DNS over IPsec Transport Mode

IPsec 的 Tunnel 模式被广泛采用，但其实 IPsec 还有 Transport 模式，可以用来给任何协议添加加密

IPsec 软件这里选择了 strongSwan ，配置 /etc/swanctl/conf.d/dns.conf 即可

A 端（国内，记得把 100.64.0.1 改成国内机器的公网 ip ）：

connections {
	dns {
		version = 2
		local_addrs  = 100.64.0.1
		remote_addrs = 100.64.0.2
		proposals = aes128gcm16-prfsha256-ecp256
		mobike = no
		dpd_delay = 20
		
		local {
			auth = psk
			id = 100.64.0.1
		}
		
		remote {
			auth = psk
			id = 100.64.0.2
		}
		
		children {
			transport {
				esp_proposals = aes128gcm128-x25519
				start_action = trap
				local_ts  = 100.64.0.1[udp/any]
				remote_ts = 100.64.0.2[udp/53]
				mode = transport
			}
		}		
	}
}

secrets {
	ike-psk {
		secret = IxwmdgyTsUwpobnrCP5hQka4PFNzYL3FPqRkv9CWec8=
		id-a = 100.64.0.1
		id-b = 100.64.0.2
	}
}

B 端（国外，local 和 remote 交换一下即可，记得把 100.64.0.2 改成国外机器的公网 ip ）：

		children {
			transport {
				esp_proposals = aes128gcm128-x25519
				start_action = trap
				local_ts  = 100.64.0.2[udp/53]
				remote_ts = 100.64.0.1[udp/any]
				mode = transport
			}
		}

在 B 端（国外）跑一个 coredns：

. {
	bind 127.0.0.53
	whoami
	erratic
	log
}

erratic 插件的作用就是不管查询什么域名，返回的都是 192.0.2.53 和 2001:DB8::53

然后在国内机器上用 nslookup 查询谷歌域名：

nslookup www.google.com 100.64.0.2

查询出来的结果应该是 192.0.2.53 和 2001:DB8::53

在双边机器上查看 IPsec 流量统计：

ip -s xfrm state