防止DNS泄露配置

powershell
dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip

  # 0. 用于解析下面所有带域名的 DOH 的 DNS
  default-nameserver:
    - 119.29.29.29
    - 223.5.5.5

  # 1. 明确国内域名、apple，走阿里/腾讯
  nameserver-policy:
    "geosite:cn,private,apple":
      - https://doh.pub/dns-query
      - https://dns.alidns.com/dns-query
    "*.linux.do": "https://xxx.ddd.oaifree.com/query-dns"
    "linux.do": "https://xxx.ddd.oaifree.com/query-dns"

  # 2. 全局默认 DNS 换成国外，并加上 #RULES 强制走代理（分流规则），由于 1.1.1.1 不匹配任何规则，会走到 MATCH，从而让远程节点服务器进行 DNS 解析
  nameserver:
    - "https://1.1.1.1/dns-query#RULES"
    - "https://8.8.8.8/dns-query#RULES"

  # 3. 用于解析节点的域名的 DNS
  proxy-server-nameserver:
    - 119.29.29.29
    - 223.5.5.5

  # 4. 解析到最后发现是直连则走此 DNS
  direct-nameserver:
    - https://doh.pub/dns-query
    - https://dns.alidns.com/dns-query

  # 在 direct-nameserver 存在时，依然以 nameserver-policy 优先
  direct-nameserver-follow-policy: true

  fake-ip-range: 198.18.0.0/16
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "*.arpa"
    - "time.*.com"
    - "ntp.*.com"
    - "+.market.xiaomi.com"
    - "localhost.ptlogin2.qq.com"
    - "*.msftncsi.com"
    - "www.msftconnecttest.com"


rules:
  - GEOSITE,private,DIRECT # 局域网域名直连
  - GEOIP,private,DIRECT,no-resolve # 局域网 IP 直连
  - RULE-SET,Telegram,📲 电报消息
  - RULE-SET,Apple,🎯 全球直连
  - DOMAIN-SUFFIX,linux.do,🐧 Linux.do
  # 这一行可以放你自己喜欢的分流规则
  - GEOSITE,CN,🎯 全球直连
  - RULE-SET,AllProxy,🚀 节点选择
  - GEOIP,CN,🎯 全球直连 # 此处会发生一次 DNS 查询，这里真不能加 no-resolve，不然 QQ 看不了图片
  - MATCH,🚀 节点选择

rule-providers:
  Telegram:
    type: http
    behavior: classical
    url: "https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Telegram/Telegram_No_Resolve.yaml"
    format: yaml
    path: ./ruleset/Telegram.yaml
    interval: 86400

  Apple:
    type: http
    behavior: classical
    url: "https://cdn.jsdelivr.net/gh/ACL4SSR/ACL4SSR@master/Clash/Providers/Apple.yaml"
    format: yaml
    path: ./ruleset/Apple.yaml
    interval: 86400

  AllProxy:
    type: http
    behavior: domain
    url: "https://cdn.jsdelivr.net/gh/blackmatrix7/ios_rule_script@master/rule/Clash/Global/Global_Domain.yaml"
    format: yaml
    path: ./ruleset/AllProxy.yaml
    interval: 86400
来源：https://linux.do/t/topic/1999640
测试：https://browserleaks.com/dns
让Ai搓了一个cloudflare worker 项目：https://github.com/YPJCoding/clash-fusion
防止DNS泄露配置 ​

防止DNS泄露配置
