[Support Request] 开启dae后，AdGuard Home拦截不显示客户端

[Rem1x-2019]

Checks

• I have searched the existing issues
• I have read the documentation
• Is it your first time sumbitting an issue

Support Request

希望开启dae后能正确显示AdGuard Home每个客户端的请求

Current Behavior

adg端口为533
Dnsmasq端口为53
dae的国内dns设置为：127.0.0.1:53
不开启dae，端口转发正常，AdGuard Home可以正常显示每个客户端的请求，
开启dae后，只有一个127.0.0.1内部地址请求

Expected Behavior

No response

Steps to Reproduce

global {
lan_interface: br-lan
wan_interface: auto
dial_mode: domain
log_level: info
allow_insecure: false
auto_config_kernel_parameter: true
tcp_check_http_method: GET
check_tolerance: 50ms
disable_waiting_network: true
}
subscription {}

node {
HK: ''
KR-arm: ''
}

dns {

    upstream {
            googledns: 'tcp://8.8.8.8:53'
            alidns: 'udp://127.0.0.1:533'
    }
    routing {
      request {  
	qname(geosite:category-ads-all) -> reject
	qname(geosite:cn) -> alidns
	fallback: googledns
      }
    }

}

group {
proxy {
filter: name(HK)
policy: fixed(0)
}

video {

    filter: name(KR-arm)
    policy: fixed(0)
}

}

routing {
pname(NetworkManager, systemd-resolved, dnsmasq) -> must_direct
dip(geoip:private) -> direct
domain(geosite:category-ads-all)->block
domain(geosite:cn)->direct
domain(geosite:category-games@cn) -> direct
domain(geosite:win-update) -> direct
dip(geoip:cn)->direct
domain(geosite:youtube, geosite:twitch, geosite:telegram) -> video
fallback: proxy

Environment

• Dae version (use dae --version): v0.8.0rc2
• OS (e.g cat /etc/os-release): ImmortalWrt 23.05.4 r28061-399f9a1db3 / LuCI openwrt-23.05.04
• Kernel (e.g. uname -a): 5.15.167
• Others: 只有一个路由器，且由路由器拨号，
  防火墙是nftables

Anything else?

No response

[dae-prow[bot]]

Thanks for opening this issue!

[Rem1x-2019]

需求：如何避免国内流量的DNS请求不被劫持。转而使用内网的ADG解析
domain(geosite:cn) must_rules 和domain(geosite:cn) must_direct 都没有效果。。
部分还会DNS分流出错，导致DNS国外出口都是国内DNS

[Rem1x-2019]

    dip(geoip:private) -> direct(must)
    domain(geosite:cn)->direct(must)

这样虽然不劫持国内流量了，但是会导致DNS泄漏
但是geoip:private不配置，又会劫持流量，国内DNS地址是内网的ADG，533端口

[Rem1x-2019]

dip(geoip:private) 如果使用must_rules 会导致内网打不开，
目前的配置是
pname(NetworkManager, systemd-resolved, dnsmasq) -> must_direct
domain(geosite:category-ads-all)->block
dip(geoip:private) -> direct
domain(geosite:cn)->direct
domain(geosite:category-games@cn) -> direct
domain(geosite:win-update) -> direct
dip(geoip:cn)->direct
domain(geosite:youtube, geosite:twitch, geosite:telegram) -> video
fallback: proxy

不知道如何让国内DNS流量不被劫持。。。

[Rem1x-2019]

!dip(8.8.8.8) && dport(53) -> must_direct
我的国内DNS是ADG的本机的533端口，已做转发，国外是8.8.8.8
只通过这条路由，可以分割国内DNS流量不劫持，访问国外也是走代理，
但是DNS会泄露，DNS出口会显示国内DNS。。不知道什么原因，其他都正常，