Network Security on 9Insomniehttps://9insomnie.github.io/tags/network-security/Recent content in Network Security on 9InsomnieHugoen-us<a href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank" rel="noopener">CC BY-NC 4.0</a>Wed, 07 Jan 2026 10:40:41 +0800DNS 泄露防护全指南：从系统到应用的层层防护方案https://9insomnie.github.io/posts/2026/01/dns-%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E5%85%A8%E6%8C%87%E5%8D%97%E4%BB%8E%E7%B3%BB%E7%BB%9F%E5%88%B0%E5%BA%94%E7%94%A8%E7%9A%84%E5%B1%82%E5%B1%82%E9%98%B2%E6%8A%A4%E6%96%B9%E6%A1%88/Wed, 07 Jan 2026 10:00:00 +0800https://9insomnie.github.io/posts/2026/01/dns-%E6%B3%84%E9%9C%B2%E9%98%B2%E6%8A%A4%E5%85%A8%E6%8C%87%E5%8D%97%E4%BB%8E%E7%B3%BB%E7%BB%9F%E5%88%B0%E5%BA%94%E7%94%A8%E7%9A%84%E5%B1%82%E5%B1%82%E9%98%B2%E6%8A%A4%E6%96%B9%E6%A1%88/<p>DNS泄露是指在使用代理或VPN时，DNS查询未通过加密隧道，而是直接发送到本地ISP的DNS服务器，导致真实IP和访问记录暴露。以下是从系统到应用的多层防护方案：</p> <hr> <h2 id="一代理vpn工具层配置最有效">一、代理/VPN工具层配置（最有效）</h2> <h3 id="1-启用tun模式强烈推荐"><strong>1. 启用TUN模式（强烈推荐）</strong></h3> <p>这是防止DNS泄露最彻底的方法，适用于Clash Verge、Surge等工具：</p> <ul> <li><strong>原理</strong>：创建虚拟网卡，强制所有流量（包括DNS）经过代理隧道</li> <li><strong>操作</strong>：在软件主界面开启&quot;TUN模式&quot;，安装虚拟网卡驱动即可</li> </ul> <h3 id="2-配置加密dns服务器"><strong>2. 配置加密DNS服务器</strong></h3> <p>在代理工具的配置文件中设置DNS：</p> <div class="highlight"><pre tabindex="0" style="color:#d0d0d0;background-color:#202020;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span><span style="color:#999;font-style:italic"># Clash Verge配置示例</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#6ab825;font-weight:bold">dns</span>:<span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span><span style="color:#6ab825;font-weight:bold">enable</span>:<span style="color:#666"> </span><span style="color:#6ab825;font-weight:bold">true</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span><span style="color:#6ab825;font-weight:bold">nameserver</span>:<span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span>- <span style="color:#3677a9">8.8.8.8</span><span style="color:#666"> </span><span style="color:#999;font-style:italic"># 常规DNS</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span>- <span style="color:#3677a9">114.114.114.114</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span><span style="color:#6ab825;font-weight:bold">fallback</span>:<span style="color:#666"> </span><span style="color:#999;font-style:italic"># 加密DNS作为备用</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span>- tls://1.1.1.1 <span style="color:#666"> </span><span style="color:#999;font-style:italic"># DoT加密</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span>- tls://8.8.8.8<span style="color:#666"> </span></span></span></code></pre></div><h3 id="3-强制所有查询走代理"><strong>3. 强制所有查询走代理</strong></h3> <div class="highlight"><pre tabindex="0" style="color:#d0d0d0;background-color:#202020;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-yaml" data-lang="yaml"><span style="display:flex;"><span><span style="color:#6ab825;font-weight:bold">dns</span>:<span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span><span style="color:#6ab825;font-weight:bold">default-nameserver</span>:<span style="color:#666"> </span><span style="color:#999;font-style:italic"># 指定最终查询服务器</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span>- tls://1.1.1.1<span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span><span style="color:#6ab825;font-weight:bold">proxy-server-nameserver</span>:<span style="color:#666"> </span><span style="color:#999;font-style:italic"># 代理节点解析用DNS</span><span style="color:#666"> </span></span></span><span style="display:flex;"><span><span style="color:#666"> </span>- <span style="color:#3677a9">8.8.8.8</span><span style="color:#666"> </span></span></span></code></pre></div><hr> <h2 id="二操作系统层配置">二、操作系统层配置</h2> <h3 id="windows-11-配置dns-over-tls-dot"><strong>Windows 11 配置DNS over TLS (DoT)</strong></h3> <ol> <li> <p><strong>设置→网络→网卡→DNS分配→编辑</strong></p> <ul> <li>首选DNS：<code>1.1.1.1</code></li> <li>备选DNS：<code>1.0.0.1</code></li> <li><strong>DoH设置为&quot;关闭&quot;</strong>（关键步骤）</li> </ul> </li> <li> <p><strong>管理员CMD/PowerShell执行</strong>：</p> </li> </ol> <div class="highlight"><pre tabindex="0" style="color:#d0d0d0;background-color:#202020;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-powershell" data-lang="powershell"><span style="display:flex;"><span><span style="color:#999;font-style:italic"># 开启全局DoT加密</span> </span></span><span style="display:flex;"><span>netsh dns add global dot=yes </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#999;font-style:italic"># 指定加密服务器（IP替换为你设置的DNS）</span> </span></span><span style="display:flex;"><span>netsh dns add encryption server=<span style="color:#3677a9">1.1</span>.1.1 dothost=<span style="color:#a61717;background-color:#e3d2d2">:</span> autoupgrade=yes </span></span><span style="display:flex;"><span> </span></span><span style="display:flex;"><span><span style="color:#999;font-style:italic"># 刷新DNS缓存</span> </span></span><span style="display:flex;"><span>ipconfig /flushdns </span></span></code></pre></div><h3 id="macos--linux"><strong>macOS / Linux</strong></h3> <ul> <li><strong>修改<code>/etc/resolv.conf</code></strong>：</li> </ul> <div class="highlight"><pre tabindex="0" style="color:#d0d0d0;background-color:#202020;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span><span style="color:#999;font-style:italic"># 仅使用加密DNS</span> </span></span><span style="display:flex;"><span>nameserver 1.1.1.1 </span></span><span style="display:flex;"><span>nameserver 8.8.8.8 </span></span></code></pre></div><ul> <li><strong>安装Stubby或dnscrypt-proxy</strong>实现系统级DoT/DoH</li> </ul> <hr> <h2 id="三浏览器层配置">三、浏览器层配置</h2> <h3 id="firefox"><strong>Firefox</strong></h3> <div class="highlight"><pre tabindex="0" style="color:#d0d0d0;background-color:#202020;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-plaintext" data-lang="plaintext"><span style="display:flex;"><span>地址栏输入 about:config </span></span><span style="display:flex;"><span>搜索 network.trr.mode 设置为 2 (强制DoH) </span></span><span style="display:flex;"><span>搜索 network.trr.uri 设置为 https://1.1.1.1/dns-query </span></span></code></pre></div><h3 id="chromeedge"><strong>Chrome/Edge</strong></h3> <div class="highlight"><pre tabindex="0" style="color:#d0d0d0;background-color:#202020;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-plaintext" data-lang="plaintext"><span style="display:flex;"><span>设置→隐私和安全→安全→使用安全DNS </span></span><span style="display:flex;"><span>选择&#34;自定义&#34;，填入：https://1.1.1.1/dns-query </span></span></code></pre></div><hr> <h2 id="四网络层配置路由器">四、网络层配置（路由器）</h2> <p>在OpenWRT等路由器上部署DNS加密：</p>