Skip to content

fix(client): make ACL domain lists take effect reliably - #641

Open
lsr00ter wants to merge 1 commit into
immortalwrt:devfrom
lsr00ter:fix-exclude-china-domain-rules
Open

fix(client): make ACL domain lists take effect reliably#641
lsr00ter wants to merge 1 commit into
immortalwrt:devfrom
lsr00ter:fix-exclude-china-domain-rules

Conversation

@lsr00ter

@lsr00ter lsr00ter commented Jul 5, 2026

Copy link
Copy Markdown

Summary

Fix ACL domain list changes not reliably taking effect in client mode.

This updates the proxy/direct domain list handling so that:

  • LuCI detects proxy/direct domain list-only edits and triggers Apply/Restart.
  • Proxy domain list rules are actually added to sing-box route rules.
  • Direct domain list entries populate the WAN direct nft set through dnsmasq, matching the existing proxy list behavior.

Root Cause

The proxy/direct domain lists are stored in files under /etc/homeproxy/resources/, not directly as UCI list values. When only those files changed, LuCI could write the new content but still not mark the HomeProxy config as changed, so Apply/Restart was not triggered.

There were also two runtime gaps:

  • proxy-domain rule sets could be generated without a matching route rule.
  • direct_list.txt generated sing-box domain rules, but did not generate dnsmasq nftset= rules, so transparent routing could still only see the resolved IP and fall through to mode defaults.

Changes

  • Store checksums for proxy/direct domain list content in UCI so LuCI detects ACL-only edits.
  • Add a route rule for proxy-domain to main-out.
  • Generate dnsmasq nftset= rules for direct_list.txt to populate:
    • homeproxy_wan_direct_addr_v4
    • homeproxy_wan_direct_addr_v6 when IPv6 is enabled

Validation

Tested on ImmortalWrt with bypass_mainland_china and redirect_tproxy mode.

Verified that:

  • ACL domain list edits trigger Apply/Restart.
  • Direct domains resolve through the configured direct DNS path.
  • Resolved direct-domain IPs are added to homeproxy_wan_direct_addr_v4.
  • Traffic to those IPs returns/directs before default proxy routing.
  • Proxy-domain DNS still resolves through main-dns via main-out.

Local checks:

sh -n root/etc/init.d/homeproxy
node --check htdocs/luci-static/resources/view/homeproxy/client.js
git diff --check origin/dev...HEAD

@1715173329 1715173329 added the AI-generated This issue/PR is AI-generated. label Jul 5, 2026
@lsr00ter
lsr00ter changed the base branch from master to dev July 5, 2026 12:27
@1715173329

Copy link
Copy Markdown
Member

This so called fix doesn't make sense at all.

@lsr00ter

lsr00ter commented Jul 5, 2026

Copy link
Copy Markdown
Author

This so called fix doesn't make sense at all.

It will trigger a working reload after change the Proxy/Direct Domain List and save/apply, not like before, always shows nothing change

@lsr00ter
lsr00ter force-pushed the fix-exclude-china-domain-rules branch from 2a4a7df to 305e861 Compare July 5, 2026 16:34
Ensure always-proxy domains are routed before fallback handling in non-custom modes, while preserving dedicated UDP routing precedence.

Make resource-backed ACL file edits update checksum fields under the control section so LuCI has a real UCI change to apply and homeproxy reloads after saving.
@lsr00ter
lsr00ter force-pushed the fix-exclude-china-domain-rules branch from 6e4a99f to 1a32fca Compare July 7, 2026 09:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AI-generated This issue/PR is AI-generated.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants