Enabling DNSSEC with Unbound and Forwarding to DNSCrypt

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
View previous topic :: View next topic  
Author Message
Denna
DD-WRT User


Joined: 16 Sep 2016
Posts: 101
PostPosted: Sun Sep 18, 2016 22:36    Post subject: Enabling DNSSEC with Unbound and Forwarding to DNSCrypt Reply with quote
How do you enable DNSSEC with Unbound and Forward to DNSCrypt ? DNSCrypt will be configured to contact a DNS Server that supports DNSSEC.
    1) From what I've read, on the Services\Services tab, add "proxy-dnssec" in the Additional DNSMasq Options section ? Is that correct ? What is the syntax for adding multiple options in this field ?

    2) Where do you configure Unbound to forward to DNSCrypt ? Is it the "forward-addr: <IP address>@<port> setting in the /etc/unbound/unbound.conf file ?
Back to top View user's profile Send private message
Sponsor
<Kong>
DD-WRT Guru


Joined: 15 Dec 2010
Posts: 4339
Location: Germany
PostPosted: Mon Sep 26, 2016 16:12    Post subject: Re: Enabling DNSSEC with Unbound and Forwarding to DNSCrypt Reply with quote
Denna wrote:
How do you enable DNSSEC with Unbound and Forward to DNSCrypt ? DNSCrypt will be configured to contact a DNS Server that supports DNSSEC.
    1) From what I've read, on the Services\Services tab, add "proxy-dnssec" in the Additional DNSMasq Options section ? Is that correct ? What is the syntax for adding multiple options in this field ?



Support for proxy-dnssec is currently not compiled into dnsmasq.

Quote:

2) Where do you configure Unbound to forward to DNSCrypt ? Is it the "forward-addr: <IP address>@<port> setting in the /etc/unbound/unbound.conf file ?


No unbound is currently using a generated config under /tmp/unbound.conf, everytime unbound starts this file is generated and your changes overwritten.

The only option right now would be to stop unbound, modify the file start unbound.

Therefore it is a bit difficult to do this with the current implementation in dd-wrt.
_________________
KONG PB's: http://www.desipro.de/ddwrt/
KONG Info: http://tips.desipro.de/
Back to top View user's profile Send private message
Denna
DD-WRT User


Joined: 16 Sep 2016
Posts: 101
PostPosted: Mon Sep 26, 2016 16:59    Post subject: Reply with quote
So running an Unbound binary would provide more flexibility ?
_________________
Asus RT-AC88u running DD-WRT 12-15-2016-r30949
Back to top View user's profile Send private message
ironmanlok
DD-WRT User


Joined: 16 Jul 2012
Posts: 59
PostPosted: Tue Sep 27, 2016 1:59    Post subject: Reply with quote
on my experience, when the GUI lacks the ability to change cmd line args of services, you can't simply use stopservice and then run the binary directly, cause iptables rules and other boilerplate config associated with that service will be deleted, so I had to use a script to periodically check the cmd line of current service instance, and if wrong, kill it and run the binary with the right cmd line without ever using servicestop...

here's the script, feel free to modify to ur needs...
Code:

#!/bin/sh

# $1 service name, $2 correct cmd line
fix_service()
{
  PID=$(ps | grep "$1" | grep -v "grep" | grep -v "fix_service" | sed -e 's/^ *//' | cut -d " " -f 1)
  if [ ! -z "$PID" ] && [ -f "/proc/$PID/cmdline" ] && [ "$(cat /proc/$PID/cmdline | tr -d ' ')" == "$(echo -n $2 | tr -d ' ')" ] && [ "$3" != "force" ]; then
    return 0
  fi

  [ ! -z "$PID" ] && kill -TERM $PID

  $2
  return 1
}

[ ! -z "$2" ] && sleep $2

fix_service "lighttpd" "lighttpd -f /jffs/lighttpd.conf" "$1"
fix_service "dnsmasq" "dnsmasq -u root -g root --conf-file=/tmp/dnsmasq.conf --cache-size=1500 --dhcp-option=252,http://wpad/wpad.dat" "$1"

Back to top View user's profile Send private message
Denna
DD-WRT User


Joined: 16 Sep 2016
Posts: 101
PostPosted: Tue Sep 27, 2016 19:32    Post subject: Reply with quote
ironmanlok,

Thanks for the detailed reply and script.

So if DNSMasq for DNS and Unbound are disabled in the Web GUI, running the Unbound binary with it's associated resolve.conf, iptables, startup scripts, etc. off of /jffs, that should be OK correct ?
_________________
Asus RT-AC88u running DD-WRT 12-15-2016-r30949
Back to top View user's profile Send private message
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum