no udp support, only use tcp

ss-tproxy

@@ -10,7 +10,18 @@ else
 fi
 
 function dnsfwd_update() {
-    # TODO
+cat << EOF > $dnsfwd_conf
+# Generated by ss-tproxy at $(date '+%F %T')
+LogOn $dnsfwd_log_enable
+LogFileThresholdLength 5120000
+LogFileFolder $dnsfwd_log_folder
+
+UseCache false
+UDPLocal $dnsfwd_listen
+
+TCPGroup $dnsfwd_upstream * no
+BlockNegativeResponse true
+EOF
 }
 
 function pdnsd_update() {
@@ -84,9 +95,6 @@ function chnip_update() {
 }
 
 function ipts_update() {
-    iptables -t mangle -F PREROUTING
-    iptables -t mangle -F SS-UDP &> /dev/null
-    iptables -t mangle -X SS-UDP &> /dev/null
     iptables -t nat -F OUTPUT
     iptables -t nat -F PREROUTING
     iptables -t nat -F POSTROUTING
@@ -106,35 +114,15 @@ function ipts_update() {
     iptables -t nat -A SS-TCP -m set --match-set chnroute dst -j RETURN
     iptables -t nat -A SS-TCP -p tcp -j REDIRECT --to-ports ${redir_port}
 
-    iptables -t mangle -N SS-UDP
-    iptables -t mangle -A SS-UDP -d 0/8 -j RETURN
-    iptables -t mangle -A SS-UDP -d 10/8 -j RETURN
-    iptables -t mangle -A SS-UDP -d 127/8 -j RETURN
-    iptables -t mangle -A SS-UDP -d 169.254/16 -j RETURN
-    iptables -t mangle -A SS-UDP -d 172.16/12 -j RETURN
-    iptables -t mangle -A SS-UDP -d 192.168/16 -j RETURN
-    iptables -t mangle -A SS-UDP -d 224/4 -j RETURN
-    iptables -t mangle -A SS-UDP -d 240/4 -j RETURN
-    iptables -t mangle -A SS-UDP -d ${server_addr} -j RETURN
-    iptables -t mangle -A SS-UDP -m set --match-set chnroute dst -j RETURN
-    iptables -t mangle -A SS-UDP -p udp -j TPROXY --tproxy-mark ${iptables_tproxy_mark} --on-ip ${iptables_tproxy_ip} --on-port ${iptables_tproxy_port}
-
     iptables -t nat -A OUTPUT -p tcp -j SS-TCP
 
     for intranet in "${iptables_intranet[@]}"; do
-        iptables -t mangle -A PREROUTING -p udp -s $intranet ! -d $intranet --dport 53 -j ACCEPT
-        iptables -t nat -A PREROUTING -p udp -s $intranet ! -d $intranet --dport 53 -j REDIRECT --to-ports 53
-
         iptables -t nat -A PREROUTING -p tcp -s $intranet -j SS-TCP
-        iptables -t mangle -A PREROUTING -p udp -s $intranet -j SS-UDP
-
+        iptables -t nat -A PREROUTING -p udp -s $intranet ! -d $intranet --dport 53 -j REDIRECT --to-ports 53
         iptables -t nat -A POSTROUTING -s $intranet ! -d $intranet -j MASQUERADE
     done
 }
 function ipts_origin() {
-    iptables -t mangle -F PREROUTING
-    iptables -t mangle -F SS-UDP &> /dev/null
-    iptables -t mangle -X SS-UDP &> /dev/null
     iptables -t nat -F OUTPUT
     iptables -t nat -F PREROUTING
     iptables -t nat -F POSTROUTING
@@ -147,15 +135,6 @@ function ipts_origin() {
     done
 }
 
-function pbr_add() {
-    ip route add local 0/0 dev lo table ${pbr_table}
-    ip rule add fwmark ${iptables_tproxy_mark} table ${pbr_table}
-}
-function pbr_del() {
-    ip rule show | grep "fwmark ${iptables_tproxy_mark}" | awk -F':' '{print $1}' | xargs -n1 ip rule del pref &> /dev/null
-    ip route flush table ${pbr_table}
-}
-
 function ipfwd_on() {
     if [ $(cat /proc/sys/net/ipv4/ip_forward) -ne 1 ]; then
         echo 1 > /proc/sys/net/ipv4/ip_forward
@@ -183,11 +162,6 @@ function current_ip() {
 function start() {
     dns_origin
 
-    if [ ! -e ${chinadns_chnroute} ]; then
-        echo -e "\e[37m${chinadns_chnroute}\e[0m  [\e[1;35mnot_exist\e[0m]"
-        exit 1
-    fi
-
     if [ "${server_use_ssr}" = 'false' ]; then
         redir_params="-s '${server_addr}' -p '${server_port}' -m '${server_method}' -k '${server_passwd}' -b '${redir_addr}' -l '${redir_port}'"
         if [ "${redir_udp_relay}" = 'true' ]; then redir_params+=" -u"; fi
@@ -205,21 +179,8 @@ function start() {
         eval "nohup ssr-redir $redir_params < /dev/null &>> '${redir_log}' &"
     fi
 
-    if [ "${server_use_ssr}" = 'false' ]; then
-        tunnel_params="-s '${server_addr}' -p '${server_port}' -m '${server_method}' -k '${server_passwd}' -b '${tunnel_addr}' -l '${tunnel_port}' -L '${tunnel_upstream}'"
-        if [ "${tunnel_udp_relay}" = 'true' ]; then tunnel_params+=" -u"; fi
-        if [ "${tunnel_verbose}" = 'true' ]; then tunnel_params+=" -v"; fi
-        if [ "${tunnel_no_delay}" = 'true' ]; then tunnel_params+=" --no-delay"; fi
-        if [ "${tunnel_reuse_port}" = 'true' ]; then tunnel_params+=" --reuse-port"; fi
-        eval "nohup ss-tunnel $tunnel_params < /dev/null &>> '${tunnel_log}' &"
-    else
-        tunnel_params="-s '${server_addr}' -p '${server_port}' -m '${server_method}' -k '${server_passwd}' -O '${server_protocol}' -o '${server_obfs}' -b '${tunnel_addr}' -l '${tunnel_port}' -L '${tunnel_upstream}'"
-        if [ -n "${server_protocol_param}" ]; then tunnel_params+=" -G '${server_protocol_param}'"; fi
-        if [ -n "${server_obfs_param}" ]; then tunnel_params+=" -g '${server_obfs_param}'"; fi
-        if [ "${tunnel_udp_relay}" = 'true' ]; then tunnel_params+=" -u"; fi
-        if [ "${tunnel_verbose}" = 'true' ]; then tunnel_params+=" -v"; fi
-        eval "nohup ssr-tunnel $tunnel_params < /dev/null &>> '${tunnel_log}' &"
-    fi
+    dnsfwd_update
+    dnsforwarder -f $dnsfwd_conf -q -d &> /dev/null
 
     chinadns_params="-b ${chinadns_addr} -p ${chinadns_port} -s ${chinadns_upstream} -c ${chinadns_chnroute}"
     if [ "${chinadns_mutation}" = 'true' ]; then chinadns_params+=" -m"; fi
@@ -233,7 +194,6 @@ function start() {
     ipset -R < ${ipset_save_file}
 
     ipts_update
-    pbr_add
     ipfwd_on
 
     dns_update
@@ -242,14 +202,12 @@ function start() {
 function stop() {
     pkill '^pdnsd$' &> /dev/null
     pkill '^chinadns$' &> /dev/null
+    pkill '^dnsforwarder$' &> /dev/null
     pkill '^ss-redir$' &> /dev/null
-    pkill '^ss-tunnel$' &> /dev/null
     pkill '^ssr-redir$' &> /dev/null
-    pkill '^ssr-tunnel$' &> /dev/null
 
     ipts_origin
     ipset -X chnroute &> /dev/null
-    pbr_del
 
     dns_origin
 }
@@ -267,6 +225,12 @@ function status() {
         echo -e "\e[37mchinadns\e[0m\t[\e[1;35mstopped\e[0m]"
     fi
 
+    if [ $(pgrep -c '^dnsforwarder$') -ge 1 ]; then
+        echo -e "\e[37mdnsforwarder\e[0m\t[\e[1;32mrunning\e[0m]"
+    else
+        echo -e "\e[37mdnsforwarder\e[0m\t[\e[1;35mstopped\e[0m]"
+    fi
+
     if [ "${server_use_ssr}" = 'false' ]; then
         if [ $(pgrep -c '^ss-redir$') -ge 1 ]; then
             echo -e "\e[37mss-redir\e[0m\t[\e[1;32mrunning\e[0m]"
@@ -280,20 +244,6 @@ function status() {
             echo -e "\e[37mssr-redir\e[0m\t[\e[1;35mstopped\e[0m]"
         fi
     fi
-
-    if [ "${server_use_ssr}" = 'false' ]; then
-        if [ $(pgrep -c '^ss-tunnel$') -ge 1 ]; then
-            echo -e "\e[37mss-tunnel\e[0m\t[\e[1;32mrunning\e[0m]"
-        else
-            echo -e "\e[37mss-tunnel\e[0m\t[\e[1;35mstopped\e[0m]"
-        fi
-    else
-        if [ $(pgrep -c '^ssr-tunnel$') -ge 1 ]; then
-            echo -e "\e[37mssr-tunnel\e[0m\t[\e[1;32mrunning\e[0m]"
-        else
-            echo -e "\e[37mssr-tunnel\e[0m\t[\e[1;35mstopped\e[0m]"
-        fi
-    fi
 }
 
 function usage() {