This article records my personal understanding of some Clash_Meta settings and how they work

Void Terminal Docs

DNS resolution

Sniffing is done before input, so rules cannot be used

../../IT/Utility/Excalidraw/openclashDNS.excalidraw

nameserver resolved to a foreign address, or a polluted address, or a match infallback-filter in the configuration, the decision will use fallback the resolved result, and then determine whether to proxy The DNS queries of the Fallback group are performed by the proxy server, because the role of the Fallback group is to handle DNS queries for blocked websites. The DNS queries of the Nameserver group can be configured by the user, and resolution follows the default DNS resolution method, that is, it first queries the local cache, then queries the hosts file, and in general is resolved by the local DNS server or a public DNS server, or by the default DNS server of the system

ipleak not in the rules, perform DNS resolution

First there are two groups of upstream DNS configurations, which are respectively nameserver and fallback , in redir-host mode, when the client DNS request arrives at clash it will concurrently request DNS servers in both groups, and use nameserver the result returned first among them as the basis, and according to fallback-filter the configuration, decide whether to use fallback the result as the final resolution result, for subsequent rule judgment.

When encountering geoip , it will initiate for traffic splitting DNS a request, with configured DNS server and other devices using this DNS server for resolution,Clash the workflow is as follows: from nameserver and the ones in fallback DNS concurrent requests are made, and the nameserver result that responds first is selected as the baseline to use GEOIP to determine this IP region it belongs to, if it belongs to the domestic（CN）or a reserved address then it responds directly to the client, otherwise it takes fallback the result in and responds to the client

Drawback: it also means that visiting foreign websites not in the rules will pass through nameserver query the address, if it happens to be polluted into cn (generally pollution will not turn it into a domestic one), then it cannot be accessed, in the vast majority of cases it will not be polluted into cn, and will go through fallback, so all websites matching GeoIP: CN and match will have DNS leakage

fallback-filter:
  geoip: true    #is true, not matching the geoip CN rules of use for fallback return result
  geoip-code: CN
  geosite:      #【Meta exclusive】setting geosite a certain category uses fallback return result
      - gfw 
  ipcidr:      #in the list ip use fallback return resolution result
    - 0.0.0.0/8
    - 10.0.0.0/8
    - 100.64.0.0/10
    - 127.0.0.0/8
    - 169.254.0.0/16
    - 172.16.0.0/12
    - 192.0.0.0/24
    - 192.0.2.0/24
    - 192.88.99.0/24
    - 192.168.0.0/16
    - 198.18.0.0/15
    - 198.51.100.0/24
    - 203.0.113.0/24
    - 224.0.0.0/4
    - 240.0.0.0/4
    - 255.255.255.255/32
  domain:       #domains in the list use fallback return resolution result
    - "+.msftconnecttest.com"
    - "+.msftncsi.com"

../../IT/Utility/Excalidraw/Drawing 2023-01-02 14.24.16.excalidraw

Routing rules

openclash Bypassing Chinese ip is implemented by the routing table and has nothing to do with clash, if the destination address is a Chinese IP it is not forwarded to clash

each IP-CIDR all carry no-resolvebecause IP-CIDR Represents the accessed address range, which is IP

meta

A netflix service has multiple connections with domain names and IPs

netflix.com Access -->Domain rules -->Proxy But netflix Internally, encrypted DNS may be used directly -->The obtained IP, local rules do not route this IP to Netflix In the rules, resulting in no netflix Not unlocked

Solution -->Force sniffing of pure IP

Because the IP also needs to establish a TCP connection and perform a TLS handshake, at this time the SNI field of the TLS handshake can be sniffed, and then the domain name corresponding to the IP is determined for routing

sniffer domain detection

`Meta has a built-in Sniffer domain sniffer, which reads the domain name field in the handshake packet and restores the IP to a domain name, effectively solving the shortcomings of the Mapping mechanism

To solve this problem, Clash uses the Mapping mechanism, which configures a mapping relationship between an IP and a domain name in the rules to direct the network traffic of a specific IP address to the specified proxy service, thereby improving the accuracy and efficiency of domain routing

The captured traffic usually only contains the IP address of the target server, without domain name information.Clash Meta Built in Sniffer The domain sniffer can help read the domain field of network packets, thereby converting the IP address back to a domain name, further improving the Mapping reliability and accuracy of the mechanism.

skip-domain

In the skip-domain list, you can specify a domain name to skip sniffing, or specify a specific keyword or string to skip.

1. Avoid conflicts: Some domain names may conflict with specific network traffic processing rules. If it is already clear that these domain names do not need special handling, you can add them to the skip-domain list to avoid conflicts and unnecessary processing.
2. Bypass sniffing restrictions: Some domain names or services may have anti-sniffing measures, that is, preventing sniffers from obtaining the real domain name information. In this case, add these domain names to the skip-domain list to avoid wasting resources on sniffing.

skip-domain: When the SNI field is content in the list, keep the Mapping result and do not use the sniffed content to overwrite the Mapping result (mainly to solve the problem of abnormal sniffing results caused by the SNI field of some sites not being a domain name, wildcards are supported).

In Clash, to implement domain routing, a mechanism called mapping is usually used, which maps IP addresses to corresponding domain names and then routes based on the domain name. This mapping relationship is usually added manually through a configuration file.

However, in some cases, the SNI field sent by the server during the handshake is not the domain name the client wants to access, causing the mapping result to not match the actual domain name, and accurate domain routing cannot be performed. At this time, Clash can sniff the domain name field in the handshake packet and restore the IP address to the correct domain name, thereby achieving precise domain routing.

The skip-domain option can be used to avoid sniffing certain specific SNI fields and keep the original mapping result,to solve the problem that the SNI field of some sites is not a domain namecausing abnormal sniffing results. The difference between sniffing results and mapping results is that mapping results are manually configured mappings from IP addresses to domain names, while sniffing results are the actual domain names obtained by parsing the SNI field in the handshake packet. For example, suppose the IP address of a site is 1.2.3.4, but its SNI field is example. com, while the domain name corresponding to this IP address in the manual configuration is abc. com. At this time, the sniffing result will restore 1.2.3.4 to example. com, thereby achieving precise domain routing.

Handshake packet

(Handshake Packet) refers to a type of data packet used in computer networks to establish a secure connection, usually in the SSL/TLS protocol. During the SSL/TLS handshake process, the client and server exchange handshake packets to negotiate encryption algorithms, generate keys, verify certificates, and other steps, thereby ensuring the confidentiality and integrity of communication.

In network communication, handshake packets usually contain important data such as identity authentication information of both communicating parties, encryption algorithms, and session keys. Therefore, in network security, handshake packets also play a very important role.

sni field

The SNI (Server Name Indication) field is an extension in the TLS protocol, used during the SSL/TLS handshake process to tell the server which domain name the client wants to access, so that the server can choose the correct certificate to provide to the client to complete the SSL/TLS connection.

Block HTTPDNS

HTTPDNS · VirgilClyne GetSomeFries Wiki

HTTPDNS bypasses local DNS settings, exposes the source IP, bypasses user routing and rule settings, and is not a standard protocol, increasing management and privacy risks. In contrast, DoH and DoT are standardized protocols that provide better privacy protection and security. HTTPDNS is not a protocol standardized by the IETF (Internet Engineering Task Force). Major HTTPDNS providers define their own interfaces and usage methods, lacking a unified standard, which increases the complexity of management and control.

HTTPDNS has the following problems

1. Bypasses system/router/VPN/local DNS (similar to DNS hijacking)
2. Exposes the source IP. Query requests are sent directly to the HTTPDNS server instead of through the local DNS server or VPN tunnel. This exposes the device real IP address to the HTTPDNS service provider, increasing the risk of privacy leakage.
3. Bypasses user routing and rule settings, directly obtains the IP address and connects, bypassing the domain routing and rule settings of the proxy tool
4. Special encryption and privacy risks**: Some HTTPDNS services may use special encryption algorithms and send more user privacy data. Because HTTPDNS service providers define their own interfaces and usage methods, these requests may contain more private information.
5. Advertising: Some mobile applications use HTTPDNS to bypass the advertising and tracker blocking rules set by users. By directly resolving and connecting to IP addresses, these applications can hide advertising and tracking requests, making user filtering rules ineffective

That is, directly obtaining the IP address through the domain name, without going through the DNS of openclash

Other

Clash causes a severe increase in standby power consumption of iPhones in the local network [Bug] Running OpenClash on the R2S bypass router severely increases the standby power consumption of iPhones in the local network · Issue #2614 · vernesong OpenClash

Client fingerprint

geo_ip

geosite The value can be one or more geographic location or site category names. The following are some common values:

• cn: Mainland China
• tw: Taiwan region
• hk: Hong Kong region
• jp: Japan
• kr: South Korea
• sg: Singapore
• my: Malaysia
• us: United States
• eu: Europe
• gfwlist: Website list based on GFWList
• google: Google websites and services
• facebook: Facebook websites and services
• twitter: Twitter websites and services

tun routing table

openclash/assets/tun模式(路由表)/image-20230315211231146.png In window clash tun mode, two routing entries are automatically added, and the network address covers all IPv4 addresses, which means taking over all network traffic. All traffic accessing the 198.18.0.1 interface is passed to the 198.18.0.2 gateway (the virtual network adapter address). To avoid loops, clash sets the egress to the physical network adapter

openclash/assets/tun模式(路由表)/image-20230315211608315.png

VPN encryption clearly states that it is VPN traffic, does not hide traffic characteristics well, and is very inconvenient for traffic splitting openclash/assets/tun模式(路由表)/image-20230315212518621.png

Windows 10 shows no network

Because fake-ip the returned address is a private IP, win10 the system default protection will consider DNS to be hijacked, causing it to show no network. To solve this, add fake-ip-filter, and return the real IP

UDP

Since UDP must use a real IP, fake-ip it will also initiate DNS requests and does not use fake IPs For example, YouTube with the QUIC protocol enabled will initiate UDP requests, eventually causing DNS leaks

Since udp is stateless, redirect it cannot help us obtain the original IP

will use tproxy Afterward, OpenClash can obtain the target IP and will perform proxying

Enhanced mode: redirect+tproxy Mixed mode: redirect+tun

Local programs will output directly and cannot be proxied, openclash will be rerouted before routing

tun mode, create a virtual network adapter

Traffic will first be forwarded to tun network adapter, whileopenclash can directly from tun read data tproxy Many problems may occur with proxying

Send to proxy server

Encrypt and send to node server

Assume server IP and port 3.3.3.3:8838

# +multiple domain levels before the number,*can only have one domain level
*.lan
*.localdomain
*.example
*.invalid
*.localhost
*.test
*.local
*.home.arpa
#Allow NTP services
time.*.com
time.*.gov
time.*.edu.cn
time.*.apple.com
time-ios.apple.com
time1.*.com
time2.*.com
time3.*.com
time4.*.com
time5.*.com
time6.*.com
time7.*.com
ntp.*.com
ntp1.*.com
ntp2.*.com
ntp3.*.com
ntp4.*.com
ntp5.*.com
ntp6.*.com
ntp7.*.com
*.time.edu.cn
*.ntp.org.cn
+.pool.ntp.org
time1.cloud.tencent.com
#Allow NetEase Cloud Music
music.163.com
*.music.163.com
*.126.net
#Baidu Music
musicapi.taihe.com
music.taihe.com
#Kugou Music
songsearch.kugou.com
trackercdn.kugou.com
#Kuwo Music
*.kuwo.cn
#JOOX Music
api-jooxtt.sanook.com
api.joox.com
joox.com
#QQ Music
y.qq.com
*.y.qq.com
streamoc.music.tc.qq.com
mobileoc.music.tc.qq.com
isure.stream.qqmusic.qq.com
dl.stream.qqmusic.qq.com
aqqmusic.tc.qq.com
amobile.music.tc.qq.com
#Xiami Music
*.xiami.com
#Migu Music
*.music.migu.cn
music.migu.cn
#QQ Login
localhost.ptlogin2.qq.com
localhost.sec.qq.com
+.qq.com
+.tencent.com
#Game
#Nintendo Switch
+.srv.nintendo.net
*.n.n.srv.nintendo.net
#Sony PlayStation
+.stun.playstation.net
#Microsoft Xbox
xbox.*.*.microsoft.com
*.*.xboxlive.com
xbox.*.microsoft.com
xnotify.xboxlive.com
#Wotgame
+.battlenet.com.cn
+.wotgame.cn
+.wggames.cn
+.wowsgame.cn
+.wargaming.net
#Golang
proxy.golang.org
#STUN  Game Service
stun.*.*
stun.*.*.*
+.stun.*.*
+.stun.*.*.*
+.stun.*.*.*.*
+.stun.*.*.*.*.*
#Linksys Router
heartbeat.belkin.com
*.linksys.com
*.linksyssmartwifi.com
#ASUS Router
*.router.asus.com
#Apple Software Update Service
mesu.apple.com
swscan.apple.com
swquery.apple.com
swdownload.apple.com
swcdn.apple.com
swdist.apple.com
#Google
lens.l.google.com
stun.l.google.com
#Netflix
+.nflxvideo.net
#FinalFantasy XIV Worldwide Server & CN Server
*.square-enix.com
*.finalfantasyxiv.com
*.ffxiv.com
*.ff14.sdo.com
ff.dorado.sdo.com
#Bilibili
*.mcdn.bilivideo.cn
#Disney Plus
+.media.dssott.com
#shark007 Codecs 
shark007.net
#Mijia
Mijia Cloud
#China Merchants Bank
+.cmbchina.com
+.cmbimg.com
#AdGuard
local.adguard.org
#Xunlei
+.sandai.net
+.n0808.com
#game
+.tfogc.com
+.qpic.cn
+.cdn-go.cn
*.douyucdn.cn:
+.gtimg.com
+.ra2.com
+.ramboplay.com
+.douyucdn.cn:
+.wegame.com.cn
+.wegame.gtimg.com
+.anticheatexpert.com
+.qq.com
+.ra2ol.com
+.trace.qq.com
+.ramboplay.com
## The download itself needs to return real IP
+.vsean.net
+.github.com
+.kujiale.cn
+.kujiale.com
+.supes.top
#win10 Local connection detection
+.msftconnecttest.com
+.msftncsi.com
+.edu.cn
#Ali
+.aliyundrive.com
+.aliyundrive.net
+.aliyun.com
#Plugin
+.jsdelivr.net
+.jsdelivr.net
+.fastgit.org
+.githubusercontent.com
+.jaist.ac.jp
#12306
+.12306.cn
+.95306.cn
+.95572.com
+.china-railway.com.cn
+.china-ric.com
+.crct.com
+.cre.cn
+.crecc.com.cn
+.creip.cn
+.crscl.com.cn
+.gzrailway.com.cn
+.nntlj.com
+.peoplerail.com
+.rails.cn
+.tdpress.com
 +.xboxlive.com
+ .msftconnecttest.com
+.msftncsi.com
+.xbox.ipv6.microsoft.com
+.riotcdn.com