AntiZapret VPN in Docker

https://github.com/xtrime-ru/antizapret-vpn-docker
Admin
AntiZapret VPN in Docker is a solution that uses split tunneling to redirect only blocked domains...
Tokens:11,977
Snippets:173
Trust Score:8.4
License:MIT
Update:4 months ago
Show doc for...
Tokens:
Raw
### Install Docker Engine

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Installs Docker Engine on the server. Ensure commands are run as root.

```bash
curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh
```

--------------------------------

### Install Amnezia Wireguard on Ubuntu 24.04

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Follow these steps to install the Amnezia Wireguard kernel extension on Ubuntu 24.04. This includes adding a PPA, installing the package, and restarting the Wireguard service.

```bash
sudo add-apt-repository ppa:amnezia/ppa
sudo apt install -y amneziawg
docker compose restart wireguard-amnezia
```

--------------------------------

### Amnezia WireGuard Command Line Configuration

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Apply custom WireGuard interface parameters via the command line for advanced Amnezia WireGuard setups.

```text
interface {name} wireguard asc {jc} {jmin} {jmax} {s1} {s2} {h1} {h2} {h3} {h4}
```

```text
interface Wireguard1 wireguard asc 8 50 1000 30 32 1811016522 1196729875 457766807 1765857463
```

--------------------------------

### Deploy Antizapret VPN Stack to Swarm

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Configures the Docker Compose setup and deploys it as a stack to the Docker Swarm. This command processes the compose configuration and deploys it using `docker stack deploy`.

```bash
docker compose config | docker run --pull always --rm -i xtrime/antizapret-vpn:6 compose2swarm | docker stack deploy --prune -c - antizapret
```

--------------------------------

### Install Amnezia Wireguard on Ubuntu 20.04, 22.04

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Instructions for installing the Amnezia Wireguard kernel extension on Ubuntu 20.04 and 22.04. This involves modifying apt sources, installing necessary packages, and building the kernel module.

```bash
sudo apt update
sudo apt install -y software-properties-common python3-launchpadlib gnupg2 linux-headers-$(uname -r)
sudo apt-get source linux-image-$(uname -r)
sudo add-apt-repository ppa:amnezia/ppa
sudo apt install -y amneziawg
sudo dkms install -m amneziawg -v 1.0.0
docker compose restart wireguard-amnezia
```

--------------------------------

### Start Docker Services and Prune System

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Starts the Docker services defined in the compose file in detached mode and then removes unused Docker objects. This command is used after configuring the services.

```shell
docker compose up -d
docker system prune -f
```

--------------------------------

### VPN Startup Script with iptables Configuration

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

This script configures iptables for NAT and masquerading to proxy traffic through a specified VPN server IP. It enables IP forwarding and installs iptables-persistent for saving rules. Replace <SERVER_IP> with your actual server IP.

```shell
#!/bin/sh

# Fill with your foreign server ip
export VPN_IP=<SERVER_IP>

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/99-sysctl.conf
sysctl -w net.ipv4.ip_forward=1

# DNAT rules
iptables -t nat -A PREROUTING -p tcp ! --dport 22 -j DNAT --to-destination "$VPN_IP"
iptables -t nat -A PREROUTING -p udp ! --dport 22 -j DNAT --to-destination "$VPN_IP"
# MASQUERADE rules
iptables -t nat -A POSTROUTING -p tcp -d "$VPN_IP" -j MASQUERADE
iptables -t nat -A POSTROUTING -p udp -d "$VPN_IP"  -j MASQUERADE

echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean false | sudo debconf-set-selections
apt install -y iptables-persistent

```

--------------------------------

### Minimal docker-compose.override.yml for Wireguard

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Creates a minimal override configuration file for Docker Compose, specifying services like AdGuardHome and Wireguard with basic password protection. This example demonstrates a basic setup for a single server.

```yaml
services:
  adguard:
    environment:
      - ADGUARDHOME_PASSWORD=somestrongpassword
  wireguard:
     environment:
        - WIREGUARD_PASSWORD=somestrongpassword
     extends:
        file: services/wireguard/docker-compose.yml
        service: wireguard
```

--------------------------------

### Example DNS Request to CoreDNS (youtube.com)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

This snippet shows the initial DNS request for 'youtube.com' routed to CoreDNS. It indicates the domain is processed and returns internal IP addresses.

```text
Status: Processed
DNS server: coredns:53
Elapsed: 91 ms
Served from cache: False
Response code: NOERROR
Response: 
A: 14.16.13.209 (ttl=300)
A: 14.16.13.207 (ttl=300)
A: 14.16.13.206 (ttl=300)
A: 14.16.13.208 (ttl=300)
```

--------------------------------

### Install OpenVPN DKMS on Ubuntu 20.04

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Installs the OpenVPN Data Channel Offload (DCO) kernel module on Ubuntu 20.04. Ensure you are on the host machine, not within a container.

```bash
sudo rm -f /etc/apt/sources.list.d/openvpn.list
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://swupdate.openvpn.net/repos/repo-public.gpg | sudo gpg --dearmor --yes -o /etc/apt/keyrings/openvpn-repo-public.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/openvpn-repo-public.gpg] http://build.openvpn.net/debian/openvpn/release/2.7 focal main" | sudo tee /etc/apt/sources.list.d/openvpn-aptrepo.list > /dev/null
sudo apt update
sudo apt install -y ovpn-dkms
```

--------------------------------

### Example DNS Request to az-world (youtube.com)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

This snippet illustrates a DNS request from CoreDNS to 'az-world' which results in a SERVFAIL response, indicating the domain is not routed through this path.

```text
Status: Rewritten
Elapsed: 0.10 ms
Response code: SERVFAIL
Rule(s):
||*^$dnsrewrite=SERVFAIL,client=az-world
Custom filtering rules
```

--------------------------------

### Docker Compose Configuration for WireGuard Amnezia

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Example of a docker-compose.override.yml file to configure WireGuard Amnezia with custom JC, JMIN, and JMAX environment variables.

```yaml
  wireguard-amnezia:
    environment:
      - WIREGUARD_PASSWORD=xxxxx
      - JC=2
      - JMIN=10
      - JMAX=20
    extends:
      file: services/wireguard/docker-compose.yml
      service: wireguard-amnezia
```

--------------------------------

### Install OpenVPN DKMS on Ubuntu 24.04

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Installs the OpenVPN Data Channel Offload (DCO) kernel module on Ubuntu 24.04. Ensure you are on the host machine, not within a container.

```bash
sudo rm -f /etc/apt/sources.list.d/openvpn.list
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://swupdate.openvpn.net/repos/repo-public.gpg | sudo gpg --dearmor --yes -o /etc/apt/keyrings/openvpn-repo-public.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/openvpn-repo-public.gpg] http://build.openvpn.net/debian/openvpn/release/2.7 noble main" | sudo tee /etc/apt/sources.list.d/openvpn-aptrepo.list > /dev/null
sudo apt update
sudo apt install -y ovpn-dkms
```

--------------------------------

### Install OpenVPN DKMS on Ubuntu 22.04

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Installs the OpenVPN Data Channel Offload (DCO) kernel module on Ubuntu 22.04. Ensure you are on the host machine, not within a container.

```bash
sudo rm -f /etc/apt/sources.list.d/openvpn.list
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://swupdate.openvpn.net/repos/repo-public.gpg | sudo gpg --dearmor --yes -o /etc/apt/keyrings/openvpn-repo-public.gpg
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/openvpn-repo-public.gpg] http://build.openvpn.net/debian/openvpn/release/2.7 jammy main" | sudo tee /etc/apt/sources.list.d/openvpn-aptrepo.list > /dev/null
sudo apt update
sudo apt install -y ovpn-dkms
```

--------------------------------

### Example DNS Request to az-local (youtube.com)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

This snippet shows a DNS request from CoreDNS to 'az-local' which is processed successfully, returning real IP addresses after AdGuard applies specific client rules.

```text
Status: Processed
DNS server: 149.112.112.11:53
Elapsed: 50 ms
Response code: NOERROR
Response
A: 173.194.221.190 (ttl=300)
A: 173.194.221.91 (ttl=300)
A: 173.194.221.136 (ttl=300)
A: 173.194.221.93 (ttl=300)
```

--------------------------------

### Change Hostname to az-world

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Sets the hostname of the secondary server to 'az-world'. This is part of the setup for a multi-node Docker Swarm configuration.

```bash
hostnamectl set-hostname az-world
```

--------------------------------

### Change Hostname to az-local

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Sets the hostname of the primary server to 'az-local'. This is part of the setup for a multi-node Docker Swarm configuration.

```bash
hostnamectl set-hostname az-local
```

--------------------------------

### Add Domains via Custom Rules

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Use these examples to add specific domains or patterns to your custom rules in AdGuard. Ensure the rules include the '$dnsrewrite' modifier and specify the client if necessary.

```text
@@||subdomain.host.com^$dnsrewrite,client=az-local
@@||*.host.com^$dnsrewrite,client=az-local
@@||host.com^$dnsrewrite,client=az-world
@@||de^$dnsrewrite,client=az-world

@@/some_.*_regex/$dnsrewrite,client=az-local
```

--------------------------------

### Expose HTTP Port in Docker Compose Override

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

To expose an HTTP port for a service, add port forwarding to your `docker-compose.override.yml` file. This example shows how to expose the AdGuard service on port 3000.

```yaml
services:
   adguard:
      #...
      ports:
        - "3000:3000/tcp"
```

--------------------------------

### Clone Repository and Checkout Version

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Clones the Antizapret VPN Docker repository and checks out a specific version. This is a prerequisite for further configuration.

```bash
git clone https://github.com/xtrime-ru/antizapret-vpn-docker.git antizapret
cd antizapret
git checkout v6
```

--------------------------------

### Initialize Docker Swarm on Primary Node

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Initializes a Docker Swarm on the primary node. Replace `<PRIMARY_SERVER_PUBLIC_IP_ADDRESS>` with the actual public IP of your primary server.

```bash
docker swarm init --advertise-addr <PRIMARY_SERVER_PUBLIC_IP_ADDRESS>
```

--------------------------------

### Test VPN Speed with iperf3 (World Node)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Use these commands to test upload and download speeds to the world iperf3 server. Ensure you are connected to the VPN first.

```shell
iperf3 -c az-world.antizapret -i1 -t10 -P10
```

```shell
iperf3 -c az-world.antizapret -i1 -t10 -P10 -R
```

--------------------------------

### Trigger Manual Update

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Manually trigger an update of Antizapret VPN configuration by executing a command within the running container.

```bash
docker exec $(docker ps -q --filter=name=az | head -n1) doall
```

--------------------------------

### Create Route to AntiZapret DNS Host

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Configure a specific route to direct traffic for the Antizapret DNS server through the VPN interface.

```text
Route type: Route to host
Description: AntiZapretDNS
Destination host address: 77.88.8.8
Gateway IP: 10.1.166.2
Interface: Antizapret
Add automatically
```

--------------------------------

### Upgrade Single Instance to v6

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Steps to upgrade a single Antizapret VPN Docker instance from a previous version to v6 using Docker Compose. This involves fetching the new version, restarting containers, and cleaning up unused resources.

```shell
docker compose down --remove-orphans
git fetch && git checkout v6 && git pull --rebase
docker compose down --remove-orphans
docker compose up -d --remove-orphans
docker system prune -af
```

--------------------------------

### Save System Configuration

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Persist the current router configuration, including WireGuard and network rule changes.

```text
system configuration save
```

--------------------------------

### Upgrade Swarm Mode to v6 (Master Node)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Instructions for upgrading the Antizapret VPN Docker deployment in Swarm mode to v6 on the master node. This includes removing the old stack, fetching the new version, and redeploying.

```shell
docker stack rm antizapret && sleep 10
git fetch && git checkout v6 && git pull --rebase
docker compose config | docker run --pull always --rm -i xtrime/antizapret-vpn:6 compose2swarm | docker stack deploy --prune -c - antizapret
docker system prune -af
```

--------------------------------

### Reset Antizapret VPN Service

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Removes all settings, VPN configurations, and returns the service to its initial state. Use this command to perform a full reset.

```shell
docker stack rm antizapret || docker compose down --remove-orphans
rm -rf config/*
git restore config
```

--------------------------------

### Test VPN Speed with iperf3 (Local Node)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Use these commands to test upload and download speeds to the local iperf3 server within the VPN container. Ensure you are connected to the VPN first.

```shell
iperf3 -c az-local.antizapret -i1 -t10 -P10
```

```shell
iperf3 -c az-local.antizapret -i1 -t10 -P10 -R
```

--------------------------------

### Configure antizapret Firewall Zones

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Add antizapret firewall zones and forwarding rules to /etc/config/firewall. This sets up network isolation and traffic routing.

```uci
config zone\n    option name 'antizapret'\n    option input 'REJECT'\n    option output 'ACCEPT'\n    option forward 'ACCEPT'\n    list network 'antizapret'\n    option mtu_fix '1'\n    option masq '1'\n\nconfig forwarding\n    option src 'lan'\n    option dest 'antizapret'\n\nconfig forwarding\n    option src 'antizapret'\n    option dest 'wan'
```

--------------------------------

### Configure Upstream DNS Resolver (PiHole CLI)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Set the upstream DNS server for PiHole via the command line by modifying /etc/pihole/setupVars.conf. Ensure no other PIHOLE_DNS_* records exist.

```shell
PIHOLE_DNS_1=192.168.100.1
```

--------------------------------

### Create Route to AntiZapret Network

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Establish a route for the entire AntiZapret network subnet to be accessed via the VPN.

```text
Route type: Route to network
Description: AntiZapret
Destination network address: 14.16.0.0
Subnet mask: 255.252.0.0/14
Gateway IP: blank
Interface: Antizapret
```

--------------------------------

### Configure antizapret Network Interface

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Add the antizapret interface configuration to /etc/config/network. Ensure the device option matches your TUN interface name.

```uci
config interface 'antizapret'\n    option proto 'none'\n    option device 'tun1'\n    option defaultroute '0'\n    option delegate '0'
```

--------------------------------

### Configure System DNS Profile

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Set up the router's system DNS profile to not transit requests, ensuring custom DNS servers are used.

```text
Profile name: System
Transit requests: NO
```

--------------------------------

### Join Docker Swarm on Secondary Node

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Joins the secondary node to the Docker Swarm. Use the token and manager IP address obtained from the `docker swarm init` command on the primary node.

```bash
docker swarm join --token <TOKEN> <MANAGER_IP_ADDRESS>:<PORT>
```

--------------------------------

### Update Single Instance

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Use these commands to update a single Antizapret VPN Docker instance using Docker Compose. Ensure you pull the latest changes and restart the services.

```shell
git pull --rebase
docker compose down --remove-orphans
docker compose up -d --remove-orphans
docker system prune -af
```

--------------------------------

### Add Allowed IP for Antizapret

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Add a specific IP address to the allowed list for the Antizapret connection to ensure it uses the VPN.

```text
77.88.8.8/32
```

--------------------------------

### Configure Upstream DNS Resolver (Bare OpenWrt)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Set the upstream DNS server for Bare OpenWrt in /etc/config/dhcp. This directs DNS queries to the specified server.

```uci
config dnsmasq\n    list server '192.168.100.1'
```

--------------------------------

### Build Docker Images Locally

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Builds Docker images locally on both servers. This is an alternative to pulling images from Docker Hub, which might be unreachable on some local hosting environments.

```bash
docker compose build
```

--------------------------------

### Add Default DNS Server

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Add a default DNS server to the system profile, which will be used for resolving domain names.

```text
DNS server type: Default
DNS server address: 77.88.8.8
```

--------------------------------

### Configure WireGuard Junk Packet Size

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Use these environment variables to adjust the junk packet size for WireGuard to bypass DPI. Default values are JMIN=20 and JMAX=100.

```shell
JC=3
JMIN=20
JMAX=100
```

```shell
JC=2
JMIN=10
JMAX=20
```

--------------------------------

### Test MTU on Windows

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Used to check if the VPN connection has issues with the default MTU. Lower the value if errors occur.

```shell
ping google.com -f -l 1420
```

--------------------------------

### Update Swarm Mode

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Commands for updating an Antizapret VPN Docker deployment in Swarm mode. This includes pulling the latest image and redeploying the stack.

```shell
git pull --rebase
docker pull xtrime/antizapret-vpn:6
docker compose config | docker run --pull always --rm -i xtrime/antizapret-vpn:6 compose2swarm | docker stack deploy --prune -c - antizapret
docker system prune -af
```

--------------------------------

### OpenVPN Configuration for Keenetic

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Add these lines to your OpenVPN configuration file to ignore specific DNS requests and route traffic for a particular IP address.

```openvpn
pull-filter ignore block-outside-dns
route 77.88.8.8
```

--------------------------------

### Docker Compose Configuration for Proxy Services

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Configure local and world proxy services in your docker-compose.override.yml file. Ensure 'proxy-world' is used with Docker Swarm mode on multiple nodes.

```yaml
proxy-local:
  hostname: proxy-local.antizapret
  extends:
    file: services/proxy/compose.yml
    service: proxy
  environment:
    - PROXY_LOGIN=admin
    - PROXY_PASSWORD=password
  deploy:
    mode: replicated
    replicas: 1
    endpoint_mode: dnsrr
    placement:
      constraints: [ node.labels.location == local ]

proxy-world:
  hostname: proxy-world.antizapret
  extends:
    file: services/proxy/compose.yml
    service: proxy
  environment:
    - PROXY_LOGIN=admin
    - PROXY_PASSWORD=password
  deploy:
    mode: replicated
    replicas: 1
    endpoint_mode: dnsrr
    placement:
      constraints: [ node.labels.location == world ]
```

--------------------------------

### Inspect Docker Swarm Nodes

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Displays a list of nodes in the Docker Swarm, showing their status, availability, and manager status. This helps verify that both primary and secondary nodes have joined the swarm correctly.

```text
ID                            HOSTNAME   STATUS    AVAILABILITY   MANAGER STATUS   ENGINE VERSION
6dzagr08r8d2iidkcumjjz3q7 *   az-local   Ready     Active         Leader           29.0.1
vspy2m6w4tf7uv4ywgdnzttvr     az-world   Ready     Active                          29.0.1
```

--------------------------------

### Add DNS Intercept Rule

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Configure a redirect rule in /etc/config/firewall to intercept DNS traffic from the LAN. Ensure the dest_ip matches your DNS server.

```uci
config redirect 'dns_int'\n    option name 'Intercept-DNS'\n    option proto 'tcp udp'\n    option src 'lan'\n    option src_dport '53'\n    option src_ip '!192.168.4.3'\n    option target 'DNAT'\n    option dest_ip '192.168.4.3'\n    option dest 'lan'
```

--------------------------------

### Test MTU on Linux

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Used to check if the VPN connection has issues with the default MTU. Lower the value if errors occur.

```shell
ping -M -s 1420 google.com
```

--------------------------------

### Reset WireGuard Configuration and Restart Docker

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Command to stop Docker containers, remove the WireGuard Amnezia configuration directory, and then restart the containers. This action will remove all existing clients and certificates.

```shell
docker compose down && rm -rf ./config/wireguard_amnezia/ && docker compose up -d
```

--------------------------------

### DNS Resolution Check

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Verifies if the DNS server is working correctly by performing a lookup for a common domain. This is a basic step in debugging VPN connection issues.

```shell
> nslookup youtube.com

Server:		14.16.0.1
Address:	14.16.0.1#53

Non-authoritative answer:
Name:	youtube.com
Address:	14.16.13.209
```

--------------------------------

### Add IPv6 Reject Rule

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Add a firewall rule to reject all IPv6 traffic. This is recommended to prevent potential IPv6 leaks when IPv6 is not fully supported.

```uci
config rule\n    option name 'Reject-IPv6'\n    option family 'ipv6'\n    list proto 'all'\n    option src '*'\n    option dest '*'\n    option target 'REJECT'
```

--------------------------------

### Test MTU on macOS

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Used to check if the VPN connection has issues with the default MTU. Lower the value if errors occur.

```shell
ping -D -s 1420 google.com
```

--------------------------------

### Add DoT Deny Rule

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Configure a rule in /etc/config/firewall to reject DNS-over-TLS traffic to prevent leaks. This rule is optional and can be enabled or disabled.

```uci
config rule 'dot_deny'\n    option name 'Deny-DoT'\n    option src 'lan'\n    option dest 'wan'\n    option dest_port '853'\n    option proto 'tcp udp'\n    option target 'REJECT'\n    option enabled '0'
```

--------------------------------

### Add Labels to Docker Swarm Nodes

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Adds labels to the Docker Swarm nodes to identify their location. 'location=local' is assigned to the 'az-local' node, and 'location=world' is assigned to the 'az-world' node. These labels are used for routing traffic.

```bash
docker node update --label-add location=local az-local && docker node update --label-add location=world az-world
```

--------------------------------

### Disable ISP DNS

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_Keenetic.md

Configure the active ISP connection to ignore DNS settings provided by the ISP, enforcing custom DNS.

```text
Enable checkbox Ignore DNSv4 from ISP
Enable checkbox Ignore DNSv6 from ISP
```

--------------------------------

### Upgrade Swarm Mode to v6 (Worker Nodes)

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/README.md

Commands for worker nodes in a Docker Swarm deployment to fetch the latest v6 code. This ensures consistency across the swarm after the master node upgrade.

```shell
git fetch && git checkout v6 && git pull --rebase
```

--------------------------------

### Disable DNS Rebind Protection

Source: https://github.com/xtrime-ru/antizapret-vpn-docker/blob/v6/docs/guide_OpenWrt.md

Disable DNS rebind protection in /etc/config/dhcp by setting 'rebind_protection' to '0' in the dnsmasq configuration.

```uci
config dnsmasq\n    option rebind_protection '0'
```
Tokens:
Raw