Introduction

On Windows systems where a TUN mode proxy is enabled (Clash Verge / Mihomo, sing-box, Surge, etc.), DSH’s web_fetch fails for all domains. The error message indicates that DNS resolution succeeded, but the resolved address was judged to be a “non-public address” and was therefore actively blocked. This happens because TUN mode uses a fake-ip mechanism that returns non-public IP addresses (such as 28.0.0.x or fc00::/7), while the built-in SSRF protection in web_fetch rejects those addresses.

Plugin Overview

This is a DSH plugin designed to route the built-in web_fetch through a local proxy, thereby avoiding the interception of fake-ip addresses by SSRF protection under TUN mode. The plugin is maintained by 1499501762, classified as a networking tool, and licensed under MIT.

Core Features

  1. Locate the local HTTP proxy inside the host process at startup.
  2. Install a proxied policy for the entire process.
  3. Verify that routing is indeed set to proxied: true.
  4. Skip the local DNS check (bypassing SSRF interception).
  5. Support automatic detection via environment variables or configuration.
  6. Provide a UI settings interface.
  7. Do not conflict with dsh-network-proxy.

Installation and Activation

Install the plugin:

dsh plugin --profile web add github:1499501762/dsh-web-fetch-proxy

This plugin requires Node.js >= 20.18.1.

After installation, restart DSH. The following message in the startup log indicates that the plugin is active:
[web-fetch-proxy] web_fetch now tunnels through http://127.0.0.1:7897 (source: clash-config:...); the local DNS check is bypassed.

Typical Usage

After installation, you can configure it in the following ways:
1. Via UI settings: go to Settings -> General -> Web Fetch Proxy. In the “Web Fetch Proxy” field, you can choose automatic detection, manually enter a proxy address, or disable it.
2. Via command-line namespace setting: web-fetch-proxy settings proxy.
3. Via environment variable: set DSH_WEB_FETCH_PROXY=http://127.0.0.1:7897.
4. Verify plugin status: npm run verify.

Notes

  • Fail-open policy: The plugin does not throw runtime errors; it only reports failures in logs.
  • Does not override host routing: If the host already has proxied routing at startup, the plugin will not override it.
  • Proxy discovery order: When proxy: auto, discovery probes in the following order: environment variables -> HTTP_PROXY -> local Clash configuration -> WinINET -> common ports (7897, 7890, etc.).
  • Compatibility: It shares the Dispatcher with dsh-network-proxy but does not affect web_fetch. The two do not conflict.

Conclusion

This plugin provides a practical solution for using web_fetch under TUN mode. More details can be found here:
- DSH Plugin Directory
- GitHub Repository