sudo apt update
sudo apt install -y dnsmasq dnsutils curl jq

# 阻止 apt 自动拉起的 systemd-resolved 抢 53 端口
sudo systemctl disable --now systemd-resolved
sudo rm -f /etc/resolv.conf
sudo ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf 2>/dev/null || true

# 确认 53 端口空着
sudo ss -lunp | grep ':53 ' || echo "53 空闲"

# ---- 监听与接口 ----
# 只监听本机回环与私网口，公网口不开 53（防开放解析器被利用）
listen-address=127.0.0.1,10.0.0.5
bind-interfaces
# 需要给内网其它机器用时，改成:
# interface=eth0
# except-interface=lo

# ---- 上游与缓存 ----
no-resolv
no-poll
domain-needed
bogus-priv
cache-size=10000
min-cache-ttl=300
max-cache-ttl=86400
neg-ttl=60

# ---- 默认上游（非国内域名）----
server=1.1.1.1
server=9.9.9.9

# ---- 预取常热域名，进一步压时延 ----
# Dnsmasq 会缓存但不会主动续期，靠下游流量自然刷新即可

# ---- 日志（调试期打开，稳定后关掉）----
log-queries=extra
log-facility=/var/log/dnsmasq.log
log-async=20

sudo install -d /etc/dnsmasq.d/china-list
cd /opt && sudo git clone --depth=1 https://github.com/felixonmars/dnsmasq-china-list.git
sudo cp dnsmasq-china-list/accelerated-domains.china.conf /etc/dnsmasq.d/china-list/
sudo cp dnsmasq-china-list/bogus-nxdomain.china.conf /etc/dnsmasq.d/china-list/ 2>/dev/null || true

# /etc/systemd/system/china-list-update.service
[Unit]
Description=Update dnsmasq-china-list
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
WorkingDirectory=/opt/dnsmasq-china-list
ExecStart=/usr/local/bin/update-china-list.sh

# /etc/systemd/system/china-list-update.timer
[Unit]
Description=Weekly dnsmasq-china-list refresh

[Timer]
OnCalendar=Sun 04:17
RandomizedDelaySec=900
Persistent=true

[Install]
WantedBy=timers.target

#!/usr/bin/env bash
set -euo pipefail

REPO=/opt/dnsmasq-china-list
DEST=/etc/dnsmasq.d/china-list
STAMP=/var/lib/china-list/last-update

git -C "$REPO" pull --ff-only --quiet

# 只在内容真正变化时才 reload，避免无谓的缓存丢失
mkdir -p "$(dirname "$STAMP")"
if ! diff -rq "$REPO/build" "$DEST" >/dev/null 2>&1; then
  install -m 644 "$REPO"/build/accelerated-domains.china.conf "$DEST"/
  install -m 644 "$REPO"/*/build/*.conf "$DEST"/ 2>/dev/null || true
  systemctl reload dnsmasq
  date -Is > "$STAMP"
  logger -t china-list "updated, dnsmasq reloaded"
else
  logger -t china-list "no change"
fi

# /etc/dnsmasq.d/20-dnssec.conf
dnssec
# 信任锚：由 dnsmasq 包自带 /usr/share/dns/root.key，通常无需手配
# 若手工部署：trust-anchor=.,20326,8,2,E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D

dig +dnssec sigfail.verteiltesysteme.net @127.0.0.1
# 期望：status: SERVFAIL（因为签名故意错误）

dig +dnssec cloudflare.com @127.0.0.1 | grep -E 'flags|status'
# 期望：flags: qr rd ra ad;   status: NOERROR   ← ad 表示已验证

# 命中（cached）与转发（forwarded）比例
awk '/cached/ {c++} /forwarded/ {f++} END {printf "cached=%d forwarded=%d hit=%.1f%%\n", c, f, c*100/(c+f)}' \
  /var/log/dnsmasq.log

# /etc/systemd/system/dnsmasq.service.d/hardening.conf
[Service]
User=dnsmasq
Group=dnsmasq
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@system-service
ReadWritePaths=/var/log /var/lib/misc

sudo systemctl daemon-reload
sudo systemctl restart dnsmasq
sudo systemctl status dnsmasq --no-pager

#!/usr/bin/env bash
# /usr/local/bin/dnsmasq-metrics.sh
set -euo pipefail
OUT=/var/lib/node_exporter/textfile/dnsmasq.prom
LOG=/var/log/dnsmasq.log
TMP=$(mktemp)

cached=$(grep -c 'cached' "$LOG" 2>/dev/null || echo 0)
forwarded=$(grep -c 'forwarded' "$LOG" 2>/dev/null || echo 0)
total=$((cached + forwarded))

rss=$(systemctl show dnsmasq -p MemoryCurrent --value)
rss=${rss:-0}

{
  echo "# HELP dnsmasq_queries_total Total queries seen in current log"
  echo "# TYPE dnsmasq_queries_total counter"
  echo "dnsmasq_queries_total{result=\"cached\"} $cached"
  echo "dnsmasq_queries_total{result=\"forwarded\"} $forwarded"
  echo "# HELP dnsmasq_cache_hit_ratio Cached / total since log rotation"
  echo "# TYPE dnsmasq_cache_hit_ratio gauge"
  if [ "$total" -gt 0 ]; then
    awk -v c="$cached" -v t="$total" 'BEGIN{printf "dnsmasq_cache_hit_ratio %.4f\n", c/t}'
  else
    echo "dnsmasq_cache_hit_ratio 0"
  fi
  echo "# HELP dnsmasq_memory_bytes Resident memory of dnsmasq"
  echo "# TYPE dnsmasq_memory_bytes gauge"
  echo "dnsmasq_memory_bytes $rss"
} > "$TMP"

mv "$TMP" "$OUT"

server=127.0.0.1#5335

# /etc/unbound/unbound.conf.d/recursive.conf
server:
  interface: 127.0.0.1
  port: 5335
  do-daemonize: no
  access-control: 127.0.0.0/8 allow
  hide-identity: yes
  hide-version: yes
  qname-minimisation: yes
  prefetch: yes
  num-threads: 1
  msg-cache-size: 32m
  rrset-cache-size: 64m

  # DNSSEC
  auto-trust-anchor-file: "/var/lib/unbound/root.key"
  val-clean-additional: yes

  # 拒绝解析私网地址，防 DNS rebinding
  private-address: 10.0.0.0/8
  private-address: 172.16.0.0/12
  private-address: 192.168.0.0/16
  private-address: 169.254.0.0/16
  private-address: fd00::/8