另外说一下，server 和 ipset 这两个参数一般不在那个/var/etc/dnsmasq.conf.cfg01411c 配置文件中，但是你查看一下配置文件中的 conf-file 参数对应的目录下，应该有使用 server 和 ipset 的配置文件。

一般使用的是/tmp/dnsmasq.d/

简单来说，DNSMASQ 有两个参数 server 和 ipset 发挥的作用

server 的作用是将指定的域名交给指定的域名服务器解析，并将 ip 存入 ipset 中，iptables 再将目标地址为这个 ipset 的 package 转发到科学上网的端口或线路上

你研究一下这个参数的说明

-S, --local, --server=[/[<domain>]/[domain/]][<server>[#<port>]][@<interface>][@<source-ip>[#<port>]]
Specify upstream servers directly. Setting this flag does not suppress reading of /etc/resolv.conf, use --no-resolv to do that. If one or more optional domains are given, that server is used only for those domains and they are queried only using the specified server. This is intended for private nameservers: if you have a nameserver on your network which deals with names of the form xxx.internal.thekelleys.org.uk at 192.168.1.1 then giving the flag --server=/internal.thekelleys.org.uk/192.168.1.1 will send all queries for internal machines to that nameserver, everything else will go to the servers in /etc/resolv.conf. DNSSEC validation is turned off for such private nameservers, UNLESS a --trust-anchor is specified for the domain in question. An empty domain specification, // has the special meaning of "unqualified names only" ie names without any dots in them. A non-standard port may be specified as part of the IP address using a # character. More than one --server flag is allowed, with repeated domain or ipaddr parts as required.
More specific domains take precedence over less specific domains, so: --server=/google.com/1.2.3.4 --server=/www.google.com/2.3.4.5 will send queries for google.com and gmail.google.com to 1.2.3.4, but www.google.com will go to 2.3.4.5

Matching of domains is normally done on complete labels, so /google.com/ matches google.com and www.google.com but NOT supergoogle.com. This can be overridden with a * at the start of a pattern only: /*google.com/ will match google.com and www.google.com AND supergoogle.com. The non-wildcard form has priority, so if /google.com/ and /*google.com/ are both specified then google.com and www.google.com will match /google.com/ and /*google.com/ will only match supergoogle.com.

For historical reasons, the pattern /.google.com/ is equivalent to /google.com/ if you wish to match any subdomain of google.com but NOT google.com itself, use /*.google.com/

The special server address '#' means, "use the standard servers", so --server=/google.com/1.2.3.4 --server=/www.google.com/# will send queries for google.com and its subdomains to 1.2.3.4, except www.google.com (and its subdomains) which will be forwarded as usual.

Also permitted is a -S flag which gives a domain but no IP address; this tells dnsmasq that a domain is local and it may answer queries from /etc/hosts or DHCP but should never forward queries on that domain to any upstream servers. --local is a synonym for --server to make configuration files clearer in this case.

IPv6 addresses may include an %interface scope-id, eg fe80::202:a412:4512:7bbf%eth0.

The optional string after the @ character tells dnsmasq how to set the source of the queries to this nameserver. It can either be an ip-address, an interface name or both. The ip-address should belong to the machine on which dnsmasq is running, otherwise this server line will be logged and then ignored. If an interface name is given, then queries to the server will be forced via that interface; if an ip-address is given then the source address of the queries will be set to that address; and if both are given then a combination of ip-address and interface name will be used to steer requests to the server. The query-port flag is ignored for any servers which have a source address specified but the port may be specified directly as part of the source address. Forcing queries to an interface is not implemented on all platforms supported by dnsmasq.

Upstream servers may be specified with a hostname rather than an IP address. In this case, dnsmasq will try to use the system resolver to get the IP address of a server during startup. If name resolution fails, starting dnsmasq fails, too. If the system's configuration is such that the system resolver sends DNS queries through the dnsmasq instance which is starting up then this will time-out and fail.

https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html#index

第 4 篇 也是最后一篇 https://mp.weixin.qq.com/s/yneYcKjZvAldRCpcaYmFGA

第 3 篇 https://mp.weixin.qq.com/s/1foakbjt6ZjUltBgLL0LvQ

第 2 篇来了 https://mp.weixin.qq.com/s/YM7WBWI7jdyw7wvDzdZPgw

@buffzty 现在哪个云厂商能开出 11 元/月的云主机？如果您可以真希望能提供链接，不要仅仅是煞有其事地泛泛而谈，也让我们也一起薅羊毛

@buffzty
1 、你举出这只是理论费用，带宽都没有算进去吧，我自己局域网的带宽可以达到 1000M ，使用云服务能达到么？相应的费用要多少？
2 、我就是要通过搭建过程来理解每个组件的作用，一键脚本简单，但失去了学习的过程。
3 、你没有算云盘费用，相比自己买的 TF 卡可以永久持有，性价比肯定更高。
4 、以后的各种二手 pi 也可以废旧利用上

其实最大的问题是，除了用于学习 K8S 的命令和各种操作，有没有实际的应用功能，比如家庭的什么功能，其实我是有想法的，但是还是要先尝试了再来给各位分享

@wsseo 我没有使用离线安装，我把网关变成了透明代理

@shen13176101 非常感谢，我研究一下 ngrok

装翻译插件是一个好事情，如果你对技术感兴趣，一遍看不懂再看第二遍、第三遍，不懂的单词或句子用鼠标选中翻译一下

如果连自己“感兴趣”的英文技术文章都看不懂，或者沉不下心来，问题不在于英文水平，在于不感兴趣，要考虑自己是否适合干这行

@gregy OpenGaussDB 可以本地部署

我现在正在用香橙派搭 K8S 带外部 etcd 集群，技术验证完全可行
3 个 OrangePi 3B 作为 etcd 集群
2 个 OrangePi 3 安装 keepalived+haproxy 作为负载均衡
3 个 OrangePi 3B 作为 control plane
再加 3 个 OrangePi 3B 作为 worker node ，或者用台式机上的虚拟机

这样就是一个功能完整的、具备独立 etcd 机器、独立负载均衡、非常廉价的 K8S 集群，而且没有风扇和噪音，适合放在家里。而且 control plane 完全独立，有多余的机器作为 worker node 加入，非常方便。

orangePi 3B 便宜的只要 200 左右，不用买带 eMMC 的，使用 64GB tf 卡，京东的 V3 速率只要 20 多元，没有比这个性价比更低的方案了

我感觉想考高分难，但是考过也很很简单，我教程都没有买，我是这么准备的

上午的客观题，背历年的真题，有 70%左右的一字不改的原题，网上找原题，提前两周开始背，不用提前太早，太早也会忘记。

下午的两门都是主观题，说实话，如果你的工作内容有写 PPT 、设计方案、技术方案的架构设计，这些日常的工作就是备考过程，你把日常这些文档写好，理解业务场景的特点，应该采用什么技术方案，按照领导和用户要求改好，把这些工作习惯养好后，用在下午的考场上，准过！