Customize stubby.yml

[lost_]

I understand the privacy implication, but I'd like to send the subnet EDNS in the DoT queries. I'm using Quad9 9.9.9.11 (ECS enabled).

It seems that is controlled by this line in /etc/stubby/stubby.yml

edns_client_subnet_private: 1

How do I permanently either remove this line, or set it to 0?

 

[ColinTaylor]

https://github.com/RMerl/asuswrt-merlin.ng/wiki/Custom-config-files#postconf-scripts

/jffs/scripts/stubby.postconf

 

[lost_]

Thanks Colin! Forgot about that directory.

For those who want to configure DoT the same way:

cat /jffs/scripts/stubby.postconf

#!/bin/sh

CONFIG=$1
source /usr/sbin/helper.sh

pc_replace "edns_client_subnet_private: 1" "edns_client_subnet_private: 0" $CONFIG

With this, my subnet is provided to Quad9 (which I'm fine with and they don't log). The resolved hosts are now the ones closest to me. I've tested with and without EDNS. Without EDNS, facebook resolved to the one in California (33 ms), and with it, it's the one in Virginia (10 ms). YMMV.

(In WAN page, set DNS over TLS to 9.9.9.11 and hostname dns11.quad9.net. In LAN, set DNSFilter to router or however you need it)

 

[bbunge]

In /jffs/scripts create file stubby.postconf with contents:

#!/bin/sh
CONFIG=$1
source /usr/sbin/helper.sh
pc_replace "edns_client_subnet_private: 1" "edns_client_subnet_private: 0" $CONFIG

Change properties of the file to 755

Here are changes I make:

#!/bin/sh
CONFIG=$1
source /usr/sbin/helper.sh
pc_replace "round_robin_upstreams: 1" "round_robin_upstreams: 0" $CONFIG
pc_insert "tls_authentication: GETDNS_AUTHENTICATION_REQUIRED" "dnssec_return_status: GETDNS_EXTENSION_TRUE" $CONFIG

The last line enables DNSSEC validation to be done by Stubby. With this enabled disable DNSSEC in the router WAN settings.

 

[lost_]

bbunge, thanks for those 2 entries in your change.

 

[NoLight]

I'm trying to do this exact thing with a RT-AX86U-PRO running ASUSWRT. It seems that it's only possible with Merlin, unless I'm doing something wrong?

Sorry to bump this old thread.

 

[ColinTaylor]

Stock Asus firmware doesn't support custom scripts.

 

[AsusFreak]

Hi,
I have now set this up for my Asus AX86U with Asuswrt-Merlin as described here.

Created a “stubby.postconf” in the “scripts” folder with the rights “755”. Then set up my preferred DNS provider under “WAN - Internet Connection - WAN DNS Settings” and set my devices to “Router” under “Global Redirection” under “LAN - DNS Director”.

Is this correct and how do I know if it works?

 

[NoLight]

Hi,
I have now set this up for my Asus AX86U with Asuswrt-Merlin as described here.

Created a “stubby.postconf” in the “scripts” folder with the rights “755”. Then set up my preferred DNS provider under “WAN - Internet Connection - WAN DNS Settings” and set my devices to “Router” under “Global Redirection” under “LAN - DNS Director”.

Is this correct and how do I know if it works?

https://www.dnscheck.tools/ will tell you