.hcb_wrap.hcb_wrap{–hcb–bgc:#0d1117;–hcb–c:#e6edf3;–hcb–ff:”Consolas”,” Menlo”, ”Courier New”, monospace; –hcb–data-label–bgc:#161b22; –hcb–data-label–c:#8b949e; –hcb–line-numbers–c:#484f58;–hcb–scbar-track–bgc:#161b2280;–hcb–scbar-thumb–bgc:#30363d}
.hcb_wrap.hcb_wrap>pre,.hcb_wrap.hcb_wrap>pre>code { background: #0d1117; color: #e6edf3; text-shadow: none!important; -webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;letter-spacing:0;font-weight:400!important}
.hcb_wrap :is(code,span){font-weight:400!important;font-style:normal!important;text-shadow:none!important}
.hcb_wrap .token.comment, .hcb_wrap .token.prolog, . hcb_wrap .token.doctype, .hcb_wrap .token.cdata, .hcb_wrap .token.punctuation { color: #8b949e }
.hcb_wrap .token.keyword, .hcb_wrap .token.boolean, .hcb_wrap .token.selector, .hcb_wrap .token.tag { color: #ff7b72 }
.hcb_wrap .token.string, .hcb_wrap .token.attr-value, .hcb_wrap .token.char { color: #a5d6ff }
.hcb_wrap .token.function, .hcb_wrap .token.class-name { color: #d2a8ff }
.hcb_wrap .token.number, .hcb_wrap .token.constant, .hcb_wrap .token.symbol, hcb_wrap .token.operator, hcb_wrap .token.entity, hcb_wrap .token.url { color: #79c0ff; background: transparent }
.hcb_wrap .token.property, .hcb_wrap .token.attr-name, .hcb_wrap .token.atrule, .hcb_wrap .token.keyword.def { color: #7ee787 }
.hcb_wrap .token.variable, .hcb_wrap .token.regex, .hcb_wrap .token.important { color: #ffa657 }
.hcb_wrap .hcb-clipboard { opacity: .85 }
When accessing the internet via a VPN, the accuracy of DNS resolution affects not only speed but also privacy and security. Have you ever encountered the following situation:
- OpenClash's Fake-IP Mode Failed？
- DNS Ad Blocking Incomplete？
- Caching and Traffic Distribution in MosDNS Not as expected？
Don't worry—after extensive testing and real-world debugging, I've put together a closed-loop DNS architecture:The OpenClash + AdGuardHome + MosDNS trio comprehensively optimizes DNS resolution, ad blocking, and caching efficiency。
✅ What problems does this solution address?
- Fake-IP mode is now active again, to improve the efficiency of proxy resolution;
- More thorough and effective ad blocking, to ensure nothing slips through the cracks;
- MosDNS as a Caching Relay, to improve the resolution response speed;
- Building a Complete DNS Closed-Loop Connection, to mitigate the risks of pollution and leaks.
???? Core logic of the data flow:
Client → OpenClash redirection → AdGuardHome ad blocking → MosDNS caching → OpenClash re-evaluation → Upstream DNSThe biggest highlight of this setup is:Make OpenClash the central hub for DNS decisions...only then will Fake-IP truly take effect; all caching and ad filtering revolve around it.
???? Brief Configuration Guide:
- OpenClash: Enable Fake-IP and listen on port 7874 to serve as the first and final DNS hub;
- AdGuard Home: Listens on port 533; focuses on ad filtering; does not participate in traffic routing;
- MosDNS: Listen on port 5335; perform only caching and relaying, and let OpenClash determine whether traffic is outgoing or incoming.
???? A complete and detailed configuration guide and hands-on tutorial have been published:
Feel free to bookmark and share this post to help more soft router enthusiasts avoid common pitfalls!
Related Reading:
- Guide to Clients for Accessing the Internet via Proxy
- DNS Unlock Tutorial
- Remote Desktop Configuration
The Proper Boundaries of Responsibilities for the Three-Part Set
| Components | Primary Responsibilities | Tasks That Should Not Be Undertaken |
|---|---|---|
| OpenClash | Proxy Redirection, Fake-IP Mapping, and Rule Evaluation | Do not create a circular referral loop between multiple DNS services. |
| AdGuard Home | Domain Filtering, Query Logs, and Client Policies | Not a proxy traffic forwarder |
| MosDNS | DNS Traffic Splitting, Caching, and Upstream Selection | Cannot replace a firewall or a comprehensive proxy policy |
Recommended Troubleshooting Methods
- Temporarily disable AdGuard Home and MosDNS, keeping only OpenClash's default DNS, to verify that the basic proxy is working.
- Sign up for MosDNS to check domain name resolution, caching, and logs both domestically and internationally.
- Finally, add AdGuard Home and make sure its upstream is set to point only to the specific MosDNS listening port.
- Check dnsmasq, port 53 hijacking, IPv6 DNS, and browser DoH to ensure there are no bypasses or loops.
Menu names and ports may vary depending on the plugin version. Do not copy the port numbers verbatim; instead, map your own DNS data flow based on the current device's listening status.
How can I verify that Fake-IP is actually working?
Initiate a new domain request from the client and check the OpenClash connection logs to see if the corresponding domain and policy group appear; at the same time, verify that the AdGuard Home and MosDNS logs show only the expected single forwarding hop. If the page loads but the logs do not match at all, this is typically due to browser DoH, IPv6, or manual DNS bypass by the client.
Original article by Tech.laowang. If you wish to repost this article, please cite the source: https://techlaowang.com/en/openclash-adguardhome-mosdns-fake-ip/
