DD-WRT :: View topic - Dnscrypt on dd-wrt

Dnscrypt on dd-wrt

DD-WRT Forum Index -> Broadcom SoC based Hardware

Goto page Previous 1, 2, 3, 4, 5, 6, 7, 8 Next

View previous topic :: View next topic

Author

Message

slobodan
DD-WRT Guru

Joined: 03 Nov 2011
Posts: 1557
Location: Zwolle

Posted: Mon Jan 18, 2016 3:04 Post subject:

Ok, use /tmp/dnsmasq.conf instead.
_________________
2 times APU2 Opnsense 21.1 with Sensei

2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)

3 times Asus RT-N16 shelved

E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)

3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)

Sponsor

slobodan
DD-WRT Guru

Joined: 03 Nov 2011
Posts: 1557
Location: Zwolle

Posted: Mon Jan 18, 2016 3:05 Post subject:

I repeat: I don't know if your specified listen-address is a good choice.
_________________
2 times APU2 Opnsense 21.1 with Sensei

2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)

3 times Asus RT-N16 shelved

E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)

3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)

johnnyNobody999
DD-WRT Guru

Joined: 10 Jan 2014
Posts: 504

Posted: Mon Jan 18, 2016 3:09 Post subject:

slobodan wrote:

Ok, use /tmp/dnsmasq.conf instead.

There are no duplicates.

johnnyNobody999
DD-WRT Guru

Joined: 10 Jan 2014
Posts: 504

Posted: Mon Jan 18, 2016 3:11 Post subject:

slobodan wrote:

I repeat: I don't know if your specified listen-address is a good choice.

I was following this wiki:

https://www.dd-wrt.com/wiki/index.php/DNSMasq_as_DHCP_server#listen-address_directive

johnnyNobody999
DD-WRT Guru

Joined: 10 Jan 2014
Posts: 504

Posted: Tue Jan 19, 2016 4:10 Post subject:
Some progress made. I was experimenting with the options and got dns working on the router again by starting unbound. Setup->DHCP->Recursive DNS Resolving. But, I still have problems with getting dnscrypt-proxy to do the proxying again. It appears to have daemonized but there's no log output to show it proxying. No telling what happened with all the experimenting that I had to do.

slobodan
DD-WRT Guru

Joined: 03 Nov 2011
Posts: 1557
Location: Zwolle

Posted: Wed Jan 20, 2016 15:03 Post subject:

Perhaps I should repeat this, too: if you want it to proxy on port 40, then specify port 40, don't use default port (53).
_________________
2 times APU2 Opnsense 21.1 with Sensei

2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)

3 times Asus RT-N16 shelved

E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)

3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)

johnnyNobody999
DD-WRT Guru

Joined: 10 Jan 2014
Posts: 504

Posted: Wed Jan 20, 2016 16:10 Post subject:

slobodan wrote:

Perhaps I should repeat this, too: if you want it to proxy on port 40, then specify port 40, don't use default port (53).

I have a dnsmasq.conf entry that says server=127.0.0.1#40 but it doesn't do what I thought it would do. I expected that it would do dns queries on port 40 but I was getting proxying done on port 53. Right now I'm not getting any proxying done - another issue to resolve.

slobodan
DD-WRT Guru

Joined: 03 Nov 2011
Posts: 1557
Location: Zwolle

Posted: Wed Jan 20, 2016 17:20 Post subject:

I meant starting it like this:

dnscrypt-proxy -a 192.168.27.1:40 -d -R cisco

or

dnscrypt-proxy -a 127.0.2.1:40 -d -R cisco
_________________
2 times APU2 Opnsense 21.1 with Sensei

2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)

3 times Asus RT-N16 shelved

E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)

3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)

johnnyNobody999
DD-WRT Guru

Joined: 10 Jan 2014
Posts: 504

Posted: Wed Jan 20, 2016 19:20 Post subject:

slobodan wrote:

I meant starting it like this:

dnscrypt-proxy -a 192.168.27.1:40 -d -R cisco

or

dnscrypt-proxy -a 127.0.2.1:40 -d -R cisco

Thanks. That works.

Jan 20 19:14:10 ea6900 daemon.notice dnscrypt-proxy[1607]: Proxying from 127.0.2.1:40 to 208.67.220.220:443

But, I tried to test the setup with the following (I don't get the error using the exact same command on an Ubuntu machine):

root@ea6900:~# nslookup -type=txt debug.opendns.com.
BusyBox v1.24.1 (2015-11-16 08:28:27 CET) multi-call binary.

Usage: nslookup [HOST] [SERVER]

Query the nameserver for the IP address of the given HOST
optionally using a specified DNS server

The Ubuntu box gives this:

user@xps15:~$ nslookup -type=txt debug.opendns.com.
Server: 127.0.2.1
Address: 127.0.2.1#53

Non-authoritative answer:
debug.opendns.com text = "server 7.chi"
debug.opendns.com text = "flags 20 0 50 1950000000000000000"
debug.opendns.com text = "originid 398737"
debug.opendns.com text = "actype 2"
debug.opendns.com text = "bundle 217721"
debug.opendns.com text = "source 216.###.###.###:34779"
debug.opendns.com text = "dnscrypt enabled (717744506545635A)"

Authoritative answers can be found from:

johnnyNobody999
DD-WRT Guru

Joined: 10 Jan 2014
Posts: 504

Posted: Mon Jun 13, 2016 19:05 Post subject:
It would be nice if they could do what Tomato does. Shibby Tomato has a checkbox for enabling dnscrypt-proxy and that displays boxes for whichever proxy you want to use, etc. Tomato is missing some features that dd-wrt has so I guess it's a toss up as to which firmware to use. I like dd-wrt since it has more options for my router but I really wish it was less complicated to use dnscrypt-proxy.

LessTerribleIvan
DD-WRT Novice

Joined: 03 Jul 2016
Posts: 1

Posted: Sun Jul 03, 2016 15:22 Post subject:
Hi! I am curios about the flash memory size that is required to install DNSCrypt. It is known that OpenVPN images require at least 8M, so what extra memory would it take to install DNSCrypt? Would it help trying to make an image myself and looking at its size?

slobodan
DD-WRT Guru

Joined: 03 Nov 2011
Posts: 1557
Location: Zwolle

Posted: Mon Jul 04, 2016 12:43 Post subject:

LessTerribleIvan wrote:

Hi!

I am curios about the flash memory size that is required to install DNSCrypt. It is known that OpenVPN images require at least 8M, so what extra memory would it take to install DNSCrypt?

Would it help trying to make an image myself and looking at its size?

Use the firmware mod kit, you may simply delete some software you don't need and replace it with dnscrypt-proxy. File size has to be lower or equal to original file size.
_________________
2 times APU2 Opnsense 21.1 with Sensei

2 times RT-AC56U running DD-WRT 45493 (one as Gateway, the other as AP, both bridged with LAN cable)

3 times Asus RT-N16 shelved

E4200 V1 running freshtomato 2020.8 (bridged with LAN cable)

3 times Linksys WRT610N V2 converted to E3000 and 1 original E3000 running freshtomato 2020.8 (bridged with LAN cable)

HalfBit
DD-WRT Guru

Joined: 04 Sep 2009
Posts: 776
Location: AR, USA

Posted: Sun Sep 25, 2016 4:11 Post subject:

I've gotten this far... Very Happy

...but I don't think it is right as I have an R7000, and it appears to be for a different BCM...

Quote:

root@R7000:~# opkg install dnscrypt-proxy dnscrypt-proxy-resolvers
Installing dnscrypt-proxy (1.7.0-1) to root...
Downloading http://www.desipro.de/musl/packages/dnscrypt-proxy_1.7.0-1_bcm53xx.ipk.
Installing libsodium (1.0.11-2) to root...
Downloading http://www.desipro.de/musl/packages/libsodium_1.0.11-2_bcm53xx.ipk.
Installing dnscrypt-proxy-resolvers (1.7.0+git-20160829-65a9553-1) to root...
Downloading http://www.desipro.de/musl/packages/dnscrypt-proxy-resolvers_1.7.0+git-20160829-65a9553-1_bcm53xx.ipk.
Package dnscrypt-proxy-resolvers (1.7.0+git-20160829-65a9553-1) installed in root is up to date.
Configuring libsodium.
Configuring dnscrypt-proxy-resolvers.
Configuring dnscrypt-proxy.
root@R7000:~#

At this point I am still poking around trying to figure out what do to next, and where.

Update:
I guess the packages are right, but still not working. I'm getting closer though:

Quote:

root@R7000:~# dnscrypt-proxy -a 127.53.53.53:5353 -R cisco -L /opt/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv
[INFO] - [cisco] does not support DNS Security Extensions
[WARNING] - [cisco] logs your activity - a different provider might be better a choice if privacy is a concern
[NOTICE] Starting dnscrypt-proxy 1.7.0
[INFO] Generating a new session key pair
[INFO] Done
[INFO] Server certificate with serial #1463092899 received
[INFO] This certificate is valid
[INFO] Chosen certificate #1463092899 is valid from [2016-05-12] to [2017-05-12]
[INFO] Server key fingerprint is ABA1:F000:D394:8045:672D:73E0:EAE6:F181:19D0:2A62:3791:EFAD:B04E:40B7:B6F9:C40B
[NOTICE] Proxying from 127.53.53.53:5353 to 208.67.220.220:443

I've added the following to the DNSMASQ options:

Quote:

addn-hosts=/opt/hosts
server=127.53.53.53#5353
listen-address=127.53.53.53

Once I change the DNS servers to 127.53.53.53, 127.0.0.1 and 127.0.0.2, I am no longer able to resolve domains. Still poking around.
_________________
R7000 Nighthawk - DD-WRT v3.0-r50308
R7000 Nighthawk - DD-WRT v3.0-r50308
~~~~~~~~~~Dismantled for learning opportunities~~~~~~~~~~
WRT54Gv2
WRT54Gv8.2
~~~~~~~~~~Other Settings~~~~~~~~~
https://nextdns.io/?from=2d3sq39x
https://pi-hole.net/
https://github.com/DNSCrypt/dnscrypt-proxy

Last edited by HalfBit on Sun Sep 25, 2016 8:17; edited 1 time in total

HalfBit
DD-WRT Guru

Joined: 04 Sep 2009
Posts: 776
Location: AR, USA

Posted: Sun Sep 25, 2016 8:07 Post subject:

I got it. Not really sure what did it other than make sure the listeners were up and validate the DNSMasq and DNS server configurations were correct. Hope this information helps:

PREREQUISITES:
See my previous post here on installing the necessary packages: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1048255#1048255

RUN DNSCRYPT-PROXY:

Code:

dnscrypt-proxy -a 127.0.0.53:5353 -R cisco -L /opt/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv -d

CONFIGURATION:

Code:

root@R7000:~# nvram get DD_BOARD
Netgear R7000

root@R7000:~# nvram get os_version
29300M

root@R7000:~# dnscrypt-proxy -V
dnscrypt-proxy 1.7.0

root@R7000:~# nvram get wan_dns
127.0.0.53 127.0.0.1 127.0.0.2

root@R7000:~# cat /tmp/resolv.dnsmasq
nameserver 127.0.0.53
nameserver 127.0.0.1
nameserver 127.0.0.2

root@R7000:~# cat /tmp/dnsmasq.conf
interface=br0,wl0.1
resolv-file=/tmp/resolv.dnsmasq
all-servers
strict-order
dhcp-leasefile=/tmp/dnsmasq.leases
dhcp-lease-max=29
dhcp-option=br0,--- REDACTED NETWORK INFO ---
dhcp-option=wl0.1,--- REDACTED NETWORK INFO ---
dhcp-authoritative
dhcp-range=br0,--- REDACTED NETWORK INFO ---
dhcp-range=--- REDACTED NETWORK INFO ---
--- REDACTED LEASE INFO ---
stop-dns-rebind
addn-hosts=/opt/hosts
server=127.0.0.53#5353
bogus-priv
domain-needed
no-negcache

root@R7000:~# netstat -an | grep 5353
tcp 0 0 127.0.0.53:5353 0.0.0.0:* LISTEN
udp 0 0 127.0.0.53:5353 0.0.0.0:*

root@R7000:~# ps | grep dnsc
5483 root 1148 S grep dnsc
22599 root 1112 S dnscrypt-proxy -a 127.0.0.53:5353 -R cisco -L /opt/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv -d

VALIDATION:
Once I kill the DNSCrypt process, either with

Code:

killall dnscrypt-proxy
or
kill <processID>

I no longer get DNS resolutions. I can also validate looking up the TXT DNS record for debug.opendns.com from a Windows 10 client:

Quote:

C:\>nslookup -type=txt debug.opendns.com.
Server: R7000
Address: 192.168.1.1

Non-authoritative answer:
debug.opendns.com text =

"server 5.REDACTED"

...

debug.opendns.com text =

"source REDACTED_WAN_IP:54226"
debug.opendns.com text =

"dnscrypt enabled (REDACTED)"

...

OBSERVATIONS:
You get more information if you don't "daemonize" the process, at least initially until you get it going:

Code:

root@R7000:~# dnscrypt-proxy -a 127.0.0.53:5353 -R cisco -L /opt/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv
[INFO] - [cisco] does not support DNS Security Extensions
[WARNING] - [cisco] logs your activity - a different provider might be better a choice if privacy is a concern
[NOTICE] Starting dnscrypt-proxy 1.7.0
[INFO] Generating a new session key pair
[INFO] Done
[INFO] Server certificate with serial #1463092899 received
[INFO] This certificate is valid
[INFO] Chosen certificate #1463092899 is valid from [2016-05-12] to [2017-05-12]
[INFO] Server key fingerprint is ABA1:F000:D394:8045:672D:73E0:EAE6:F181:19D0:2A62:3791:EFAD:B04E:40B7:B6F9:C40B
[NOTICE] Proxying from 127.0.0.53:5353 to 208.67.220.220:443

Whereas daemonizing (-d switch) gives you:

Code:

root@R7000:~# dnscrypt-proxy -a 127.0.0.53:5353 -R cisco -L /opt/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv -d
[INFO] - [cisco] does not support DNS Security Extensions
[WARNING] - [cisco] logs your activity - a different provider might be better a choice if privacy is a concern
root@R7000:~#

For additional networks/VAPs, more configuration is necessary. See my next post here: http://www.dd-wrt.com/phpBB2/viewtopic.php?p=1049346#1049346
_________________
R7000 Nighthawk - DD-WRT v3.0-r50308
R7000 Nighthawk - DD-WRT v3.0-r50308
~~~~~~~~~~Dismantled for learning opportunities~~~~~~~~~~
WRT54Gv2
WRT54Gv8.2
~~~~~~~~~~Other Settings~~~~~~~~~
https://nextdns.io/?from=2d3sq39x
https://pi-hole.net/
https://github.com/DNSCrypt/dnscrypt-proxy

Last edited by HalfBit on Mon Oct 10, 2016 1:02; edited 4 times in total

HalfBit
DD-WRT Guru

Joined: 04 Sep 2009
Posts: 776
Location: AR, USA

Posted: Tue Oct 04, 2016 1:36 Post subject:

I was able to fully validate DNSCrypt was working today. I noticed that it was not working on my guest wifi VAP, so I started tinkering again. I was able to finally get the TXT DNS record for debug.opendns.com from a Windows 10 laptop.

From my protected network:

Quote:

C:\>nslookup -type=txt debug.opendns.com
Server: R7000
Address: 192.168.1.1

Non-authoritative answer:
debug.opendns.com text =

"server 9.REDACTED"

...
debug.opendns.com text =

"source REDACTED_WAN_IP:42569"
debug.opendns.com text =

"dnscrypt enabled (REDACTED)"

and from guest wifi VAP

Quote:

C:\>nslookup -type=txt debug.opendns.com
Server: UnKnown
Address: 192.168.10.1

Non-authoritative answer:
debug.opendns.com text =

"server 5.REDACTED"

...

debug.opendns.com text =

"source REDACTED_WAN_IP:64526"
debug.opendns.com text =

"dnscrypt enabled (REDACTED)"
...

In order to get it working on my guest wifi VAP, I had to enable "Forced DNS Redirection" on the Wireless>Basic Settings tab(s) under the guest wifi VAP settings, and enter the IP address for my router on the my network in the "Optional DNS Target" field.

Clients connected to the guest wifi VAP are configured to use the guest wifi VAP default gateway IP as DNS/DHCP/Gateway, and then that IP address uses the router's real IP address as DNS which is then proxied through DNSCrypt.
_________________
R7000 Nighthawk - DD-WRT v3.0-r50308
R7000 Nighthawk - DD-WRT v3.0-r50308
~~~~~~~~~~Dismantled for learning opportunities~~~~~~~~~~
WRT54Gv2
WRT54Gv8.2
~~~~~~~~~~Other Settings~~~~~~~~~
https://nextdns.io/?from=2d3sq39x
https://pi-hole.net/
https://github.com/DNSCrypt/dnscrypt-proxy

Goto page Previous 1, 2, 3, 4, 5, 6, 7, 8 Next

Display posts from previous:

Page 5 of 8

DD-WRT Forum Index -> Broadcom SoC based Hardware

All times are GMT

Navigation

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum

Log in

Dnscrypt on dd-wrt

Quick Links

Log in