SOCKS Proxy Not Working with Forwarding Rules

[kkkgo]

I have configured dnscrypt-proxy with a SOCKS5 proxy and forwarding rules using the following settings:

proxy = 'socks5://10.0.0.3:1080'
force_tcp = true
forwarding_rules = 'forwarding-rules.txt'

Regular DNS queries are correctly routed through the SOCKS5 proxy as expected. However, when using the forwarding_rules file to specify domain names and rules, the forwarded queries to the server do not go through the SOCKS5 proxy. Since the forwarded server can only be accessed through the SOCKS proxy, this prevents the results from being returned.

[jedisct1]

Forwarding was mainly designed to resolve local domains; send queries to a local router, AD server, Docker container or a company DNS server that is required to resolve non-public zones.

For all these use cases, we do not want to use a SOCKS proxy, as a remote proxy is unlikely to be able to reach local servers.

Forwarding some zones via SOCKS can be implemented, but that has to be distinct from the global proxy configuration. We need to add another setting and invent a way in the forwarding file to express what zones should use a direct route, and which ones have to go through a proxy.

[lifenjoiner]

As far as I can tell:

1. Like other rule lists, it is an exception to the main process. Explained above.
2. Plain protocol leaks your privacy, even using proxies.
3. public-resolvers.md has a google DoH entry. It must be blocked strictly by IP and SNI, I guess.
4. Forwarding to sdns won't help either, in item 3 scenario.
5. People have their preference for some servers. But, when limited, you might as well try others, maybe there will be good results.
6. If you insist using those servers, a solution I can tell currently: create a new instance serving with the specified server only, and using a proxy, and then forward to the new instance. Other tools may support proxying plain DNS, if you don't mind privacy leaking.
7. Mentioned in item 3, nowadays blocking is much more advanced. Even you get a correct IP, it won't work anymore. There is DPI blocking by SNI, TLS fingerprints, and even by TLS in TLS patterns.

[kkkgo]

My actual scenario is as follows:

• 1. I need to forward DNS queries from one of my own domains to an authoritative server to obtain real-time results. This does not involve any privacy breaches.
• 2. Due to censorship reasons in my current network, I am unable to connect to the authoritative server directly.
• 3. However, I have access to an encrypted tunnel that allows me to bypass censorship and map out a SOCKS5 port for local program usage.
• 4. Therefore, I'm hoping to use this tunnel to forward DNS queries.

I've already raised an issue on #2441 . If there's a way to enhance the existing rules to support this scenario, it would be greatly appreciated!

[lifenjoiner]

to an authoritative server to obtain real-time results

dnscrypt-proxy is not a recursive resolver. Does this help?

[kkkgo]

Based on my understanding, forwarding a specific domain to an authoritative DNS server does not necessarily require functioning as a recursive resolver service. dnscrypt-proxy can achieve this by simply forwarding according to the rules set in the plugin. In fact, there is a similar scenario described in this reply: #2394 (comment)

[lifenjoiner]

OK. Special case.
Normally, users don't know which authoritative server holds the answer for the domain he/she wants.