精简 Dnsmasq 参数

02.PVE初始化配置.md

@@ -164,10 +164,7 @@ $ apt full-upgrade
 $ apt update
 
 ## 安装系统软件
-$ apt install btop lm-sensors unzip neovim tmux unattended-upgrades powermgmt-base
-
-## 安装网络工具
-$ apt install iperf iperf3 iftop sshguard openvswitch-switch
+$ apt install btop lm-sensors tmux neovim unzip unattended-upgrades powermgmt-base sshguard
 
 ## 安装 CPU 调度调整工具
 $ apt install linux-cpupower
@@ -175,6 +172,12 @@ $ apt install linux-cpupower
 ## 根据 CPU 厂商安装 CPU 微码工具
 $ apt install intel-microcode (amd64-microcode)
 
+## 安装 Open vSwitch（可选）
+$ apt install openvswitch-switch
+
+## 安装网络检测工具（可选）
+$ apt install iftop iperf3 iperf
+
 ## 更新 PCI 数据库
 $ update-pciids
 ```

03.PVE系统调整.md

@@ -4,17 +4,14 @@
 
 在 PVE 系统调整之前，请确认必要的软件包已经安装完成，本文后续命令均在 SSH 终端下执行。  
 
-关于 [Neovim](https://neovim.io/) 的基础使用方法，请参阅：[Neovim 基本操作](https://www.bing.com/search?q=neovim+%E5%9F%BA%E6%9C%AC%E6%93%8D%E4%BD%9C) 。  
+关于 [Neovim](https://neovim.io/) 的基础使用方法，请参阅：[Neovim 基础教程](https://cn.bing.com/search?q=Neovim+%E5%9F%BA%E7%A1%80%E6%95%99%E7%A8%8B) 。  
 
 ```bash
 ## 同步镜像仓库
 $ apt update
 
 ## 安装系统软件
-$ apt install btop lm-sensors unzip neovim tmux unattended-upgrades powermgmt-base
-
-## 安装网络工具
-$ apt install iperf iperf3 iftop sshguard openvswitch-switch
+$ apt install btop lm-sensors tmux neovim unzip unattended-upgrades powermgmt-base sshguard
 
 ## 安装 CPU 调度调整工具
 $ apt install linux-cpupower
@@ -22,6 +19,12 @@ $ apt install linux-cpupower
 ## 根据 CPU 厂商安装 CPU 微码工具
 $ apt install intel-microcode (amd64-microcode)
 
+## 安装 Open vSwitch（可选）
+$ apt install openvswitch-switch
+
+## 安装网络检测工具（可选）
+$ apt install iftop iperf3 iperf
+
 ## 更新 PCI 数据库
 $ update-pciids
 ```

05.PVE制作虚拟机模板.md

@@ -155,13 +155,16 @@ $ sudo apt full-upgrade
 
 ```bash
 ## 安装系统软件
-$ sudo apt install qemu-guest-agent zsh git btop tmux logrotate cron nftables sshguard neovim
+$ sudo apt install qemu-guest-agent btop tmux logrotate cron neovim zsh git
 
 ## 安装系统自动更新工具
 $ sudo apt install unattended-upgrades powermgmt-base python3-gi
 
 ## 安装网络工具
-$ sudo apt install iperf iperf3 iftop lsof knot-dnsutils
+$ sudo apt install nftables sshguard lsof knot-dnsutils
+
+## 安装网络检测工具（可选）
+$ sudo apt install iftop iperf3 iperf
 
 ## 写入磁盘
 $ sudo sync
@@ -198,7 +201,7 @@ $ cd && rm -rvf ohmyzsh .bash_history .zsh_history .shell.pre-oh-my-zsh
 $ sudo nvim /etc/sysctl.d/99-sysctl.conf
 ```
 
-在配置文件末尾输入以下配置项，注意配置中间的空格。  
+在配置文件中添加以下配置项，注意配置中间的空格。  
 
 ```bash
 # This configuration file is customized by fox,
@@ -208,7 +211,6 @@ kernel.panic = 20
 kernel.panic_on_oops = 1
 
 net.core.default_qdisc = fq_codel
-net.ipv4.tcp_congestion_control = cubic
 
 # Other adjustable system parameters
 
@@ -225,6 +227,7 @@ net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fastopen = 3
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
+net.ipv4.tcp_max_syn_backlog = 512
 net.ipv4.tcp_notsent_lowat = 131072
 net.ipv4.tcp_rmem = 4096 87380 26214400
 net.ipv4.tcp_wmem = 4096 16384 655360
@@ -238,7 +241,7 @@ net.ipv6.conf.default.use_tempaddr = 0
 
 ```bash
 ## 让内核参数生效
-$ sudo sysctl -f
+$ sudo sysctl --system
 ```
 
 ### 1.6.调整系统时间

06.PVE制作DNS服务器.md

@@ -216,10 +216,10 @@ $ mkdir -p /tmp/SmartDNS
 $ cd /tmp/SmartDNS
 
 ## 下载 SmartDNS 安装包
-$ curl -LR -O https://github.com/pymumu/smartdns/releases/download/Release46/smartdns.1.2024.06.12-2222.x86_64-linux-all.tar.gz
+$ curl -LR -O https://github.com/pymumu/smartdns/releases/download/Release46.1/smartdns.1.2025.03.02-1533.x86_64-linux-all.tar.gz
 
 ## 解压缩 SmartDNS 安装包
-$ tar zxf smartdns.1.2024.06.12-2222.x86_64-linux-all.tar.gz
+$ tar zxf smartdns.*.x86_64-linux-all.tar.gz
 
 ## 进入安装包目录
 $ cd smartdns
@@ -252,7 +252,7 @@ $ sudo systemctl enable smartdns.service
 $ sudo mkdir -p /etc/smartdns.d
 
 ## 下载广告规则配置文件
-$ sudo curl -LR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
+$ sudo curl -LR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
 ```
 
 `SmartDNS` 的加速规则通过 `bash` 脚本安装，脚本生成的配置文件位于 `/etc/smartdns.d` 目录。  
@@ -287,7 +287,7 @@ $ sudo crontab -e
 ```bash
 ## 定时任务配置项
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
 
 30 9 * * * /usr/bin/systemctl restart smartdns.service
 
@@ -298,7 +298,7 @@ $ sudo crontab -e
 ```bash
 ## 定时任务配置项
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
 
 30 9 * * * /usr/bin/bash /opt/smartdns-plugin.sh
 ```
@@ -358,13 +358,14 @@ $ sudo nvim /etc/smartdns/smartdns.conf
 conf-file /etc/smartdns.d/*.conf
 
 log-level notice
+log-console yes
 
 bind [::]:6053@lo
 bind-tcp [::]:6053@lo
 
 cache-size 32768
 max-query-limit 1024
-max-reply-ip-num 24
+max-reply-ip-num 16
 
 prefetch-domain yes
 
@@ -377,10 +378,6 @@ rr-ttl-min 60
 rr-ttl-max 28800
 rr-ttl-reply-max 14400
 
-server 172.16.1.1 -group intranet -exclude-default-group
-nameserver /internal/intranet
-domain-rules /internal/ -speed-check-mode none -no-cache
-
 server-tcp 180.184.1.1 -bootstrap-dns
 server-tcp 114.114.114.114 -bootstrap-dns
 server-tcp 2400:3200::1 -bootstrap-dns
@@ -444,7 +441,6 @@ domain-needed
 no-hosts
 no-negcache
 no-resolv
-no-round-robin
 rebind-localhost-ok
 stop-dns-rebind
 
@@ -465,9 +461,7 @@ server=/test/
 # DNS Server
 
 server=/fox.internal/172.16.1.1
-
 server=127.0.0.1#6053
-server=::1#6053
 
 ```
 

07.PVE制作TS服务器.md

@@ -126,17 +126,20 @@ $ sudo apt full-upgrade
 
 ```bash
 ## 安装系统软件
-$ sudo apt install qemu-guest-agent zsh git btop tmux logrotate cron nftables sshguard neovim
+$ sudo apt install qemu-guest-agent btop tmux logrotate cron neovim zsh git
 
 ## 安装系统自动更新工具
 $ sudo apt install unattended-upgrades powermgmt-base python3-gi
 
 ## 安装网络工具
-$ sudo apt install iperf iperf3 iftop lsof knot-dnsutils dnsmasq conntrack
+$ sudo apt install dnsmasq conntrack nftables sshguard lsof knot-dnsutils
 
 ## 安装 TS
 $ sudo apt install tailscale
 
+## 安装网络检测工具（可选）
+$ sudo apt install iftop iperf3 iperf
+
 ## 写入磁盘
 $ sudo sync
 ```
@@ -189,7 +192,7 @@ nf_conntrack
 $ sudo nvim /etc/sysctl.d/99-sysctl.conf
 ```
 
-在配置文件末尾输入以下配置项，注意配置中间的空格。  
+在配置文件中添加以下配置项，注意配置中间的空格。  
 
 ```bash
 # This configuration file is customized by fox,
@@ -239,13 +242,15 @@ net.ipv4.route.error_cost = 100
 net.ipv4.route.redirect_load = 2
 net.ipv4.route.redirect_silence = 2048
 
+net.ipv4.tcp_adv_win_scale = -2
 net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fastopen = 3
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
+net.ipv4.tcp_max_syn_backlog = 512
 net.ipv4.tcp_notsent_lowat = 131072
-net.ipv4.tcp_rmem = 4096 87380 26214400
-net.ipv4.tcp_wmem = 4096 16384 655360
+net.ipv4.tcp_rmem = 8192 262144 536870912
+net.ipv4.tcp_wmem = 4096 16384 536870912
 
 net.ipv6.conf.all.accept_redirects = 0
 net.ipv6.conf.default.accept_redirects = 0
@@ -266,7 +271,7 @@ net.netfilter.nf_conntrack_tcp_timeout_established = 7440
 
 ```bash
 ## 让内核参数生效
-$ sudo sysctl -f
+$ sudo sysctl --system
 ```
 
 ### 1.7.调整系统时间
@@ -539,7 +544,7 @@ cache-size=2048
 max-cache-ttl=7200
 fast-dns-retry=1800
 
-interface=eth0
+interface=eth0,tailscale0
 rebind-domain-ok=/fox.internal/
 
 bind-dynamic
@@ -548,7 +553,6 @@ domain-needed
 no-hosts
 no-negcache
 no-resolv
-no-round-robin
 rebind-localhost-ok
 stop-dns-rebind
 
@@ -569,9 +573,7 @@ server=/test/
 # DNS Server
 
 server=/ts.net/100.100.100.100
-
 server=/fox.internal/172.16.1.1
-
 server=172.16.1.1
 
 ```

src/debian/debian_dns_99_sysctl.conf

@@ -5,7 +5,6 @@ kernel.panic = 20
 kernel.panic_on_oops = 1
 
 net.core.default_qdisc = fq_codel
-net.ipv4.tcp_congestion_control = cubic
 
 # Other adjustable system parameters
 
@@ -22,6 +21,7 @@ net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fastopen = 3
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
+net.ipv4.tcp_max_syn_backlog = 512
 net.ipv4.tcp_notsent_lowat = 131072
 net.ipv4.tcp_rmem = 4096 87380 26214400
 net.ipv4.tcp_wmem = 4096 16384 655360

src/debian/debian_dns_dnsmasq.conf

@@ -22,7 +22,6 @@ domain-needed
 no-hosts
 no-negcache
 no-resolv
-no-round-robin
 rebind-localhost-ok
 stop-dns-rebind
 
@@ -43,7 +42,5 @@ server=/test/
 # DNS Server
 
 server=/fox.internal/172.16.1.1
-
 server=127.0.0.1#6053
-server=::1#6053
 

src/debian/debian_dns_smartdns.conf

@@ -16,13 +16,14 @@
 conf-file /etc/smartdns.d/*.conf
 
 log-level notice
+log-console yes
 
 bind [::]:6053@lo
 bind-tcp [::]:6053@lo
 
 cache-size 32768
 max-query-limit 1024
-max-reply-ip-num 24
+max-reply-ip-num 16
 
 prefetch-domain yes
 
@@ -35,10 +36,6 @@ rr-ttl-min 60
 rr-ttl-max 28800
 rr-ttl-reply-max 14400
 
-server 172.16.1.1 -group intranet -exclude-default-group
-nameserver /internal/intranet
-domain-rules /internal/ -speed-check-mode none -no-cache
-
 server-tcp 180.184.1.1 -bootstrap-dns
 server-tcp 114.114.114.114 -bootstrap-dns
 server-tcp 2400:3200::1 -bootstrap-dns

src/debian/debian_dns_smartdns_cron.conf

@@ -1,14 +1,14 @@
 # This configuration file is customized by fox,
 # Optimize SmartDNS crontab for local DNS server.
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
 
 30 9 * * * /usr/bin/systemctl restart smartdns.service
 
 
 ## Or when the smartdns plugin is installed
 
-20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/neodevhost.smartdns.conf https://neodev.team/lite_smartdns.conf
+20 9 * * * /usr/bin/curl --retry-connrefused --retry 5 --retry-delay 5 --retry-max-time 60 -fsSLR -o /etc/smartdns.d/anti-ad.smartdns.conf https://anti-ad.net/anti-ad-for-smartdns.conf
 
 30 9 * * * /usr/bin/bash /opt/smartdns-plugin.sh
 

src/debian/debian_ts_99_sysctl.conf

@@ -45,13 +45,15 @@ net.ipv4.route.error_cost = 100
 net.ipv4.route.redirect_load = 2
 net.ipv4.route.redirect_silence = 2048
 
+net.ipv4.tcp_adv_win_scale = -2
 net.ipv4.tcp_challenge_ack_limit = 1000
 net.ipv4.tcp_fastopen = 3
 net.ipv4.tcp_fin_timeout = 30
 net.ipv4.tcp_keepalive_time = 120
+net.ipv4.tcp_max_syn_backlog = 512
 net.ipv4.tcp_notsent_lowat = 131072
-net.ipv4.tcp_rmem = 4096 87380 26214400
-net.ipv4.tcp_wmem = 4096 16384 655360
+net.ipv4.tcp_rmem = 8192 262144 536870912
+net.ipv4.tcp_wmem = 4096 16384 536870912
 
 net.ipv6.conf.all.accept_redirects = 0
 net.ipv6.conf.default.accept_redirects = 0

src/debian/debian_ts_dnsmasq.conf

@@ -13,7 +13,7 @@ cache-size=2048
 max-cache-ttl=7200
 fast-dns-retry=1800
 
-interface=eth0
+interface=eth0,tailscale0
 rebind-domain-ok=/fox.internal/
 
 bind-dynamic
@@ -22,7 +22,6 @@ domain-needed
 no-hosts
 no-negcache
 no-resolv
-no-round-robin
 rebind-localhost-ok
 stop-dns-rebind
 
@@ -43,8 +42,6 @@ server=/test/
 # DNS Server
 
 server=/ts.net/100.100.100.100
-
 server=/fox.internal/172.16.1.1
-
 server=172.16.1.1
 

src/debian/debian_ts_nftables.conf

@@ -25,38 +25,34 @@ table inet router {
 
     chain input {
         type filter hook input priority filter; policy drop;
-        ct state established,related accept comment "defconf: handle inbound flows"
         iif "lo" accept comment "defconf: accept traffic from loopback"
-        ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
+        ct state vmap { established : accept, related : accept } comment "defconf: handle inbound flows"
+        tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "defconf: rate limit new TCP connections"
         iifname "eth0" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
         iifname "tailscale0" jump input_tailscale comment "tsconf: handle TS IPv4 / IPv6 input traffic"
     }
 
     chain forward {
         type filter hook forward priority filter; policy drop;
-        ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
+        ct state established,related flow add @ft;
+        ct state vmap { established : accept, related : accept } comment "defconf: handle forwarded flows"
         iifname "eth0" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
         iifname "tailscale0" jump forward_tailscale comment "tsconf: handle TS IPv4 / IPv6 forward traffic"
     }
 
     chain output {
         type filter hook output priority filter; policy accept;
-        ct state established,related accept comment "defconf: handle outbound flows"
         oif "lo" accept comment "defconf: accept traffic towards loopback"
+        ct state vmap { established : accept, related : accept } comment "defconf: handle outbound flows"
         oifname "eth0" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
         oifname "tailscale0" jump output_tailscale comment "tsconf: handle TS IPv4 / IPv6 output traffic"
     }
 
     chain syn_flood {
-        limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
+        limit rate 50/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
         counter drop comment "defconf: drop excess new TCP connections"
     }
 
-    chain handle_offload {
-        flow add @ft comment "defconf: track forwarded flows"
-        accept
-    }
-
     chain input_lan {
         ct status dnat accept comment "lanconf: accept port redirect"
         jump accept_from_lan
@@ -111,7 +107,7 @@ table inet router {
 
     chain dstnat {
         type nat hook prerouting priority dstnat; policy accept;
-        iifname "eth0" meta l4proto { tcp, udp } th dport domain jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
+        iifname { "eth0", "tailscale0" } meta l4proto { tcp, udp } th dport domain jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
     }
 
     chain srcnat {