Configure DNS and Fake-IP correctly

What fake-ip actually does

With fake-ip on, a program asks for the address of example.com and the core does not resolve anything. It hands back an unused address from a reserved range, commonly 198.18.0.0/16. When the program connects to that address, the core looks it up in its own table, recovers the domain name, and matches your rules against the name.

What you save is one real lookup. No lookup, no chance of a poisoned answer, and no waiting on a round trip to an authoritative server abroad. What you pay is that anything wanting the real IP now sees a 198.18 placeholder. Local device discovery, some P2P software and the direct-connect phase of certain games can all break on that.

A starting point that works

dns:
  enable: true
  ipv6: false
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "*.local"
    - "+.pool.ntp.org"
  nameserver:
    - 223.5.5.5
    - 119.29.29.29
  fallback:
    - https://dns.google/dns-query
    - tls://1.0.0.1:853

nameserver is the default resolver set — usually whatever answers fastest on your network. fallback holds encrypted resolvers over DoH or DoT for names you would rather not trust the local answer for. These are not primary and backup: the core decides which answer to believe according to its own policy, so everything in fallback has to be something you actually trust.

What belongs in fake-ip-filter

• Local names. *.lan, *.local, whatever hostname your router admin page uses. Give those a fake address and you can no longer reach your own hardware.
• Services that need a real address to function: time sync, some intranet service discovery, trackers used by download clients.
• Domains your rules already send direct. They are going out over the local network anyway, so a placeholder address buys nothing.
• Games. This is the category with no general answer. Some titles reach the lobby by hostname and the match server by raw IP, and fake-ip leaves them unable to find the way. If a game stops joining rooms under TUN, adding its domains here is the first thing to try.

When to fall back to redir-host

redir-host is the older approach: resolve the name for real, keep the name on record, and still match rules by name when forwarding. It is slower and it does expose you to poisoned answers, but because the addresses are genuine there are far fewer compatibility surprises.

The decision is not subtle. If you browse, stream and use developer tools, fake-ip is less trouble. If you run P2P, play multiplayer games, work with a lot of devices on the local network, or have already piled a dozen exceptions into the filter to keep fake-ip happy, switch to redir-host and stop fighting it.

nameserver-policy for the exceptions

Some names only give the right answer from a specific resolver — company intranet domains are the obvious case, and so are sites whose CDN only returns a sensible node to a local resolver. nameserver-policy pins a resolver per domain pattern, which is far more surgical than changing the whole nameserver list.

  nameserver-policy:
    "+.corp.example.com": 10.0.0.53
    "geosite:cn": [223.5.5.5, 119.29.29.29]