V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
testcaoy7
V2EX  ›  DNS

有关 unbound 的 ssl-upstream 功能,高手求解

  •  
  •   testcaoy7 · 2016-11-20 20:19:33 +08:00 · 4430 次点击
    这是一个创建于 2926 天前的主题,其中的信息可能已经有所发展或是发生改变。
    我设置了 OARC 的 DNS-over-TLS 的服务器,见: https://www.dns-oarc.net/oarc/services/dnsprivacy

    我的配置文件:

    # Unbound configuration file on windows.
    # See example.conf for more settings and syntax
    server:
    # verbosity level 0-4 of logging
    verbosity: 0

    # if you want to log to a file use
    logfile: "D:\unbound.log"

    # on Windows, this setting makes reports go into the Application log
    # found in ControlPanels - System tasks - Logs
    use-syslog: no

    # ip address to bind
    interface: 127.0.0.1

    # port to operate
    port: 53

    # if yes, perform prefetching of almost expired message cache entries.
    prefetch: yes

    # use dns-over-tls
    ssl-upstream: yes

    forward-zone:
    name: "."
    forward-addr: 184.105.193.78@853

    但是 DNS 查询就是不断地超时:

    nslookup zh.wikipedia.org 127.0.0.1
    服务器: localhost
    Address: 127.0.0.1

    DNS request timed out.
    timeout was 2 seconds.
    DNS request timed out.
    timeout was 2 seconds.
    DNS request timed out.
    timeout was 2 seconds.
    DNS request timed out.
    timeout was 2 seconds.
    *** 请求 localhost 超时

    高手求解?
    5 条回复    2016-11-24 00:37:10 +08:00
    flyfishcn
        1
    flyfishcn  
       2016-11-22 20:41:33 +08:00
    请确定上游服务的可用性
    testcaoy7
        2
    testcaoy7  
    OP
       2016-11-23 17:59:20 +08:00
    @flyfishcn 上游服务可用,用 tdns-client-proxy ( https://ant.isi.edu/software/tdns/tdns-client-proxy/index.html )在 ubuntu 下测试过了,看来是 unbound 的问题
    flyfishcn
        3
    flyfishcn  
       2016-11-23 19:25:27 +08:00
    @testcaoy7 反正我检测其中的一个 IP 853 端口都没有开放,也许就是我测的碰巧挂了。
    testcaoy7
        4
    testcaoy7  
    OP
       2016-11-23 19:42:04 +08:00
    @flyfishcn 海外测试的,莫不成是某防火墙的问题
    legend4
        5
    legend4  
       2016-11-24 00:37:10 +08:00
    @testcaoy7 别鬼迷心窍了,你没看 OARC 页面介绍( https://www.dns-oarc.net/oarc/services/dnsprivacy)里说的很清楚的,这个 DNS 服务商要收集查询记录、数据用作研究的,无论是你个人用,还是局域网公用,都不建议用这个,为什么不考虑 dnscrypt+unbound+opennic 的组合
    PS: 我也尝试了, unbound 里语法没问题,查询没有成功,仔细看过 OARC 要记录用户查询数据,直接放弃
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   实用小工具   ·   3025 人在线   最高记录 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 22ms · UTC 13:57 · PVG 21:57 · LAX 05:57 · JFK 08:57
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.