[{"data":1,"prerenderedAt":149},["ShallowReactive",2],{"content:\u002Ffiddling\u002Fmore-accurate-chnroute":3,"surround:\u002Ffiddling\u002Fmore-accurate-chnroute":140},{"id":4,"title":5,"body":6,"categories":114,"date":116,"description":117,"draft":118,"extension":119,"image":120,"meta":121,"navigation":123,"path":124,"permalink":120,"published":120,"readingTime":125,"recommend":120,"references":120,"seo":130,"sitemap":131,"stem":132,"tags":133,"type":138,"__hash__":139},"content\u002Fposts\u002Ffiddling\u002Fmore-accurate-chnroute.md","更精确的基于 BGP 的国内外 IP 分流",{"type":7,"value":8,"toc":111},"minimark",[9,24,35,54,60,63,69,72,77,85,88,96,99,102,108],[10,11,12,13,18,19,23],"p",{},"此前折腾过两节的透明代理方案：",[14,15,17],"a",{"href":16},"\u002Ffiddling\u002Fdebian-as-bypass-router","debian 旁路由方案"," 和 ",[14,20,22],{"href":21},"\u002Ffiddling\u002Ffake-ip-based-transparent-proxy","基于 FakeIP 的透明代理分流","，家里的透明代理基本已经可用了。基于 FakeIP 的方案使用 FakeIP 标记国外 IP，并在主路由识别并进行分流。sing-box 的 dns 模块配置为",[25,26,32],"pre",{"className":27,"code":29,"language":30,"meta":31},[28],"language-json","{\n  \"dns\": {\n    \"servers\": [\n      ...\n    ],\n    \"rules\": [\n      ...\n      {\n        \"server\": \"local\",\n        \"rewrite_ttl\": 10,\n        \"type\": \"logical\",\n        \"mode\": \"and\",\n        \"rules\": [\n          {\n            \"rule_set\": [\n              \"geosite-geolocation-!cn\" \u002F\u002F [!code highlight]\n            ],\n            \"invert\": true\n          },\n          {\n            \"rule_set\": [\n              \"geosite-cn\", \u002F\u002F [!code highlight]\n              \"geosite-category-companies@cn\", \u002F\u002F [!code highlight]\n              \"geoip-cn\" \u002F\u002F [!code highlight]\n            ]\n          }\n        ]\n      },\n      {\n        \"server\": \"dns-fakeip\",\n        \"rewrite_ttl\": 1,\n        \"query_type\": [\n          \"A\",\n          \"AAAA\"\n        ]\n      }\n    ],\n    \"strategy\": \"ipv4_only\",\n    \"fakeip\": {\n      \"enabled\": true,\n      \"inet4_range\": \"198.18.0.0\u002F15\"\n    }\n  }\n}\n","json","",[33,34,29],"code",{"__ignoreMap":31},[10,36,37,38,41,42,45,46,49,50,53],{},"这个 dns 分流规则基于规则集：当域名不在 ",[33,39,40],{"code":40},"geosite-geolocation-!cn"," 中，且域名在 ",[33,43,44],{"code":44},"geosite-cn"," 或者 ",[33,47,48],{"code":48},"geosite-category-companies@cn","，或域名解析出的 ip 在 ",[33,51,52],{"code":52},"geoip-cn"," 中时，认为是国内流量，返回 RealIP，否则返回 FakeIP",[10,55,56,57,59],{},"这种判断方式十分粗糙，且不说这几个域名规则集只能囊括一些常见域名，ip 规则集 ",[33,58,52],{"code":52}," 是基于 MaxMind 的 GeoLite2 数据库，来自于 WHOIS 数据库，大部分情况只代表这个 IP 被哪个机构注册使用，但无从知晓该 IP 被用在何处，尤其是 CN-IP，十分不准确",[10,61,62],{},"正好，最近了解到了 BGP。抄一点科普如下",[64,65,66],"blockquote",{},[10,67,68],{},"边界网关协议（Border Gateway Protocol，BGP）是一种用来在路由选择域之间交换网络层可达性信息（Network Layer Reachability Information，NLRI）的路由选择协议。由于不同的管理机构分别控制着他们各自的路由选择域，因此，路由选择域经常被称为自治系统 AS（Autonomous System）。现在的 Internet 是一个由多个自治系统相互连接构成的大网络，BGP 作为事实上的 Internet 外部路由协议标准，被广泛应用于 ISP（Internet Service Provider）之间。",[10,70,71],{},"基于 BGP，所有路由到中国的流量都会由国内 AS 声明，那么只要收集到国内全部 AS 声明的 IP list，就是一份更加准确的 CN-IP 了",[64,73,74],{},[10,75,76],{},"根据中国具体国情、维基百科，能够直接与国际互联网建立 BGP Session 只有三大运营商、教育网和科技网",[10,78,79,80],{},"网上有很多教程教你如何自己运营一个 AS，由此拉到一张完整的 BGP 表。但是作为懒狗（拿来主义），我找到 Github 上其实已经有一些基于 BGP 的 CN-IP list。本篇基于这个项目：",[14,81,82],{"href":82,"rel":83},"https:\u002F\u002Fgithub.com\u002Fgaoyifan\u002Fchina-operator-ip\u002Fblob\u002Fip-lists\u002Fchina.txt",[84],"nofollow",[10,86,87],{},"有了 list，下面就是 code time！",[25,89,94],{"className":90,"code":92,"language":93,"meta":31},[91],"language-bash","#!\u002Fbin\u002Fbash\n\n# 定义变量\nURL=\"https:\u002F\u002Fraw.githubusercontent.com\u002Fgaoyifan\u002Fchina-operator-ip\u002Frefs\u002Fheads\u002Fip-lists\u002Fchina.txt\"\nIPSET_NAME=\"allowed_ips\"\n\n# 下载新的 IP 列表\ncurl -o \u002Ftmp\u002Fip-list.txt \"$URL\" || { echo \"下载 IP 列表失败\"; exit 1; }\n\n# 清空现有的 ipset 集合\nipset flush $IPSET_NAME\n\n# 重新创建 ipset 集合（如果不存在则创建）\nipset create $IPSET_NAME hash:net -exist\n\n# 添加局域网地址到集合\nipset add $IPSET_NAME 0.0.0.0\u002F8\nipset add $IPSET_NAME 127.0.0.0\u002F8\nipset add $IPSET_NAME 10.0.0.0\u002F8\nipset add $IPSET_NAME 172.16.0.0\u002F12\nipset add $IPSET_NAME 192.168.0.0\u002F16\nipset add $IPSET_NAME 169.254.0.0\u002F16\nipset add $IPSET_NAME 224.0.0.0\u002F4\nipset add $IPSET_NAME 240.0.0.0\u002F4\n\n# 读取 IP 列表并添加到 ipset 集合\nwhile IFS= read -r ip\ndo\n    # 如果行为空或注释行，则跳过\n    if [ -z \"$ip\" ] || [[ $ip == \\#* ]]; then\n        continue\n    fi\n    ipset add $IPSET_NAME $ip\ndone \u003C \u002Ftmp\u002Fip-list.txt\n\n# 清理临时文件\nrm \u002Ftmp\u002Fip-list.txt\n\n# 创建自定义链\niptables -t mangle -N NO_FORWARD\n\n# 配置 iptables：将流量引导到自定义链，并基于逻辑规则返回或标记\niptables -t mangle -A PREROUTING -j NO_FORWARD\n\n# 在自定义链中配置规则\niptables -t mangle -A NO_FORWARD -s 192.168.7.2 -j RETURN\niptables -t mangle -A NO_FORWARD -m set --match-set $IPSET_NAME dst -j RETURN\niptables -t mangle -A NO_FORWARD -j MARK --set-mark 1\n\n# 设置路由以标记的流量转发到 192.168.7.2\nip rule add fwmark 1 table 100\nip route add default via 192.168.7.2 table 100\n","bash",[33,95,92],{"__ignoreMap":31},[10,97,98],{},"代码注释很完全，不做过多解释",[10,100,101],{},"如果你的路由系统是 OpenWRT，需要额外安装 bash、ipset、iptables 等，OpenWRT 的默认 shell 是 ash，无法运行此脚本",[25,103,106],{"className":104,"code":105,"language":93,"meta":31},[91],"opkg update\nopkg install bash\nopkg install curl\nopkg install ipset\nopkg install iptables\n",[33,107,105],{"__ignoreMap":31},[10,109,110],{},"这份 CN-IP 一天更新一次，可以设置一个定时任务一天执行一次这个脚本，并把这个脚本添加到启动项中",{"title":31,"searchDepth":112,"depth":112,"links":113},4,[],[115],"折腾","2024-10-07 16:51:00","基于 BGP 的国内外 IP 分流方案，提升了透明代理的效率和精准度。通过对国外 IP 进行 FakeIP 标记，主路由能够更智能地进行流量分流，确保网络连接的顺畅性。sing-box 的 DNS 模块配置也进行了相应优化，使得在处理 DNS 请求时，更加灵活且高效，进一步提升整体网络体验。",false,"md",null,{"slots":122},{},true,"\u002Ffiddling\u002Fmore-accurate-chnroute",{"text":126,"minutes":127,"time":128,"words":129},"5 min read",4.99,299400,998,{"title":5,"description":117},{"loc":124},"posts\u002Ffiddling\u002Fmore-accurate-chnroute",[115,134,135,136,137],"软路由","透明代理","分流","BGP","tech","oVnWKJ0LSfculYi50d_iaDi7teNorGy9vDcIwnezm_M",[141,144],{"title":22,"path":21,"stem":142,"date":143,"type":138,"children":-1},"posts\u002Ffiddling\u002Ffake-ip-based-transparent-proxy","2024-08-16 23:53:00",{"title":145,"path":146,"stem":147,"date":148,"type":138,"children":-1},"实现 OPNsense 透明代理+分流","\u002Ffiddling\u002Fopnsense-transparent-proxy","posts\u002Ffiddling\u002Fopnsense-transparent-proxy","2025-01-16 23:09:00",1787554444551]