Introduction

In a DSH environment using TUN mode (such as Mihomo or Clash), the system DNS resolver typically returns Fake-IP addresses (for example, 198.18.0.11) rather than the real IP addresses. The native http fetch provider blocks these requests by default because they do not belong to the public address range, causing traffic that should work to be blocked. fakeip-compat is a Fake-IP-aware Web Fetch provider that allows traffic to flow in TUN Fake-IP environments and supports access to pinned LAN CIDRs.

Core Features

This plugin provides the following capabilities:

  • Fake-IP-aware Web Fetch provider.
  • Support for TUN (Mihomo/Clash) DNS environments.
  • Support for access to specific LAN CIDRs.
  • Verification using DoH (DNS over HTTPS).
  • Integrated settings UI for configuration changes.

Installation and Enablement

The plugin is installed through DSH’s plugin registration mechanism and requires no build steps.

Installation

Run the following command to add the plugin to the specified profile configuration:

dsh plugin --profile web add github:iwinoid/fakeip-compat

Runtime Dependencies

After installation, ensure the following dependencies are available:

  • DSH Peers: @deepseek-ai/dsh-web, @deepseek-ai/dsh-timeout
  • Runtime libraries: @deepseek-ai/schemastery, ipaddr.js, undici

Enablement

The plugin does not select itself automatically; it must be specified explicitly. In the profile configuration, set fetchProvider to fakeip-http. Also keep the original searchProvider configuration.

- id: web
  name: '@deepseek-ai/dsh-web'
  config:
    searchProvider: tavily      # Keep the original search provider
    fetchProvider: fakeip-http  # Switch to fakeip-http

You can also specify it via an environment variable:

DSH_WEB_FETCH_PROVIDER=fakeip-http

After enabling, verify the configuration with the following command:

dsh --profile <name> --dump-config | grep -A8 fakeip

Configuration

The plugin registers a fakeip-compat configuration section. Its main parameters are as follows:

Parameter Default Value Description
lanCidr 192.168.0.0/16 LAN allowlist. When the system-resolution result falls within this range, traffic is sent using the pinned IP.
fakeV4Cidr / fakeV6Cidr 198.18.0.0/16 / fdfe:dcba:9876::/48 Local Fake-IP pools. These must match the Fake-IP ranges configured in Clash Verge.
dohEndpoints 1.1.1.1/dns-query, 8.8.8.8/resolve Trusted DoH (JSON API) endpoints. Connections are made using direct IP literals, and the first endpoint to succeed completely takes effect.
dohTimeoutMs 8000 Timeout for DoH queries.
lanInsecure false Skip TLS checks only on the LAN path. Used for self-signed device scenarios.
maxResponseBytes / maxBodyChars / timeoutMs / maxRedirects / userAgent 5000000 / 100000 / 30000 / 5 / Official UA Same semantics as the official provider.

Settings UI

The plugin registers a settings card named fakeip-compat (located under Settings → Plugins → Plugin configuration).

  • Function: Hand-written browser-side UI with no build steps.
  • Effect: Configuration changes take effect immediately; no DSH restart is required.
  • Fault tolerance: Invalid input (such as an incorrect CIDR) blocks saving; runtime modification errors retain the last valid value and do not affect in-flight Fetch requests.

API Behavior

The Provider ID is fakeip-http. This plugin primarily handles two paths; all other paths follow the native http provider’s rejection logic:

  1. TUN Fake-IP Path: When system resolution returns a Fake-IP, the plugin revalidates the domain via DoH, then pins the transport to the set of real IP addresses verified by DoH.
  2. LAN Path: When the system-resolution result is within lanCidr, traffic is sent directly using the pinned IP, with TLS checks retained by default.

Notes

  • Manual Selection: The plugin only registers the provider and does not select it automatically. It must be specified explicitly via Profile YAML or an environment variable.
  • Dependency Check: Before installation, ensure that DSH Peers and runtime dependencies are available.
  • No Build Required: This package has no build steps and is ready to run after installation.
  • Configuration Completeness: When modifying the configuration file, you must preserve the searchProvider setting because configuration replacement is performed line by line.