Configuration · Clash documentation

Clash DNS

Understand how Clash DNS connects nameserver, fallback, fake-ip, nameserver-policy, and IPv6 so you can diagnose poisoned responses, routing mistakes, and local-domain failures.

Read the articleBack to documentation home
  • fake-ip
  • DNS pollution
  • SCRIPT
  • GEOIP
  • IP-CIDR
Configuration

Because some parts of Clash operate at layer 3, the network layer, their packets do not expose domain names and therefore cannot use rule-based routing.

Enter fake-ip: It enables rule-based routing, minimizes the impact of DNS poisoning attacks, and can improve network performance—sometimes significantly.

fake-ip

The concept of a “fake IP” comes from RFC 3089:

A "fake IP" address serves as a key for looking up the corresponding "FQDN" information.

The default CIDR for the fake-ip pool is 198.18.0.1/16, a reserved IPv4 address range that can be changed in dns.fake-ip-range.

When a DNS request reaches Clash DNS, the Clash core assigns an unused fake-ip address from the pool while maintaining an internal mapping between domain names and their fake-ip addresses.

Consider a browser visiting http://google.com.

  1. The browser asks Clash DNS for the IP address of google.com

  2. Clash checks its internal mapping and returns 198.18.1.5

  3. The browser sends an HTTP request to port 80/tcp at 198.18.1.5

  4. When Clash receives an inbound packet for 198.18.1.5, it consults its internal mapping and discovers that the client is actually sending the packet to google.com

  5. Results vary by rule.

    1. Clash may send only the domain name to an outbound proxy such as SOCKS5 or shadowsocks and establish the connection through that proxy server

    2. Alternatively, Clash may look up the real IP address of google.com using the SCRIPT, GEOIP, or IP-CIDR rules, or through the DIRECT outbound

Because this concept can be confusing, consider accessing http://google.com with cURL:

txt
$ curl -v http://google.com
<---- cURL 向您的系统 DNS (Clash) 询问 google.com 的 IP 地址
----> Clash 决定使用 198.18.1.70 作为 google.com 的 IP 地址, 并记住它
*   Trying 198.18.1.70:80...
<---- cURL 连接到 198.18.1.70 tcp/80
----> Clash 将立即接受连接, 并且..
* Connected to google.com (198.18.1.70) port 80 (#0)
----> Clash 在其内存中查找到 198.18.1.70 对应于 google.com
----> Clash 查询对应的规则, 并通过匹配的出口发送数据包
> GET / HTTP/1.1
> Host: google.com
> User-Agent: curl/8.0.1
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Location: http://www.google.com/
< Content-Type: text/html; charset=UTF-8
< Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-ahELFt78xOoxhySY2lQ34A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
< Date: Thu, 11 May 2023 06:52:19 GMT
< Expires: Sat, 10 Jun 2023 06:52:19 GMT
< Cache-Control: public, max-age=2592000
< Server: gws
< Content-Length: 219
< X-XSS-Protection: 0
< X-Frame-Options: SAMEORIGIN
<
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
* Connection #0 to host google.com left intact
Previous articleRulesNext articleConfiguration Reference