acl not working

[shurakenas]

Does not work by domain name. If you specify an IP, only then the traffic goes through a proxy. What am I doing wrong?

/etc/shadowsocks/config.json:

{
    "server":"my_ip",
    "server_port":my_port,
    "local_address": "my_local_ip",
    "local_port":my_local_port,
    "password":"my_password",
    "timeout":5,
    "method":"chacha20-ietf-poly1305",
    "acl":"/etc/shadowsocks/hosts.acl",
    "plugin": "/etc/shadowsocks/simple-tls",
    "plugin_opts": "cert-hash=my_cert_hash;no-verify;n=my_domen"
}

/etc/shadowsocks/hosts.acl:

[bypass_all]

[proxy_list]
^[a-z]{5}\.2ip\.ru
^[a-z]{5}\.ident\.me

[zonyitoo]

It works perfectly fine with your configuration. How did you test? How to reproduce? What did you see in log?

[shurakenas]

I am using a proxy client in the keenetic router to redirect traffic to the proxy. The proxy itself is raised on a separate virtual machine in its local network. If I use without "acl":"/etc/shadowsocks/hosts.acl", then everything works fine, all sites go through a proxy. But I need to run some sites through a proxy, not all of them. As soon as I use the acl, the regular expression for the domain name does not work, but if you specify the ip address of the site, it will work. Moreover, if you omit the topic with the keenetic router and specify the proxy address in the browser, then there will be no problem. I understand that it has something to do with the DNS and the keenetic router. DNS in the router uses DNS-over-HTTPS. I would be grateful if you could help me figure it out.

[zonyitoo]

What version of sslocal are you using? Could you run sslocal with -vvv and see what exactly it was happening.

[shurakenas]

version sslocal - 1.22.0

part of the log at startup

2025-01-08T09:25:52.346508549+03:00 TRACE main ThreadId(01) shadowsocks_rust::service::local: src/service/local.rs:618: Config { log: LogConfig { level: 3, format: LogFormatConfig { without_time: false }, config_path: None }, runtime: RuntimeConfig { worker_count: None, mode: MultiThread } }
2025-01-08T09:25:52.346680679+03:00 TRACE main ThreadId(01) shadowsocks_service::acl: crates/shadowsocks-service/src/acl/mod.rs:347: ACL loading from "/etc/shadowsocks/hosts.acl"
2025-01-08T09:25:52.346701675+03:00 TRACE main ThreadId(01) shadowsocks_service::acl: crates/shadowsocks-service/src/acl/mod.rs:362: ACL parsing start from mode BlackList and black_list / bypass_list
2025-01-08T09:25:52.346730914+03:00 TRACE main ThreadId(01) shadowsocks_service::acl: crates/shadowsocks-service/src/acl/mod.rs:395: switch to mode WhiteList
2025-01-08T09:25:52.346741567+03:00 TRACE main ThreadId(01) shadowsocks_service::acl: crates/shadowsocks-service/src/acl/mod.rs:411: loading white_list / proxy_list
2025-01-08T09:25:52.346991791+03:00 TRACE main ThreadId(01) shadowsocks_service::acl: crates/shadowsocks-service/src/acl/mod.rs:222: REGEX-RULE ident.me
2025-01-08T09:25:52.349340236+03:00 TRACE main ThreadId(01) shadowsocks_rust::sys: src/sys.rs:25: rlimit NOFILE rlimit { rlim_cur: 1024, rlim_max: 524288 } require adjustion
2025-01-08T09:25:52.349359055+03:00 DEBUG main ThreadId(01) shadowsocks_rust::sys: src/sys.rs:72: rlimit NOFILE adjusted rlimit { rlim_cur: 524288, rlim_max: 524288 }
2025-01-08T09:25:52.349377516+03:00  INFO main ThreadId(01) shadowsocks_rust::service::local: src/service/local.rs:982: shadowsocks local 1.22.0 build 2025-01-02T14:53:49.390696600+00:00
2025-01-08T09:25:52.349558292+03:00 TRACE main ThreadId(01) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:571: registering event source with poller: token=Token(1), interests=READABLE

part of the log when accessing the site ident.me (49.12.234.183), as can be seen in the log in the first line of CONNECT 49.12.234.183:80, for some reason the ip address is instead of the name. At this moment, the proxy client in the keenetic router is being used to redirect traffic to ss, no proxy is specified in the browser.

2025-01-08T09:26:40.635380082+03:00 DEBUG tokio-runtime-worker ThreadId(02) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:208: CONNECT 49.12.234.183:80
2025-01-08T09:26:40.63547977+03:00 TRACE tokio-runtime-worker ThreadId(02) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:571: registering event source with poller: token=Token(934829823535023), interests=READABLE | WRITABLE
2025-01-08T09:26:40.695346417+03:00 TRACE tokio-runtime-worker ThreadId(02) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:267: sent header: TcpResponseHeader { reply: Succeeded, address: 192.168.253.100:51504 }
2025-01-08T09:26:40.69538493+03:00 DEBUG tokio-runtime-worker ThreadId(02) shadowsocks_service::local::utils: /project/crates/shadowsocks-service/src/local/utils.rs:103: established tcp tunnel 192.168.253.50:50564 <-> 49.12.234.183:80 bypassed
2025-01-08T09:26:41.058859047+03:00 TRACE tokio-runtime-worker ThreadId(02) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:571: registering event source with poller: token=Token(895848482309347), interests=READABLE | WRITABLE
2025-01-08T09:26:41.059489421+03:00 TRACE tokio-runtime-worker ThreadId(02) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:187: socks5 HandshakeRequest { methods: [0] }
2025-01-08T09:26:41.059511858+03:00 TRACE tokio-runtime-worker ThreadId(02) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:76: reply handshake HandshakeResponse { chosen_method: 0 }
2025-01-08T09:26:41.060451448+03:00 TRACE tokio-runtime-worker ThreadId(02) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:201: socks5 TcpRequestHeader { command: TcpConnect, address: 64.233.161.188:5228 } peer: 192.168.253.50:50566

part of the log when accessing the site ident.me (49.12.234.183), as can be seen in the log in the first line of CONNECT identifier.me:80, the domain name is displayed correctly here. A proxy in the browser is currently being used.

2025-01-08T09:35:31.577895099+03:00 DEBUG tokio-runtime-worker ThreadId(03) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:208: CONNECT ident.me:80
2025-01-08T09:35:31.57809715+03:00 TRACE tokio-runtime-worker ThreadId(03) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:571: registering event source with poller: token=Token(290382942049263), interests=READABLE | WRITABLE
2025-01-08T09:35:31.578162395+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks::relay::tcprelay::proxy_stream::client: /project/crates/shadowsocks/src/relay/tcprelay/proxy_stream/client.rs:138: connected tcp remote my_ip:my_port (outbound: 127.0.0.1:38311) with ConnectOpts { fwmark: None, bind_local_addr: None, bind_interface: None, tcp: TcpSocketOpts { send_buffer_size: None, recv_buffer_size: None, nodelay: false, fastopen: false, keepalive: Some(15s), mptcp: false }, udp: UdpSocketOpts { mtu: None, allow_fragmentation: false } }
2025-01-08T09:35:31.578198824+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks::relay::tcprelay::crypto_io: /project/crates/shadowsocks/src/relay/tcprelay/crypto_io.rs:409: generated AEAD cipher salt b"something"
2025-01-08T09:35:31.578295327+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:267: sent header: TcpResponseHeader { reply: Succeeded, address: 127.0.0.1:58210 }
2025-01-08T09:35:31.578315362+03:00 DEBUG tokio-runtime-worker ThreadId(03) shadowsocks_service::local::utils: /project/crates/shadowsocks-service/src/local/utils.rs:29: established tcp tunnel 192.168.253.3:53078 <-> ident.me:80 through sever 127.0.0.1:38311 (outbound: my_ip:my_port)
2025-01-08T09:35:31.922594006+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks::relay::tcprelay::aead: /project/crates/shadowsocks/src/relay/tcprelay/aead.rs:204: got AEAD salt b"something"
2025-01-08T09:35:37.151728601+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks::relay::tcprelay::utils: /project/crates/shadowsocks/src/relay/tcprelay/utils.rs:256: copy bidirection ends, a_to_b: Done(482), b_to_a: Done(370)
2025-01-08T09:35:37.151754322+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks_service::local::utils: /project/crates/shadowsocks-service/src/local/utils.rs:72: tcp tunnel 192.168.253.3:53078 <-> ident.me:80 (proxied) closed, L2R 370 bytes, R2L 482 bytes
2025-01-08T09:35:37.151775658+03:00 TRACE tokio-runtime-worker ThreadId(03) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:702: deregistering event source from poller
2025-01-08T09:35:37.15180881+03:00 TRACE tokio-runtime-worker ThreadId(03) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:702: deregistering event source from poller
2025-01-08T09:35:41.682298932+03:00 TRACE tokio-runtime-worker ThreadId(03) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:571: registering event source with poller: token=Token(141234567898765), interests=READABLE | WRITABLE
2025-01-08T09:35:41.682543007+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:187: socks5 HandshakeRequest { methods: [0] }
2025-01-08T09:35:41.682567825+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:76: reply handshake HandshakeResponse { chosen_method: 0 }
2025-01-08T09:35:41.682907729+03:00 TRACE tokio-runtime-worker ThreadId(03) mio::poll: /cargo/registry/src/index.crates.io-6f17d22bba15001f/mio-1.0.3/src/poll.rs:571: registering event source with poller: token=Token(139751994871680), interests=READABLE | WRITABLE
2025-01-08T09:35:41.683628227+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:187: socks5 HandshakeRequest { methods: [0] }
2025-01-08T09:35:41.683650977+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:76: reply handshake HandshakeResponse { chosen_method: 0 }
2025-01-08T09:35:41.683967526+03:00 TRACE tokio-runtime-worker ThreadId(03) shadowsocks_service::local::socks::server::socks5::tcprelay: /project/crates/shadowsocks-service/src/local/socks/server/socks5/tcprelay.rs:201: socks5 TcpRequestHeader { command: TcpConnect, address: 149.154.167.41:443 } peer: 192.168.253.50:56484