DNS 从 fake-ip 切到 redir-host，配合 sniffer 嗅探域名

- enhanced-mode: fake-ip -> redir-host，ping/调试/局域网应用看到真实 IP
- 启用 sniffer 从 TLS SNI/HTTP Host/QUIC 嗅出域名，保证基于域名的分流照常生效
- 新增 proxy-server-nameserver 走代理拉 DoH，防国外域名 DNS 污染
- 新增 nameserver-policy 让国内域名/私有 IP 强制走国内 DNS

via [HAPI](https://hapi.run)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: HAPI <noreply@hapi.run>

clash_base.yaml

@@ -5,16 +5,36 @@ mode: rule
 log-level: info
 external-controller: '127.0.0.1:9090'
 
+sniffer:
+  enable: true
+  override-destination: true
+  sniff:
+    HTTP:
+      ports: [80, 8080-8880]
+      override-destination: true
+    TLS:
+      ports: [443, 8443]
+    QUIC:
+      ports: [443, 8443]
+  skip-domain:
+    - 'Mijia Cloud'
+    - '+.push.apple.com'
+
 dns:
   enable: true
   listen: '127.0.0.1:9053'
+  ipv6: false
+  enhanced-mode: redir-host
   default-nameserver:
     - 223.5.5.5
-    - 223.6.6.6
     - 119.29.29.29
-  enhanced-mode: fake-ip
-  fake-ip-range: 198.18.0.1/16
   nameserver:
     - 'https://223.5.5.5/dns-query'
-    - 'https://223.6.6.6/dns-query'
+    - 'https://doh.pub/dns-query'
+  proxy-server-nameserver:
+    - 'https://1.1.1.1/dns-query'
+    - 'https://8.8.8.8/dns-query'
+  nameserver-policy:
+    'geosite:cn,private':
+      - 'https://223.5.5.5/dns-query'
       - 'https://doh.pub/dns-query'