mapdns在immortalwrt中是不是不能启用？

[science2468]

大家好，我之前用smartdns配合dnsmasq的dns转发+pbr，将代理的域名路由到tun0设备实现访问。看到mapdns时我觉得 mapdns的作用和smartdns的作用很像，都是获取域名的IP地址。尝试后发现mapdns未启用，日志也没有输出相关的信息。解析www.google.com等这类域名依然是被抢答的IP地址，没有240开头的“假”IP。
版本：immortalwrt24.10.5，设备：jcg q30 pro

  # Mapped DNS address
  address: 8.8.8.8
  # Mapped DNS port
  port: 53
  # Mapped IP network base
  network: 240.0.0.0
  # Mapped IP network mask
  netmask: 240.0.0.0
  # Mapped DNS cache size
  cache-size: 1000

root@ImmortalWrt:~# netstat -tunlp | grep 53
tcp        0      0 192.168.1.1:53          0.0.0.0:*               LISTEN      15831/dnsmasq
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      15831/dnsmasq
tcp        0      0 198.18.0.1:53           0.0.0.0:*               LISTEN      15831/dnsmasq
tcp        0      0 x.x.x.x:53      0.0.0.0:*               LISTEN      15831/dnsmasq
tcp        0      0 fe80::2bdd:7072:5482:34a6:53 :::*                    LISTEN      15831/dnsmasq
tcp        0      0 fc00::1:53              :::*                    LISTEN      15831/dnsmasq
tcp        0      0 fe80::5233:f0ff:fefb:ac04:53 :::*                    LISTEN      15831/dnsmasq
tcp        0      0 fe80::5233:f0ff:fefb:ac04:53 :::*                    LISTEN      15831/dnsmasq
tcp        0      0 ::1:53                  :::*                    LISTEN      15831/dnsmasq
tcp        0      0 fe80::5233:f0ff:fefb:ac05:53 :::*                    LISTEN      15831/dnsmasq
tcp        0      0 fd21:aaa3:850d::1:53    :::*                    LISTEN      15831/dnsmasq
tcp        0      0 xxxxxxxxx:53 :::*                    LISTEN      15831/dnsmasq
tcp        0      0xxxxxx:53 :::*                    LISTEN      15831/dnsmasq
tcp        0      0 fe80::45f9:9e80:b9e4:8375:53 :::*                    LISTEN      15831/dnsmasq
udp        0      0 198.18.0.1:53           0.0.0.0:*                           15831/dnsmasq
udp        0      0 127.0.0.1:53            0.0.0.0:*                           15831/dnsmasq
udp        0      0 192.168.1.1:53          0.0.0.0:*                           15831/dnsmasq
udp        0      0 xxxxx:53      0.0.0.0:*                           15831/dnsmasq
udp        0      0 fc00::1:53              :::*                                15831/dnsmasq
udp        0      0 fe80::2bdd:7072:5482:34a6:53 :::*                                15831/dnsmasq
udp        0      0 ::1:53                  :::*                                15831/dnsmasq
udp        0      0 fe80::5233:f0ff:fefb:ac04:53 :::*                                15831/dnsmasq
udp        0      0 fe80::5233:f0ff:fefb:ac05:53 :::*                                15831/dnsmasq
udp        0      0 2408:8221:5b11:4dc0::1:53 :::*                                15831/dnsmasq
udp        0      0 fd21:aaa3:850d::1:53    :::*                                15831/dnsmasq
udp        0      0 fe80::5233:f0ff:fefb:ac04:53 :::*                                15831/dnsmasq
udp        0      0 xxxxxxxx:53 :::*                                15831/dnsmasq
udp        0      0 fe80::45f9:9e80:b9e4:8375:53 :::*                                15831/dnsmasq

53端口有198.18.0.1，我在dnsmasq中把dns劫持关了，也是这样。

这是info等级的日志：

Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [I] 0x7fbedf0e70 socks5 client tcp -> [91.108.56.101]:443
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [I] 0x7fbedcf3c0 socks5 client tcp -> [2001:b28:f23f:f005::a]:443
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [I] 0x7fbedcf4b0 socks5 client tcp -> [91.108.56.101]:80
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [I] 0x7fbee7d060 socks5 client tcp -> [2001:b28:f23f:f005::a]:80
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [I] 0x7fbedcf3c0 io timeout
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [E] 0x7fbedcf3c0 socks5 client connect
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [E] 0x7fbedcf3c0 socks5 session connect
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [I] 0x7fbee7d060 io timeout
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [E] 0x7fbee7d060 socks5 client connect
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [E] 0x7fbee7d060 socks5 session connect
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [I] 0x7fbee7d060 socks5 client tcp -> [2001:b28:f23f:f005::a]:80
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [E] 0x7fbee7d060 socks5 client res.rep 1
Fri Feb 13 18:16:51 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:51] [E] 0x7fbee7d060 socks5 session handshake
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [I] 0x7fbee7d060 socks5 client tcp -> [91.108.56.101]:443
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [I] 0x7fbedcf3c0 socks5 client tcp -> [2001:b28:f23f:f005::a]:443
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [I] 0x7fbee7d140 socks5 client tcp -> [91.108.56.101]:80
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [I] 0x7fbee7da20 socks5 client tcp -> [2001:b28:f23f:f005::a]:80
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [I] 0x7fbee7da20 io timeout
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [E] 0x7fbee7da20 socks5 client connect
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [E] 0x7fbee7da20 socks5 session connect
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [E] 0x7fbedcf3c0 socks5 client res.rep 1
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [E] 0x7fbedcf3c0 socks5 session handshake
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [I] 0x7fbedcf4b0 socks5 client tcp -> [2001:b28:f23f:f005::a]:80
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [E] 0x7fbedcf4b0 socks5 client res.rep 1
Fri Feb 13 18:16:52 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:52] [E] 0x7fbedcf4b0 socks5 session handshake
Fri Feb 13 18:16:58 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:16:58] [I] 0x7fbee7d060 socks5 client tcp -> [140.82.112.26]:443
Fri Feb 13 18:17:04 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:17:04] [I] 0x7fbee7d140 socks5 client tcp -> [91.108.56.101]:443
Fri Feb 13 18:17:04 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:17:04] [I] 0x7fbedcf4b0 socks5 client tcp -> [2001:b28:f23f:f005::a]:443
Fri Feb 13 18:17:04 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:17:04] [I] 0x7fbedf0e70 socks5 client tcp -> [2001:b28:f23f:f005::a]:80
Fri Feb 13 18:17:04 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:17:04] [I] 0x7fbedcf3c0 socks5 client tcp -> [91.108.56.101]:80
Fri Feb 13 18:17:04 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:17:04] [I] 0x7fbedcf4b0 io timeout
Fri Feb 13 18:17:04 2026 daemon.err hev-socks5-tunnel[17637]: [2026-02-13 18:17:04] [E] 0x7fbedcf4b0 socks5 client connect

[heiher]

# Mapped DNS address
  address: 8.8.8.8

配置文件中指定了Mapped DNS服务器地址是8.8.8.8，需要域名是从8.8.8.8解析的，并且8.8.8.8是路由至tun网口的。

[science2468]

在pbr中，我把8.8.8.8路由到tun0设备后，这时没有设置dns转发到8.8.8.8。暂时出现了：

root@ImmortalWrt:~# nslookup www.google.com
Server:         127.0.0.1
Address:        127.0.0.1:53

Non-authoritative answer:
Name:   www.google.com
Address: 142.251.155.119
Name:   www.google.com
Address: 142.251.151.119
Name:   www.google.com
Address: 142.251.154.119
Name:   www.google.com
Address: 142.251.152.119
Name:   www.google.com
Address: 142.251.150.119
Name:   www.google.com
Address: 142.251.157.119
Name:   www.google.com
Address: 142.251.153.119
Name:   www.google.com
Address: 142.251.156.119

Non-authoritative answer:
Name:   www.google.com
Address: 2001::1

不到1分钟解析出来的IP就是被抢答的IP，199和31开头的facebook的IP。使用8.8.8.8、198.18.0.1解析也是
我尝试过未设置dns转发，重启 tun0、pbr、dnsmasq，解析IP是被抢答的；设置dns转发：domain/8.8.8.8，关闭dns劫持后，解析的IP是被抢答的。

这次没有info和error级别日志。使用8.8.8.8、198.18.0.1解析的IP依然是被抢答。

下面是我命令行的操作过程：

PS C:\Users\DXB24> ssh root@192.168.1.1


BusyBox v1.36.1 (2026-02-09 09:37:22 UTC) built-in shell (ash)

.___                               __         .__
|   | _____   _____   ____________/  |______  |  |
|   |/     \ /     \ /  _ \_  __ \   __\__  \ |  |
|   |  Y Y  \  Y Y  (  <_> )  | \/|  |  / __ \|  |__
|___|__|_|  /__|_|  /\____/|__|   |__| (____  /____/
          \/      \/  BE FREE AND UNAFRAID  \/
 -----------------------------------------------------
 ImmortalWrt 24.10.5, r33805-7c4e882aaf6f
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@ImmortalWrt:~# vi /etc/hev-socks5-tunnel/main.yml
root@ImmortalWrt:~# /etc/init
init.d/  inittab
root@ImmortalWrt:~# /etc/init.d/hev-socks5-tunnel restart
root@ImmortalWrt:~# nslookup google.com
Server:         127.0.0.1
Address:        127.0.0.1:53

Non-authoritative answer:
Name:   google.com
Address: 142.250.73.142

Non-authoritative answer:
Name:   google.com
Address: 2607:f8b0:400a:802::200e

root@ImmortalWrt:~# nslookup www.google.com
Server:         127.0.0.1
Address:        127.0.0.1:53

Non-authoritative answer:
Name:   www.google.com
Address: 142.251.155.119
Name:   www.google.com
Address: 142.251.151.119
Name:   www.google.com
Address: 142.251.154.119
Name:   www.google.com
Address: 142.251.152.119
Name:   www.google.com
Address: 142.251.150.119
Name:   www.google.com
Address: 142.251.157.119
Name:   www.google.com
Address: 142.251.153.119
Name:   www.google.com
Address: 142.251.156.119

Non-authoritative answer:
Name:   www.google.com
Address: 2001::1

root@ImmortalWrt:~# nslookup www.google.com 8.8.8.8
Server:         8.8.8.8
Address:        8.8.8.8:53

Non-authoritative answer:
Name:   www.google.com
Address: 199.16.158.8

Non-authoritative answer:
Name:   www.google.com
Address: 2001::1

root@ImmortalWrt:~# nslookup www.google.com
Server:         127.0.0.1
Address:        127.0.0.1:53

Non-authoritative answer:
Name:   www.google.com
Address: 142.251.156.119
Name:   www.google.com
Address: 142.251.155.119
Name:   www.google.com
Address: 142.251.151.119
Name:   www.google.com
Address: 142.251.154.119
Name:   www.google.com
Address: 142.251.152.119
Name:   www.google.com
Address: 142.251.150.119
Name:   www.google.com
Address: 142.251.157.119
Name:   www.google.com
Address: 142.251.153.119

Non-authoritative answer:
Name:   www.google.com
Address: 2001::1

root@ImmortalWrt:~# nslookup www.google.com 198.18.0.1
Server:         198.18.0.1
Address:        198.18.0.1:53

Non-authoritative answer:
Name:   www.google.com
Address: 142.251.153.119
Name:   www.google.com
Address: 142.251.156.119
Name:   www.google.com
Address: 142.251.155.119
Name:   www.google.com
Address: 142.251.151.119
Name:   www.google.com
Address: 142.251.154.119
Name:   www.google.com
Address: 142.251.152.119
Name:   www.google.com
Address: 142.251.150.119
Name:   www.google.com
Address: 142.251.157.119

Non-authoritative answer:
Name:   www.google.com
Address: 2001::1

root@ImmortalWrt:~# nslookup www.google.com
Server:         127.0.0.1
Address:        127.0.0.1:53

Non-authoritative answer:
Name:   www.google.com
Address: 31.13.73.169

Non-authoritative answer:
Name:   www.google.com
Address: 2001::1

root@ImmortalWrt:~# nslookup www.google.com 198.18.0.1
Server:         198.18.0.1
Address:        198.18.0.1:53

Non-authoritative answer:
Name:   www.google.com
Address: 31.13.73.169

Non-authoritative answer:
Name:   www.google.com
Address: 2001::1

[heiher]

我怎么看着没访问到mapped dns呢，ip route get 8.8.8.8 贴下看看。有没有配置防火墙层面的dns访问劫持？

[science2468]

确实是没有路由。下面是我添加路由测试成功。

mapdns:
  # Mapped DNS address
  address: 198.18.0.2
  # Mapped DNS port
  port: 53
  # Mapped IP network base
  network: 100.64.0.0
  # Mapped IP network mask
  netmask: 255.192.0.0
  # Mapped DNS cache size
  cache-size: 10000

root@ImmortalWrt:~# ip route add 198.18.0.2/32 dev tun0
root@ImmortalWrt:~# ip route get 198.18.0.2
198.18.0.2 dev tun0 src 198.18.0.1 uid 0
    cache
root@ImmortalWrt:~# nslookup duckduckgo.com 198.18.0.2
Server:         198.18.0.2
Address:        198.18.0.2:53

Non-authoritative answer:
Name:   duckduckgo.com
Address: 100.64.0.0

Non-authoritative answer:

上面是我添加路由后按照您给的命令重新测试返回了预设IP段的IP。

现在我添加了静态路由

network.@route[0]=route
network.@route[0].interface='rm5p'
network.@route[0].target='198.18.0.2/32'

PBR1.2.0-r6现在需要配合接口，防火墙可以wan也可以lan，单纯的tun0设备暂时没法选择

network.rm5p=interface
network.rm5p.proto='static'
network.rm5p.device='tun0'
network.rm5p.ipaddr='198.18.0.1/32'
network.rm5p.ip6addr='fc00::1/128'
network.rm5p.defaultroute='0'

经过网页测试可以正常访问Google。curl和wget测试都是error。

ps：hev-socks5-tunnel+pbr可以正常分流代理域名。32MB的小闪存大内存设备可以使用这个替代sing-box和clash。2插件的总占空间不到1MB，我这带上ddns，3个插件712KB。

[heiher]

即使是路由正确了，curl和wget还不正常？

[science2468]

pbr.@policy[3]=policy
pbr.@policy[3].name='telegram'
pbr.@policy[3].dest_addr='91.108.56.0/22 91.108.4.0/22 91.108.8.0/22 91.108.16.0/22 91.108.12.0/22 149.154.160.0/20 91.105.192.0/23 91.108.20.0/22 185.76.151.0/24 2001:b28:f23d::/48 2001:b28:f23f::/48 2001:67c:4e8::/48 2001:b28:f23c::/48 2a0a:f280::/32'
pbr.@policy[3].interface='rm5p'
pbr.@policy[4]=policy
pbr.@policy[4].name='mapdns'
pbr.@policy[4].dest_addr='100.64.0.0/10'
pbr.@policy[4].interface='rm5p'
pbr.@policy[5]=policy
pbr.@policy[5].name='ai'
pbr.@policy[5].interface='rm5p'
pbr.@policy[5].dest_addr='titles.prod.mos.microsoft.com mss.office.com'
root@ImmortalWrt:~# curl https://www.google.com
curl: (7) Failed to connect to www.google.com port 443 after 4191 ms: Error
root@ImmortalWrt:~# wget https://www.google.com
Downloading 'https://www.google.com'
Connecting to 100.64.0.1:443
SSL error: error:00000005:lib(0)::reason(5)
Connection error: Connection failed
root@ImmortalWrt:~#

不影响使用，只是测试是这样。我是用sing-box的mixed作入站，入站连接是有的。