https://github.com/aa65535/openwrt-dnsmasq


1.卸载默认的dnsmasq

opkg remove dnsmasq
2.安装dnsmasq-full

opkg install http://sourceforge.net/projects/openwrt-dist/files/depends-libs/ramips/libnettle_2.7.1-1_ramips_24kec.ipk
opkg install http://sourceforge.net/projects/openwrt-dist/files/depends-libs/ramips/libgmp_6.0.0-1_ramips_24kec.ipk
opkg install http://sourceforge.net/projects/openwrt-dist/files/dnsmasq/2.72-8372a82/ramips/dnsmasq-full_2.72-6_ramips_24kec.ipk
3.安装ipset

opkg update //安装前必须更新包数据库缓存。
opkg install ipset iptables-mod-nat-extra
安装的时候会报错,需要重启一次路由才可以正常使用.
4.安装配置shadowsocks就不细说了,参考这里
5.用ipset创建一个set，这里我创建的set名字为fuckgfw,然后将这个set中所有IP均转发到shadowsocks（这里本机的shadowsocks监听的是默认的1080端口）。建议将下面的命令写入 /etc/rc.local 。每次开机自动运行。

ipset -N fuckgfw iphash
iptables -t nat -A PREROUTING -p tcp -m set --match-set fuckgfw dst -j REDIRECT --to-port 1080
设置 dnsmasq 对某些域名使用pdnsd进行解析并且加入fuckgfw这个set：
为了保持配置文件整洁，建议在 /etc/dnsmasq.conf 最后加入：

conf-dir=/etc/dnsmasq.d
然后新建目录 /etc/dnsmasq.d,自定义的配置文件就放这里面.在这里我们使用一个python脚本转换gfwlist里面的网址为符合dnsmasq格式要求的配置文件.
脚本内容为如下

#!/usr/bin/env python  
#coding=utf-8
#  
# Generate a list of dnsmasq rules with ipset for gfwlist
#  
# Copyright (C) 2014 http://www.shuyz.com   
# Ref https://code.google.com/p/autoproxy-gfwlist/wiki/Rules    
 
import urllib2 
import re
import os
import datetime
import base64
import shutil
 
mydnsip = '127.0.0.1'
mydnsport = '1053'

# the url of gfwlist
baseurl = 'http://dl.aenes.com/gfwlist.txt'
# match comments/title/whitelist/ip address
comment_pattern = '^\!|\[|^@@|^\d+\.\d+\.\d+\.\d+'
domain_pattern = '([\w\-\_]+\.[\w\.\-\_]+)[\/\*]*' 
tmpfile = 'gfwlisttmp'
# do not write to router internal flash directly
outfile = 'gfwlist.conf'
rulesfile = 'gfwlist.conf'
 
fs =  file(outfile, 'w')
fs.write('# gfw list ipset rules for dnsmasq\n')
fs.write('# updated on ' + datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S") + '\n')
fs.write('#\n')
 
print 'fetching list...'
content = urllib2.urlopen(baseurl, timeout=15).read().decode('base64')

# write the decoded content to file then read line by line
tfs = open(tmpfile, 'w')
tfs.write(content)
tfs.close()
tfs = open(tmpfile, 'r')

print 'page content fetched, analysis...'

# remember all blocked domains, in case of duplicate records
domainlist = []

for line in tfs.readlines():    
    if re.findall(comment_pattern, line):
        print 'this is a comment line: ' + line
        #fs.write('#' + line)
    else:
        domain = re.findall(domain_pattern, line)
        if domain:
            try:
                found = domainlist.index(domain[0])
                print domain[0] + ' exists.'
            except ValueError:
                print 'saving ' + domain[0]
                domainlist.append(domain[0])
                fs.write('server=/.%s/%s#%s\n'%(domain[0],mydnsip,mydnsport))
                fs.write('ipset=/.%s/gfwlist\n'%domain[0])
        else:
            print 'no valid domain in this line: ' + line
                    
tfs.close() 
fs.close();

#print 'moving generated file to dnsmasg directory'
#shutil.move(outfile, rulesfile)

#print 'restart dnsmasq...'
#print os.popen('/etc/init.d/dnsmasq restart').read()
 
print 'done!'
gfwlist的地址默认是访问不了的,我们替换为镜像地址.生成的配置文件很长,有伍仟多行,这里就不放上来了.用ftp工具穿到/etc/dnsmasq.d里面.
然后重启dnsmasq

/etc/init.d/dnsmasq restart
6.通过下面的命令查看set中的IP，这样可以确定解析是否正常，并且查看某网站是否正确的被加到了ipset：

ipset list fuckgfw
7.通过下面的命令可以清理掉set中所有ip。更多的ipset用法请查看ipset help

ipset flush fuckgfw