mirror of
https://github.com/paulmillr/encrypted-dns.git
synced 2026-05-23 01:09:41 +02:00
Big update: streamline and simplify everything.
This commit is contained in:
Paul Miller
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"code": "en",
|
||||
"name": "English",
|
||||
"table_columns": {
|
||||
"name": "Name",
|
||||
"region": "Region",
|
||||
"censorship": "Censorship",
|
||||
"notes": "Notes",
|
||||
"install_signed": "Install (Signed - Recommended)",
|
||||
"install_unsigned": "Install (unsigned)"
|
||||
},
|
||||
"yes": "Yes",
|
||||
"no": "No"
|
||||
}
|
||||
@@ -0,0 +1,104 @@
|
||||
<%LANGUAGES%>
|
||||
|
||||
# encrypted-dns-configs
|
||||
|
||||
Configuration profiles for [DNS over HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS) and [DNS over TLS](https://en.wikipedia.org/wiki/DNS_over_TLS). Check out the article for more info: [paulmillr.com/posts/encrypted-dns/](https://paulmillr.com/posts/encrypted-dns/).
|
||||
|
||||
To add a new provider, or edit an existing one, edit json files in `src` directory.
|
||||
|
||||
### Caveats
|
||||
|
||||
Known issues (we can't fix them, maybe Apple can):
|
||||
|
||||
1. Applications (e.g. Firefox in specific regions; App Store in all regions) can choose to ignore the system-level resolver and use their own.
|
||||
[Check out the discussion](https://github.com/paulmillr/encrypted-dns/issues/22).
|
||||
2. iCloud Private Relay, VPN clients & Little Snitch / LuLu will ignore the DNS profile.
|
||||
3. Command line tools that interact with DNS (e.g. `host`, `dig`, `nslookup`) won't use DoH -
|
||||
will use the DNS severs set in Network, or picked up from DHCP.
|
||||
4. [Wi-Fi captive portals](https://en.wikipedia.org/wiki/Captive_portal) in cafes, hotels, airports are exempted by Apple from eDNS rules; to simplify authentication - this is good
|
||||
5. TLS DNS is blocked more often by ISPs than HTTPS, because TLS uses non-standard port 853, which is easy to block.
|
||||
See [Google's article](https://security.googleblog.com/2022/07/dns-over-http3-in-android.html)
|
||||
|
||||
Check out [encrypted-dns over TOR](https://github.com/alecmuffett/dohot) if you need more privacy.
|
||||
|
||||
## Providers
|
||||
|
||||
`Censorship=yes` (also known as "filtering") means the profile will not send true information about `hostname=IP` relation for some hosts.
|
||||
|
||||
<%PROVIDERS_TABLE%>
|
||||
|
||||
## Installation
|
||||
|
||||
To make settings work across all apps in **iOS**, **iPadOS** & **macOS**, you'll need to install configuration profile. This profile would tell operating system to use DoH / DoT. Note: it's not enough to simply set server IPs in System Preferences — you need to install a profile.
|
||||
|
||||
iOS / iPadOS: Open the mobileconfig file in GitHub by using Safari (other browsers will just download the file and won't ask for installation), and then click/tap on "Allow" button. The profile should download. Go to **System Settings => General => VPN, DNS & Device Management**, select downloaded profile and tap the "Install" button.
|
||||
|
||||
macOS [(official docs)](https://support.apple.com/guide/mac-help/mh35561/):
|
||||
|
||||
1. Download and save the profile. After save, rename it to be in format: `NAME.mobileconfig`, not NAME.txt, or so
|
||||
2. Choose Apple menu > System Settings, click Privacy and Security in the sidebar, then click Profiles on the right. (You may need to scroll down.)
|
||||
You may be asked to supply your password or other information during installation.
|
||||
3. In the Downloaded section, double-click the profile.
|
||||
4. Review the profile contents then click Continue, Install or Enroll to install the profile.
|
||||
|
||||
If an earlier version of a profile is already installed on your Mac, the settings in the updated version replace the previous ones.
|
||||
|
||||
## Scope
|
||||
|
||||
There seems to be an [additional option](https://github.com/paulmillr/encrypted-dns/issues/22) that allows to use system-wide profiles. To try it, add this to mobileconfig file:
|
||||
|
||||
```xml
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
```
|
||||
|
||||
## Signed Profiles
|
||||
|
||||
In the `signed` folder we have signed versions of the profiles in this repository. These profiles have been signed by [@Xernium](https://github.com/Xernium) so that when you install the profiles,
|
||||
they will have a verified check box on the installation screen. It also ensures that these profiles have not been tampered with. However, since they were signed by a third party, they may lag behind their unsigned counterparts a little.
|
||||
The signature is valid until `2025-11-02`
|
||||
|
||||
Previous signatures by:
|
||||
[@Xernium](https://github.com/Xernium), replaced at `2024-11-01`
|
||||
|
||||
[@Candygoblen123](https://github.com/Candygoblen123), replaced at `2023-11-29`
|
||||
|
||||
[comment]: <> (We recommend that you install a signed profile instead of an unsigned profile because it ensures that it was not modified while it was downloading.)
|
||||
|
||||
To verify resolver IPs and hostnames, compare mobileconfig files to their documentation URLs. Internal workings of the profiles are described on [developer.apple.com](https://developer.apple.com/documentation/devicemanagement/dnssettings). In order to verify signed mobileconfigs, you will need to download them to your computer and open them in a text editor, because signing profiles makes GitHub think that they are binary files.
|
||||
|
||||
## On demand activation
|
||||
|
||||
You can optionally exclude some trusted Wi-Fi networks where you don't want to use encrypted DNS. To do so, add your SSIDs in the [OnDemandRules](https://github.com/paulmillr/encrypted-dns/blob/master/profiles/template-on-demand.mobileconfig#L22-L38) section inside the `PayloadContent` dictionary of a profile. Note: you can't edit signed profiles.
|
||||
|
||||
## Contributing a new profile
|
||||
|
||||
Profiles are generated from easily editable `.json` files. Check out `providers` directory to add or edit a new profile.
|
||||
|
||||
Copy an existing one and change its UUID, make sure you update README with new profile's info.
|
||||
|
||||
In addition to generating online, there are many other ways to generate a random UUID:
|
||||
|
||||
- Press `F12` to open DevTools in the browser, run this code in the console
|
||||
|
||||
```javascript
|
||||
crypto.randomUUID();
|
||||
```
|
||||
|
||||
- Run these commands in the macOS / Linux terminal
|
||||
|
||||
```sh
|
||||
# Works both in macOS & Linux
|
||||
uuidgen
|
||||
|
||||
# Works in Linux
|
||||
cat /proc/sys/kernel/random/uuid
|
||||
```
|
||||
|
||||
- Run this cmdlet in Powershell
|
||||
|
||||
```powershell
|
||||
New-Guid
|
||||
```
|
||||
|
||||
<%PROVIDERS_LINKS%>
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"code": "cmn-CN",
|
||||
"name": "简体中文",
|
||||
"table_columns": {
|
||||
"name": "名称",
|
||||
"region": "区域",
|
||||
"censorship": "审查",
|
||||
"notes": "备注",
|
||||
"install_signed": "安装 (已签名 - 推荐)",
|
||||
"install_unsigned": "安装 (未签名)"
|
||||
},
|
||||
"yes": "是",
|
||||
"no": "否"
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
<%LANGUAGES%>
|
||||
|
||||
# 加密 DNS 配置
|
||||
|
||||
[DNS over HTTPS](https://zh.wikipedia.org/wiki/DNS_over_HTTPS) 和 [DNS over TLS](https://zh.wikipedia.org/wiki/DNS_over_TLS) 的配置描述文件。查看这篇文章以获取更多信息：[paulmillr.com/posts/encrypted-dns/](https://paulmillr.com/posts/encrypted-dns/) 以及有关[提交新描述文件](#提交新描述文件)的信息。
|
||||
|
||||
### 注意事项
|
||||
|
||||
根据[谷歌这篇文章](https://security.googleblog.com/2022/07/dns-over-http3-in-android.html)的介绍，DoH 似乎比 DoT 的性能更优。
|
||||
|
||||
从 iOS 和 iPadOS 15.5 开始，为了简化咖啡厅、宾馆、机场等公共场所无线网络的身份认证，苹果将这些无线网络的[强制登录门户](https://zh.wikipedia.org/wiki/%E5%BC%BA%E5%88%B6%E9%97%A8%E6%88%B7)加入到了加密 DNS 排除规则中。这是个好消息，但还有一些其他问题我们无法修复，只有等苹果来解决：
|
||||
|
||||
- 无法启用加密 DNS：[Little Snitch & Lulu](https://github.com/paulmillr/encrypted-dns/issues/13)、[VPN](https://github.com/paulmillr/encrypted-dns/issues/18)
|
||||
- 部分流量绕过加密 DNS：[终端和 App Store](https://github.com/paulmillr/encrypted-dns/issues/22)、[Chrome 浏览器](https://github.com/paulmillr/encrypted-dns/issues/19)
|
||||
|
||||
如果你需要更进一步的隐私保护，请查看[使用 Tor 网络的加密 DNS](https://github.com/alecmuffett/dohot)。
|
||||
|
||||
## 供应商
|
||||
|
||||
“`审查=是`”表示描述文件不会发送某些主机“`主机名=IP`”关系的真实信息。
|
||||
|
||||
<%PROVIDERS_TABLE%>
|
||||
|
||||
## 安装
|
||||
|
||||
要使设置在 **iOS**、**iPadOS** 和 **macOS** 中所有的应用程序上生效，你需要安装配置描述文件。此文件将指引操作系统使用 DoH 或 DoT。注意：只在系统无线局域网设置中设置 DNS 服务器 IP 是不够的——你需要安装描述文件。
|
||||
|
||||
iOS / iPadOS：使用 Safari 浏览器（其他浏览器只会下载该文件，不会弹出安装提示）打开 GitHub 上的 mobileconfig 文件，然后点击“允许”按钮，描述文件将完成下载。打开 **系统设置 => 通用 => VPN、DNS 与设备管理**，选择已下载的描述文件并点击“安装”按钮。
|
||||
|
||||
macOS [（官方文档）](https://support.apple.com/zh-cn/guide/mac-help/mh35561/)：
|
||||
|
||||
1. 下载并保存描述文件，将其重命名为 `NAME.mobileconfig`，而不是 txt 之类的扩展名。
|
||||
2. 选取苹果菜单 >“系统设置”，点按边栏中的“隐私和安全性” ，然后点按右侧的“描述文件”。（你可能需要向下滚动。）
|
||||
安装期间，系统可能会要求你提供密码或其他信息。
|
||||
3. 在“已下载”部分中，连按描述文件。
|
||||
4. 检查描述文件内容，然后点按“继续”、“安装”或“注册”以安装描述文件。
|
||||
|
||||
如果 Mac 上已安装了较早版本的描述文件，其设置将替换为更新版本中的设置。
|
||||
|
||||
## 范围
|
||||
|
||||
这条[额外选项](https://github.com/paulmillr/encrypted-dns/issues/22)似乎可以让描述文件在系统全局范围生效。如果有兴趣尝试，请将下面的内容添加到 mobileconfig 文件中：
|
||||
|
||||
```xml
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
```
|
||||
|
||||
## 签名版描述文件
|
||||
|
||||
在 `signed` 文件夹中，存放了*稍微过时的*签名版描述文件。这些描述文件已由 [@Candygoblen123](https://github.com/Candygoblen123) 签名，因此当你安装时，界面上会有“已验证”的提示，此举还可确保这些描述文件未被篡改。但由于这些描述文件是交由第三方签名的，因此可能会稍微落后于未签名的版本。
|
||||
|
||||
[备注]: <> (我们建议安装签名版的描述文件，因为数字签名可以确保文件在下载时没有被修改。)
|
||||
|
||||
如要验证 DNS 解析器的 IP 和主机名，请将描述文件内容与其官方网站的文档进行比对，描述文件内部结构和属性在[苹果开发者网站](https://developer.apple.com/documentation/devicemanagement/dnssettings)上有详细讲解。如要验证签名版的描述文件，请将其下载到本地后用文本编辑器打开，因为 GitHub 会将签名版描述文件视为二进制文件而无法直接查看。
|
||||
|
||||
## 提交新描述文件
|
||||
|
||||
描述文件本质上是文本文件，将现有的描述文件复制一份并修改其 UUID 即可，请确保在本 README 文件中更新描述文件的相关信息。
|
||||
|
||||
随机 UUID 除了可以通过网站在线生成，还有很多其他获取方法：
|
||||
|
||||
- 在浏览器中按下 `F12` 打开“开发人员工具”，在控制台中运行这段代码
|
||||
|
||||
```javascript
|
||||
crypto.randomUUID();
|
||||
```
|
||||
|
||||
- 在 macOS / Linux 终端中运行此命令
|
||||
|
||||
```sh
|
||||
# 适用于 macOS 和 Linux
|
||||
uuidgen
|
||||
|
||||
# 适用于 Linux
|
||||
cat /proc/sys/kernel/random/uuid
|
||||
```
|
||||
|
||||
- 在 Powershell 中运行此命令
|
||||
|
||||
```powershell
|
||||
New-Guid
|
||||
```
|
||||
|
||||
<%PROVIDERS_LINKS%>
|
||||
@@ -0,0 +1,15 @@
|
||||
{
|
||||
"code": "cmn-TW",
|
||||
"name": "繁體中文",
|
||||
"emojiLength": 1,
|
||||
"table_columns": {
|
||||
"name": "名稱",
|
||||
"region": "區域",
|
||||
"censorship": "審查",
|
||||
"notes": "備註",
|
||||
"install_signed": "安裝連結",
|
||||
"install_unsigned": ""
|
||||
},
|
||||
"yes": "是",
|
||||
"no": "否"
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
<%LANGUAGES%>
|
||||
|
||||
# 加密 DNS 配置
|
||||
|
||||
[DNS over HTTPS](https://zh.wikipedia.org/zh-tw/DNS_over_HTTPS) 和 [DNS over TLS](https://zh.wikipedia.org/zh-tw/DNS_over_TLS) 的設定描述檔。查看這篇文章以獲取更多訊息：[paulmillr.com/posts/encrypted-dns/](https://paulmillr.com/posts/encrypted-dns/) 以及有關[提交新描述檔](#提交新描述檔)的訊息。
|
||||
|
||||
### 注意事項
|
||||
|
||||
根據 [Google 這篇文章](https://security.googleblog.com/2022/07/dns-over-http3-in-android.html)的介紹，DoH 似乎比 DoT 的性能更優。
|
||||
|
||||
從 iOS 和 iPadOS 15.5 開始，為了簡化咖啡館、飯店、機場等公共場所 Wi-Fi 的身份認證，蘋果將這些 Wi-Fi 的[強制網路門戶](https://zh.wikipedia.org/zh-tw/%E5%BC%BA%E5%88%B6%E9%97%A8%E6%88%B7)加入到了加密 DNS 豁免清單中。這是個好消息，但還有一些其他問題我們無法修復，只有等蘋果來解決：
|
||||
|
||||
- 無法啟用加密 DNS：[Little Snitch & Lulu](https://github.com/paulmillr/encrypted-dns/issues/13)、[VPN](https://github.com/paulmillr/encrypted-dns/issues/18)
|
||||
- 部分流量繞過加密 DNS：[終端機和 App Store](https://github.com/paulmillr/encrypted-dns/issues/22)、[Chrome 瀏覽器](https://github.com/paulmillr/encrypted-dns/issues/19)
|
||||
|
||||
如果你需要更進一步的隱私保護，請查看[使用 Tor 網路的加密 DNS](https://github.com/alecmuffett/dohot)。
|
||||
|
||||
## 供應商
|
||||
|
||||
「`審查=是`」意味著描述檔不會發送某些主機「`主機名=IP`」關係的真實訊息。
|
||||
|
||||
<%PROVIDERS_TABLE%>
|
||||
|
||||
## 安裝
|
||||
|
||||
要使設置在 **iOS**、**iPadOS** 和 **macOS** 中所有的應用程式上生效，你需要安裝設定描述檔。此文件將指引操作系統使用 DoH 或 DoT。注意：僅在系統 Wi-Fi 設定中設置 DNS 伺服器 IP 是不夠的——你需要安裝描述檔。
|
||||
|
||||
iOS / iPadOS：使用 Safari 瀏覽器（其他瀏覽器只會下載該文件，不會彈出安裝提示）打開 GitHub 上的 mobileconfig 文件，然後點擊「允許」按鈕，描述檔將完成下載。打開 **系統設定 => 一般 => VPN、DNS 與裝置管理**，選擇已下載的描述檔並點擊「安裝」按鈕。
|
||||
|
||||
macOS [（官方文檔）](https://support.apple.com/zh-tw/guide/mac-help/mh35561/)：
|
||||
|
||||
1. 下載並保存描述檔，將其重命名為 `NAME.mobileconfig`，而不是 txt 之類的副檔名。
|
||||
2. 選擇「蘋果」選單 >「系統設定」，按一下側邊欄中的「隱私權和安全性」，然後按一下右側的「描述檔」。（你可能需要向下捲動。）
|
||||
安裝期間，系統可能會要求你提供密碼或其他資訊。
|
||||
3. 在「已下載」區域中，按兩下描述檔。
|
||||
4. 檢視描述檔內容然後按一下「繼續」、「安裝」或「註冊」來安裝描述檔。
|
||||
|
||||
若 Mac 上已安裝描述檔的較早版本，則以上版本中的設定會取代先前的設定。
|
||||
|
||||
## 範圍
|
||||
|
||||
這條[額外選項](https://github.com/paulmillr/encrypted-dns/issues/22)似乎可以讓描述文件在系統全域範圍生效。如果有興趣嘗試，請將下面的內容添加到 mobileconfig 文件中：
|
||||
|
||||
```xml
|
||||
<key>PayloadScope</key>
|
||||
<string>System</string>
|
||||
```
|
||||
|
||||
## 簽署版描述檔
|
||||
|
||||
在 `signed` 文件夾中，存放了*稍微過時的*簽署版描述檔。這些描述檔已由 [@Candygoblen123](https://github.com/Candygoblen123) 簽署，因此當你安裝時，介面上會有「已驗證」的提示，此舉還可確保這些描述檔未被篡改。但由於這些描述檔是交由第三方簽署的，因此可能會稍微落後於未簽署的版本。
|
||||
|
||||
[備註]: <> (我們建議安裝簽署版的描述檔，因為數位簽章可以確保文件在下載時沒有被修改。)
|
||||
|
||||
如要驗證 DNS 解析器的 IP 和主機名，請將描述檔內容與其官方網站的文檔進行比對，描述檔內部結構和屬性在[蘋果開發人員網站](https://developer.apple.com/documentation/devicemanagement/dnssettings)上有詳細講解。如要驗證簽署版的描述檔，請將其下載到本地後用文字編輯器打開，因為 GitHub 會將簽署版描述檔視為二進位檔案而無法直接查看。
|
||||
|
||||
## 提交新描述檔
|
||||
|
||||
描述檔本質上是文字檔案，將現有的描述檔複製一份並修改其 UUID 即可，請確保在本 README 文件中更新描述檔的相關訊息。
|
||||
|
||||
隨機 UUID 除了可以通過網站在線生成，還有很多其他獲取方法：
|
||||
|
||||
- 在瀏覽器中按下 `F12` 打開“開發人員工具”，在主控台中執行這段程式碼
|
||||
|
||||
```javascript
|
||||
crypto.randomUUID();
|
||||
```
|
||||
|
||||
- 在 macOS / Linux 終端機中執行此指令
|
||||
|
||||
```sh
|
||||
# 適用於 macOS 和 Linux
|
||||
uuidgen
|
||||
|
||||
# 適用於 Linux
|
||||
cat /proc/sys/kernel/random/uuid
|
||||
```
|
||||
|
||||
- 在 Powershell 中執行此指令
|
||||
|
||||
```powershell
|
||||
New-Guid
|
||||
```
|
||||
|
||||
<%PROVIDERS_LINKS%>
|
||||
Reference in New Issue
Block a user