0 0 240,21 23 0 96,48 0 0 0,84 0 0 240,21 0 20 64,48 0 0 9,21 0 18 17,40 0 0 6,69 16 0 8191,177 0 0 0,72 0 0 0,21 0 13 53,40 0 0 4,21 0 11 0,40 0 0 6,21 0 9 0,48 0 0 8,37 7 0 40,72 0 0 12,21 0 5 1,72 0 0 14,21 0 3 1,72 0 0 16,21 0 1 0,6 0 0 65535,6 0 0 0' -j DROP
iptables -t raw -A PREROUTING -p udp -m bpf --bytecode '39,40 0 0 20,21 0 36 53,32 0 0 36,21 0 34 0,32 0 0 32,21 3 0 65537,21 0 31 65536,40 0 0 30,21 15 29 33152,40 0 0 30,84 0 0 65487,21 17 0 34176,40 0 0 24,7 0 0 0,64 0 0 4,21 5 0 3222011905,21 0 21 536936448,64 0 0 8,21 0 19 0,64 0 0 12,21 3 17 0,64 0 0 10,37 15 0 255,53 0 14 64,32 0 0 4,21 11 0 0,21 11 0 16384,84 0 0 65535,21 8 9 16384,40 0 0 6,21 0 7 0,40 0 0 24,7 0 0 0,64 0 0 6,21 0 3 65537,64 0 0 10,21 0 1 60,6 0 0 1,6 0 0 0' -j DROP
ip6tables -t raw -A PREROUTING -m bpf --bytecode '29,48 0 0 0,84 0 0 240,21 0 25 96,48 0 0 6,21 0 23 17,40 0 0 40,21 0 21 53,40 0 0 4,37 19 0 128,40 0 0 52,21 0 17 1,40 0 0 54,21 0 15 1,40 0 0 56,21 0 13 0,40 0 0 58,21 0 11 1,40 0 0 4,20 0 0 8,7 0 0 1,64 0 0 40,21 0 6 268435456,40 0 0 4,20 0 0 4,7 0 0 6,64 0 0 40,21 0 1 0,6 0 0 65535,6 0 0 0' -j DROP
ip6tables -t raw -A PREROUTING -m bpf --bytecode '19,48 0 0 0,84 0 0 240,21 0 15 96,48 0 0 6,21 0 13 17,40 0 0 40,21 0 11 53,32 0 0 0,21 0 9 1610612736,40 0 0 4,37 7 0 128,40 0 0 52,21 0 5 1,40 0 0 54,21 0 3 1,40 0 0 56,21 0 1 0,6 0 0 65535,6 0 0 0' -j DROP
ip6tables -t raw -A PREROUTING -p udp -m bpf --bytecode '23,40 0 0 40,21 0 20 53,32 0 0 52,21 0 18 65537,32 0 0 56,21 0 16 0,40 0 0 0,84 0 0 65520,21 0 13 24576,40 0 0 44,7 0 0 0,64 0 0 24,21 5 0 3222011905,21 0 8 536936448,64 0 0 28,21 0 6 0,64 0 0 32,21 3 4 0,64 0 0 30,37 2 0 255,53 0 1 64,6 0 0 1,6 0 0 0' -j DROP

上述规则六条中的两条为 lccd 的成果，字节码所对应的原始汇编可在此 gist 查看。

剩余四条字节码由以下 pcap-filter 规则使用 nfbpf_compile 编译而来。

ipv4

udp src port 53 and
ip[4:2] = 0x0000 and
ip[6:2] = 0x0000 and
ip[8] <= 40 and
udp[12:2] = 0x0001 and
udp[14:2] = 0x0001 and
udp[16:2] = 0x0000

udp src port 53 and
ip[2:2] <= 128 and
udp[12:2] = 0x0001 and
udp[14:2] = 0x0001 and
udp[16:2] = 0x0000 and
udp[18:2] = 0x0001 and
udp[(udp[4:2] - 8):4] = 0x10000000 and udp[(udp[4:2] - 4):4] = 0x00000000

ipv6

ip6[6] = 0x11 and
ip6[40:2] = 0x0035 and
ip6[0:4] = 0x60000000 and
ip6[4:2] <= 128 and
ip6[52:2] = 0x0001 and
ip6[54:2] = 0x0001 and
ip6[56:2] = 0x0000

ip6[6] = 0x11 and
ip6[40:2] = 0x0035 and
ip6[4:2] <= 128 and
ip6[52:2] = 0x0001 and
ip6[54:2] = 0x0001 and
ip6[56:2] = 0x0000 and
ip6[58:2] = 0x0001 and
ip6[40 + (ip6[4:2] - 8): 4] = 0x10000000 and ip6[40 + (ip6[4:2] - 4): 4] = 0x00000000