有时，我们所在单位的电脑只允许上内网，外网被断掉了，如果想要同时上内外网，我们可以通过修改路由表，然后双网卡一机两网的方式来实现分流上网，例如网线连公司内网，用WiFi连接自己的手机热点，或者额外购买一个USB网卡插入电脑，同时连接公司的AP和自己手机热点。
但是这样会衍生出一个问题，有些公司的内部系统例如OA系统等，也是通过域名而不是难以记忆的IP地址来访问的，这些内部系统的域名不是注册商注册的，更不在公共DNS上，而是公司内网上使用的内网域名，使用公司自建的内网DNS服务器才能解析，解析出通常是一个本地局域网地址，在公网无法解析和访问，当接入公司内网，企业路由器会通过DHCP下发内网DNS给网卡，现在同时上内外网时，外网网卡也会获得运营商下发的外网DNS地址，操作系统会按照跃点数只选择某个网卡上获得的的DNS用作DNS解析，如果默认了内网网卡优先，且内网DNS只解析公司内网域名，同样会导致外网无法访问，如果内网DNS能解析外部域名，同样存在利用DNS屏蔽某些网站或服务（例如影视剧，游戏，向日葵远控等）甚至后台偷偷记录DNS解析记录的可能，因此为了保险起见，我们可以自己用代码实现一个DNS代理服务器来进行代理和分流，根据特定后缀等特征判断出内网域名，交给内网DNS解析，对于外网域名则直接选择一些公共DNS来解析（例如谷歌，阿里，114的DNS服务）
这里采用Java实现一个多线程的DNS代理服务器，对于内网域名直接通过内网DNS的UDP:53进行解析，对于外网域名则以加密的DOH（DNS Over Https）方式通过阿里云DNS进行解析，并解析DNS服务器返回的报文并打印日志。需要依赖dnsjava这个类库的支持，程序启动后，只需要将网卡DNS服务器地址和备用地址修改为127.0.0.1和127.0.0.2即可实现DNS的分流。
<dependencies>
<!-- DNS 处理库 -->
<dependency>
<groupId>dnsjava</groupId>
<artifactId>dnsjava</artifactId>
<version>3.6.0</version>
</dependency>
<!-- HTTP 客户端（用于DoH请求） -->
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>5.3</version>
</dependency>
</dependencies>package com.changelzj.dns;
import org.apache.hc.core5.http.ContentType;
import org.xbill.DNS.*;
import org.apache.hc.client5.http.classic.methods.HttpPost;
import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
import org.apache.hc.client5.http.impl.classic.HttpClients;
import org.apache.hc.core5.http.io.entity.ByteArrayEntity;
import java.io.ByteArrayInputStream;
import java.io.DataInputStream;
import java.io.IOException;
import java.net.DatagramPacket;
import java.net.DatagramSocket;
import java.net.InetAddress;
import java.nio.charset.StandardCharsets;
import java.time.Duration;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.concurrent.*;
public class LoggedDnsServer {
/**
* 需要内网DNS才能解析的内网域名
*/
private static final String[] INTERNAL_DOMAINS = {"p****c.com", "s******c.com"};
/**
* 内网NDS服务器IP地址
*/
private static final String INTERNAL_DNS = "10.249.35.11";
private static final String DOH_URL = "https://223.5.5.5/dns-query";
private static final ExecutorService executor = new ThreadPoolExecutor(
Runtime.getRuntime().availableProcessors() * 2,
Runtime.getRuntime().availableProcessors() * 2,
60L,
TimeUnit.SECONDS,
new LinkedBlockingQueue<>(200),
new ThreadPoolExecutor.CallerRunsPolicy()
);
public static void main(String[] args) throws IOException {
DatagramSocket socket = new DatagramSocket(53);
System.out.println("Multi-threaded DNS Server with Logging started on port 53");
byte[] buffer = new byte[512];
while (true) {
DatagramPacket requestPacket = new DatagramPacket(buffer, buffer.length);
socket.receive(requestPacket);
byte[] requestData = new byte[requestPacket.getLength()];
System.arraycopy(requestPacket.getData(), 0, requestData, 0, requestPacket.getLength());
executor.submit(() -> {
Instant start = Instant.now();
String domain = "";
String method = "";
boolean success = false;
String ip = "";
try {
Message query = new Message(requestData);
domain = query.getQuestion().getName().toString(true).toLowerCase();
byte[] responseData;
if (isInternalDomain(domain)) {
method = "Internal DNS (" + INTERNAL_DNS + ")";
responseData = forwardToUdpDns(query, INTERNAL_DNS);
} else {
method = "Ali DNS DoH (" + DOH_URL + ")";
responseData = forwardToDoh(query);
}
success = true;
ip = parseDnsResponse(responseData).toString();
DatagramPacket responsePacket = new DatagramPacket(
responseData,
responseData.length,
requestPacket.getAddress(),
requestPacket.getPort()
);
socket.send(responsePacket);
} catch (Exception e) {
System.err.println("[ERROR] " + e.getMessage());
} finally {
long ms = Duration.between(start, Instant.now()).toMillis();
System.out.printf(
"[%s] %s -> %s | %s | %s | %dms | %s %n",
requestPacket.getAddress().getHostAddress(),
domain,
method,
success ? "OK" : "FAIL",
ip,
ms,
Thread.currentThread().getName()
);
}
});
}
}
private static boolean isInternalDomain(String domain) {
for (String suffix : INTERNAL_DOMAINS) {
if (domain.endsWith(suffix)) {
return true;
}
}
return false;
}
private static byte[] forwardToUdpDns(Message query, String dnsServer) throws IOException {
SimpleResolver resolver = new SimpleResolver(dnsServer);
resolver.setTCP(false);
resolver.setTimeout(3);
Message response = resolver.send(query);
return response.toWire();
}
private static byte[] forwardToDoh(Message query) throws IOException {
try (CloseableHttpClient client = HttpClients.createDefault()) {
HttpPost post = new HttpPost(DOH_URL);
post.setHeader("Content-Type", "application/dns-message");
post.setEntity(new ByteArrayEntity(query.toWire(), ContentType.create("application/dns-message")));
return client.execute(post, httpResponse -> {
try (java.io.InputStream in = httpResponse.getEntity().getContent();
java.io.ByteArrayOutputStream bos = new java.io.ByteArrayOutputStream()) {
byte[] buf = new byte[1024];
int len;
while ((len = in.read(buf)) != -1) {
bos.write(buf, 0, len);
}
return bos.toByteArray();
}
});
}
}
public static List<String> parseDnsResponse(byte[] msg) throws Exception {
List<String> result = new ArrayList<>();
int pos = 0;
// 头部 12 字节
pos += 4; // ID + Flags
int qdCount = ((msg[pos] & 0xFF) << 8) | (msg[pos + 1] & 0xFF); pos += 2;
int anCount = ((msg[pos] & 0xFF) << 8) | (msg[pos + 1] & 0xFF); pos += 2;
int nsCount = ((msg[pos] & 0xFF) << 8) | (msg[pos + 1] & 0xFF); pos += 2;
int arCount = ((msg[pos] & 0xFF) << 8) | (msg[pos + 1] & 0xFF); pos += 2;
// 跳过 Question 区
for (int i = 0; i < qdCount; i++) {
// 读 QNAME（支持压缩指针）
pos = readName(msg, pos, null);
pos += 4; // QTYPE + QCLASS
}
int rrCount = anCount + nsCount + arCount;
for (int i = 0; i < rrCount; i++) {
pos = readName(msg, pos, null);
int type = ((msg[pos] & 0xFF) << 8) | (msg[pos + 1] & 0xFF); pos += 2;
pos += 2; // CLASS
pos += 4; // TTL
int rdlen = ((msg[pos] & 0xFF) << 8) | (msg[pos + 1] & 0xFF); pos += 2;
if (type == 1 && rdlen == 4) { // A
byte[] addr = Arrays.copyOfRange(msg, pos, pos + 4);
result.add(InetAddress.getByAddress(addr).getHostAddress());
} else if (type == 28 && rdlen == 16) { // AAAA
byte[] addr = Arrays.copyOfRange(msg, pos, pos + 16);
result.add(InetAddress.getByAddress(addr).getHostAddress());
}
pos += rdlen;
}
return result;
}
// 工具：读取域名（含压缩指针），返回新的 pos
private static int readName(byte[] msg, int pos, StringBuilder out) {
int jumpedPos = -1;
while (true) {
int len = msg[pos] & 0xFF;
if ((len & 0xC0) == 0xC0) { // 压缩
int ptr = ((len & 0x3F) << 8) | (msg[pos + 1] & 0xFF);
if (jumpedPos == -1) jumpedPos = pos + 2;
pos = ptr;
continue;
}
pos++;
if (len == 0) break;
if (out != null) {
if (out.length() > 0) out.append('.');
out.append(new String(msg, pos, len, StandardCharsets.ISO_8859_1));
}
pos += len;
}
return jumpedPos != -1 ? jumpedPos : pos;
}
}
同样的功能，python也可以实现
import socket
import threading
from dnslib import DNSRecord, QTYPE, RR
# --- 核心配置 ---
LISTEN_IP = '0.0.0.0' # 监听所有网卡
LISTEN_PORT = 53
INTERNAL_DNS = '10.249.35.11'
EXTERNAL_DNS = '114.114.114.114'
TARGET_DOMAINS = ['pc**.com', 'si*.com']
def should_use_internal(domain_name):
domain = domain_name.rstrip('.').lower()
for target in TARGET_DOMAINS:
if domain == target or domain.endswith('.' + target):
return True
return False
def handle_request(data, addr, server_sock):
try:
request = DNSRecord.parse(data)
query_domain = str(request.q.qname)
query_type = QTYPE[request.q.qtype]
# --- 策略 1: 屏蔽 IPv6 查询 (AAAA) ---
if query_type == 'AAAA':
reply = request.reply()
# 直接返回空结果（无错误，但没记录），强制客户端尝试 IPv4
server_sock.sendto(reply.pack(), addr)
print(f"[屏蔽 IPv6] {query_domain}")
return
# --- 策略 2: 分流判断 ---
upstream = INTERNAL_DNS if should_use_internal(query_domain) else EXTERNAL_DNS
# 转发请求给上游
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as proxy_sock:
proxy_sock.settimeout(2.5)
proxy_sock.sendto(data, (upstream, 53))
try:
raw_reply, _ = proxy_sock.recvfrom(4096)
# --- 策略 3: 二次过滤返回报文中的 IPv6 记录 ---
reply_record = DNSRecord.parse(raw_reply)
# 只保留 A 记录 (IPv4) 和 CNAME 记录
reply_record.rr = [r for r in reply_record.rr if QTYPE[r.rtype] in ['A', 'CNAME']]
server_sock.sendto(reply_record.pack(), addr)
print(f"[IPv4 转发] {query_domain} -> {upstream}")
except socket.timeout:
print(f"[超时] 上游 {upstream} 未响应 {query_domain}")
except Exception as e:
print(f"[错误] {e}")
def start_proxy():
# Windows 环境下建议先尝试绑定 127.0.0.1
server_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
try:
server_sock.bind((LISTEN_IP, LISTEN_PORT))
print(f"DNS 代理已就绪...")
print(f"监听地址: {LISTEN_IP}:{LISTEN_PORT}")
print(f"内网解析: {TARGET_DOMAINS} -> {INTERNAL_DNS}")
print(f"外网解析: 其他 -> {EXTERNAL_DNS}")
except PermissionError:
print("!!! 权限不足: 请右键使用'管理员身份'运行 CMD/PyCharm !!!")
return
except Exception as e:
print(f"启动失败: {e}")
return
while True:
try:
data, addr = server_sock.recvfrom(512)
threading.Thread(target=handle_request, args=(data, addr, server_sock), daemon=True).start()
except:
pass
if __name__ == '__main__':
start_proxy()此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。