openclash-dnsfix

name	openclash-dnsfix
description	Diagnose and fix DNS leaks in iKuai + iStoreOS + OpenClash bypass-gateway networks. Use when the user mentions iKuai, iStoreOS, OpenClash, DNS leak tests, BrowserLeaks, IPLeak, fake-ip, firewall redirect, or client devices that should route through OpenClash.

OpenClash DNSFix

Safety Contract

• Default to read-only evidence until the user explicitly approves router changes.
• Never store or echo router passwords, dashboard secrets, subscription URLs, UUIDs, proxy passwords, or private keys in reports.
• Preserve client topology: do not change the user's Mac Clash/VPN path, iKuai gateway, DHCP pools, or OpenClash proxy groups unless the user specifically asks.
• Before any write, record rollback: UCI export path, modified files, exact settings changed, and restart impact.

Workflow

1. Confirm topology:

   • iKuai LAN gateway, usually 192.168.31.1.
   • iStoreOS/OpenClash gateway, usually 192.168.31.11.
   • Target client IP/MAC, DHCP gateway, and DNS.
   • Whether the current Mac is intentionally bypassing OpenClash. Completion: one current client is tied to one MAC, one IP, one router, and one DNS path.

2. Prove the leak:

   • Treat BrowserLeaks/IPLeak as user-device evidence.
   • A leak is present when page exit IP is proxy/VPS but DNS servers include ISP/mainland resolvers.
   • Separate stale screenshots from current client settings. Completion: classify the leak as client DHCP, OpenClash DNS upstream, DNS hijack, IPv6, or browser private DNS.

3. Audit OpenClash:

   • Prefer SSH/UCI for exact state when credentials are available.
   • Use scripts/audit-openclash-dns.sh for read-only checks.
   • Confirm generated runtime YAML, not only subscription source YAML. Completion: runtime dns: block and active DNS connections are known.

4. Fix only after approval:

   • Use Firewall Redirect for local DNS hijack.
   • Disable WAN/default DNS append.
   • Enable custom DNS overwrite and respect-rules.
   • Remove ISP/mainland resolvers from effective nameserver, fallback, nameserver-policy, and proxy-server-nameserver.
   • Disable IPv6 DNS unless the user explicitly needs IPv6 proxying. Completion: generated runtime DNS block has no ISP/mainland resolver entries.

5. Verify:

   • Restart OpenClash core once.
   • Query the router DNS directly for A and AAAA.
   • Inspect OpenClash connections for DNS upstreams.
   • Ask the user to rerun BrowserLeaks/IPLeak from the affected phone after toggling Wi-Fi. Completion: router-side DNS is clean and the user's browser test no longer shows ISP/mainland DNS.

References

• Read references/playbook.md for the full diagnosis matrix, fix details, and rollback plan.
• Use scripts/audit-openclash-dns.sh before changing anything.
• Use scripts/apply-openclash-dns-hardening.sh only after user approval.