What is this?
A DNS proxy in Rust that sidesteps blanket ISP IP blocks: when an operator cuts off an anycast address shared by hundreds of Cloudflare sites, it rewrites that IP in the DNS response to an unblocked neighbor of the same prefix.
A DNS proxy in Rust that sidesteps blanket ISP IP blocks: when an operator cuts off an anycast address shared by hundreds of Cloudflare sites, it rewrites that IP in the DNS response to an unblocked neighbor of the same prefix.Is this something I install on my own server, or a hosted service I can point my devices at?Both. The authors run public resolvers — dns.xdp.es and lite.xdp.es — reachable by plain IP, DoH, DoT and DoQ on port 853, so you can just use them; this repo is the server side if you prefer to self-host.
Both. The authors run public resolvers — dns.xdp.es and lite.xdp.es — reachable by plain IP, DoH, DoT and DoQ on port 853, so you can just use them; this repo is the server side if you prefer to self-host.What does running my own instance involve?Build with Rust 1.82+ and, on a Debian/Ubuntu server, run the install script as root: it puts the binary in /usr/local/bin/evade-proxy, the tree in /opt/xdp-dns-evadeproxy and starts the proxy plus the blocklist timer. A Docker compose stack is the alternative.
Build with Rust 1.82+ and, on a Debian/Ubuntu server, run the install script as root: it puts the binary in /usr/local/bin/evade-proxy, the tree in /opt/xdp-dns-evadeproxy and starts the proxy plus the blocklist timer. A Docker compose stack is the alternative.Besides the proxy itself, what else does a full setup need?The example stack pairs it with an unbound recursive resolver doing DNSSEC validation and a blocklist-updater loop. Full coverage of IPv6 and non-anycast CDNs also wants the residential probe reporting from a home connection.
The example stack pairs it with an unbound recursive resolver doing DNSSEC validation and a blocklist-updater loop. Full coverage of IPv6 and non-anycast CDNs also wants the residential probe reporting from a home connection.Does the rewriting rescue every blocked site?No — only Cloudflare anycast IPs are rewritten, everything outside those prefixes is left untouched. Non-anycast CDNs like GitHub, Fastly or Akamai go through probe-verified redirects instead, and you can't run this alongside the older Python evadeproxy because they share ports.
No — only Cloudflare anycast IPs are rewritten, everything outside those prefixes is left untouched. Non-anycast CDNs like GitHub, Fastly or Akamai go through probe-verified redirects instead, and you can't run this alongside the older Python evadeproxy because they share ports.Where does all of this actually run?The server side targets Debian/Ubuntu (Docker works too) and listens only on localhost: 5335 and 5337 for DNS, 5339 for metrics, 8090 for probe ingest. The residential probe is meant for a Raspberry Pi or mini-PC behind your home NAT, making outgoing connections only.
The server side targets Debian/Ubuntu (Docker works too) and listens only on localhost: 5335 and 5337 for DNS, 5339 for metrics, 8090 for probe ingest. The residential probe is meant for a Raspberry Pi or mini-PC behind your home NAT, making outgoing connections only.What happens to my queries on the hosted resolvers?The xdp.es resolvers advertise DNSSEC validation, zero logs and built-in ad and malware filtering. Self-hosting keeps it all on your own machine, with the proxy listening on localhost only.
The xdp.es resolvers advertise DNSSEC validation, zero logs and built-in ad and malware filtering. Self-hosting keeps it all on your own machine, with the proxy listening on localhost only.What exactly gets changed in a DNS response?If an A, AAAA or HTTPS/SVCB hint is both on the blocklist and inside a Cloudflare prefix, the proxy swaps the IP for an unblocked neighbor of the same prefix and sets TTL 30 s — tunable via EVADEREWRITETTL, where 0 restores the old behavior. The rewrite is done in-place, preserving compression pointers, flags and record order.
If an A, AAAA or HTTPS/SVCB hint is both on the blocklist and inside a Cloudflare prefix, the proxy swaps the IP for an unblocked neighbor of the same prefix and sets TTL 30 s — tunable via EVADEREWRITETTL, where 0 restores the old behavior. The rewrite is done in-place, preserving compression pointers, flags and record order.Why is there a residential probe on top of the blocklist?Because a server in a datacenter cannot see what a subscriber line sees. A small box at home probes targets over TCP:443, TLS(SNI) and HTTP HEAD and reports back; the server flags a block only when a site serves fine from the datacenter but fails from home, with hysteresis of 3 rounds to add an IP and 2 to remove it.
Because a server in a datacenter cannot see what a subscriber line sees. A small box at home probes targets over TCP:443, TLS(SNI) and HTTP HEAD and reports back; the server flags a block only when a site serves fine from the datacenter but fails from home, with hysteresis of 3 rounds to add an IP and 2 to remove it.Why rewrite IPs instead of just pointing at another resolver?Because the block hits the address, not the domain: any resolver still returns the same blocked anycast IP that hundreds of sites share. Swapping it for a live neighbor in the same Cloudflare prefix restores access for everything riding on that address.
Because the block hits the address, not the domain: any resolver still returns the same blocked anycast IP that hundreds of sites share. Swapping it for a live neighbor in the same Cloudflare prefix restores access for everything riding on that address.How does it keep up when operators add or lift blocks?A script runs on a 15-second timer: it downloads the public blocked-IP list, keeps the IPv4 entries, merges whatever your home probe confirmed and writes /etc/unbound/blockedips.txt, which the proxy reloads every 5 s. Cloudflare prefix data refreshes once a day.
A script runs on a 15-second timer: it downloads the public blocked-IP list, keeps the IPv4 entries, merges whatever your home probe confirmed and writes /etc/unbound/blockedips.txt, which the proxy reloads every 5 s. Cloudflare prefix data refreshes once a day.What are similar projects?smartdns, DnsServer, openvpn-install, MasterDnsVPN, wireguard-install, russia-mobile-internet-whitelist, nyx, 3X-UI_KIT
smartdns, DnsServer, openvpn-install, MasterDnsVPN, wireguard-install, russia-mobile-internet-whitelist, nyx, 3X-UI_KITWhich topics is it in?dns-over-tls, ipv4, dns-server, ipv6, debian, censorship, proxy-server, ubuntu, network-security, self-hosting, anti-censorship, dns
dns-over-tls, ipv4, dns-server, ipv6, debian, censorship, proxy-server, ubuntu, network-security, self-hosting, anti-censorship, dns