Dnscrypt from opendns

amigohd · Jul 29, 2015

spalife said:
Take a look @
http://www.snbforums.com/threads/adding-unblock-us-dns-using-dnsmasq.8266/page-5

The suggestions / solutions discussed in that thread may be useful to your issue

thank you, it works

ryzhov_al · Aug 26, 2015

I removed my how-to from the second post, leaving a link to asuswrt-merlin wiki page. After adding fake-hwclock package installation of dnscrypt-proxy is simplified.

Secure DNS queries using DNSCrypt.

Make sure there is no errors in syslog after reboot:

Code:

...
Jan  1 03:00:15 pppd[315]: Connect: ppp0 <--> eth0
...
Jan  1 03:00:20 custom script: Running /jffs/scripts/post-mount (args: /tmp/mnt/OPT)
...
Aug 26 11:05:07 admin: Started dnscrypt-proxy from .
...
Aug 26 11:06:06 pppd[315]: System time change detected.

wheelq · Aug 26, 2015

Hi,

Is there a manual how to install this on optware? Is it possible?

ryzhov_al · Aug 26, 2015

Hi.

wheelq said:
Is there a manual how to install this on optware? Is it possible?

I see no dnscrypt-proxy package both in Optware and Optware-NG, sorry.

ASAT · Aug 26, 2015

wheelq said:
Is there a manual how to install this on optware? Is it possible?

Use the toolchain included with the Asuswrt-Merlin firmware to compile dnscrypt-proxy. Then you copy the binaries to /jffs/bin. No Optware or Entware required.

Calisro · Aug 26, 2015

wheelq said:
Hi,

Is there a manual how to install this on optware? Is it possible?

Or grab one compiled by @lancethepants . Don't forget to thank him.

http://files.lancethepants.com/Binaries/dnscrypt-proxy/

RogueSpear · Aug 26, 2015

It seems some of the previous steps are either not necessary anymore or they were forgotten in the re-write? For starters, I'm not sure how to configure dual resolvers anymore, but more importantly, this doesn't seem to be working for me. I'm just not resolving anything. I just signed up with Perfect Privacy to see if I get better performance than PIA has been giving me lately. They allegedly have some sort of secure DNS solution, so I think I'll give that a shot until this gets fleshed out a little more again.

wheelq · Aug 27, 2015

ryzhov_al said:
I removed my how-to from the second post, leaving a link to asuswrt-merlin wiki page. After adding fake-hwclock package installation of dnscrypt-proxy is simplified.

Secure DNS queries using DNSCrypt.

Make sure there is no errors in syslog after reboot:

Code:

... Jan 1 03:00:15 pppd[315]: Connect: ppp0 <--> eth0 ... Jan 1 03:00:20 custom script: Running /jffs/scripts/post-mount (args: /tmp/mnt/OPT) ... Aug 26 11:05:07 admin: Started dnscrypt-proxy from . ... Aug 26 11:06:06 pppd[315]: System time change detected.

I have sued this manual, no internet after reboot and in the lgos I can see issues with certificates...(same as in one of the first posts in this thread)

ASAT · Aug 27, 2015

RogueSpear said:
I'm not sure how to configure dual resolvers.

Here's my wiki mod. No Optware or Entware required.

/jffs/scripts/wan-start

Code:

#!/bin/sh
logger -t $(basename $0) "started [$$]"

/bin/pidof dnscrypt-proxy > /dev/null 2>&1 || \
(
  # Now resolve DNS name for NTP server
  ntp_name=$(nvram get ntp_server0)
  grep "$ntp_name" /jffs/configs/hosts.add > /dev/null 2>&1 || \
  for ip in $(/jffs/bin/hostip $ntp_name)
  do
    echo $ip $ntp_name >>  /jffs/configs/hosts.add
  done

  # restart NTP client to eliminate 4-5 mins delay
  killall ntp
  sleep 1
  service restart_dnsmasq
  service restart_ntpc
  sleep 5

  # wait up to 5 minutes to make sure the router has the correct time
  tmax=300
  i=0
  while [ $i -le $tmax ]
  do
    if [ "$(nvram get ntp_ready)" -eq "1" ]
    then
      break
    fi
    logger "Waiting for correct time to be set."
    sleep 1
    i=`expr $i + 1`
  done

  # dnscrypt-proxy requires the correct time for certificate validation
  /jffs/bin/dnscrypt-proxy --local-address=127.0.0.1:60053 --ephemeral-keys --resolver-name=dnscrypt.org-fr --resolvers-list=/jffs/bin/dnscrypt-resolvers.csv --daemonize
  /jffs/bin/dnscrypt-proxy --local-address=127.0.0.1:60054 --ephemeral-keys --resolver-name=soltysiak --resolvers-list=/jffs/bin/dnscrypt-resolvers.csv --daemonize
)

/jffs/configs/dnsmasq.conf.add

Code:

...
### dnscrypt
no-resolv
server=127.0.0.1#60053 # dnscrypt
server=127.0.0.1#60054 # dnscrypt
...

ILMostro · Sep 14, 2015

This little "how-to" spans over 13 pages now! Can somebody try to clarify this procedure and/or duplicate it consistently with success? I'm at a loss between one set of scripts and another, remove this, that, and the other...

Calisro · Sep 14, 2015

ILMostro said:
This little "how-to" spans over 13 pages now! Can somebody try to clarify this procedure and/or duplicate it consistently with success? I'm at a loss between one set of scripts and another, remove this, that, and the other...

If you are okay with the entware approach, then follow the wiki.

https://github.com/RMerl/asuswrt-merlin/wiki/Secure-DNS-queries-using-DNSCrypt

If you do not want to depend on entware, then you can probably use the post right above yours ASAT wrote.

ILMostro · Sep 14, 2015

I did follow the wiki, and it didn't work; so I tried to follow the discussions in this thread and got lost in its maze. That's why I'm asking for clarification, thinking that after 13 pages of discussion the kinks were worked out.

Calisro · Sep 14, 2015

@ILMostro I see you updated that wiki. The steps you added shouldn't be neccessaary. With fak-hwclock the existing ntp will work fine as it will take the existing time from before the reboot and dnscrypt won't fail on the cert verification any longer.

#!/bin/sh

for ip in $(/opt/bin/hostip $(nvram get ntp_server0))
do
echo $ip $(nvram get ntp_server0) >> /etc/hosts
done

Calisro · Sep 14, 2015

Since you're going to use entware, here is how it should work and I agree the wiki could use some updates considering it is entirely missing the actual configuration set up for dnscrypt-proxy itself.

1) Install fa ke_hwclock
2) After you install fak e-hwclock. You should reboot and verify from your /tmp/syslog.log that the clock was set very quickly after boot.
3) Now set up dnscrypt. For this you need to edit the config files for dnscrypt in /opt. check the /tmp/syslog.log to verify its working.
4) Once the dnscrypt daemon is working (check the /tmp/syslog.log to verify) change dnsmasq to use it as a resolver like so:

echo "no-resolv" > /jffs/configs/dnsmasq.conf.add
echo "server=127.0.0.1#65053" >> /jffs/configs/dnsmasq.conf.add

5) Then you reboot and verify again.

I'd update the wiki but I am running a slightly modified version of this with static binaries rather than entware itself but the premise is hte same.

ILMostro · Sep 14, 2015

Thanks for the update; however, I'm not able to see your changes to the wiki.

ILMostro · Sep 14, 2015

My problem might be stemming from my PATH variable. `dnscrypt` updates the PATH to prepend /opt/bin:/opt/sbin, but then "/opt/bin:/opt/sbin" is appended to the PATH at the end by default. So, prepending the custom directory might not have any effect if it's called again AFTER the primary system's bin directories again.

Code:

PATH=/opt/bin:/opt/sbin:/bin:/usr/bin:/sbin:/usr/sbin:/home/ilmostro:/mmc/sbin:/mmc/bin:/mmc/usr/sbin:/mmc/usr/bin:/opt/sbin:/opt/bin:/opt/usr/sbin:/opt/usr/bin

Calisro · Sep 14, 2015

ILMostro said:
Thanks for the update; however, I'm not able to see your changes to the wiki.

I haven't/can't update the wiki as I am running a very different config than standard... My comments above though is essentially it. The fa ke-hwclock makes it pretty easy after the first reboot.

My suggestion is to do it all in phases starting fa_ke-hwclock. Verify that is functioning before playing with dnscrypt.

ILMostro · Sep 14, 2015

In terms of customizing the dnscrypt-related files in "/opt/", I'm not sure what, if anything, should be changed.

Code:

:/# cat /opt/etc/init.d/S09dnscrypt-proxy
#!/bin/sh

ENABLED=yes
PROCS=dnscrypt-proxy
ARGS="--local-address=127.0.0.1:65053 --daemonize -R opendns"
PREARGS=""
DESC=$PROCS
PATH=/opt/sbin:/opt/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

. /opt/etc/init.d/rc.func

Calisro · Sep 14, 2015

ILMostro said:
In terms of customizing the dnscrypt-related files in "/opt/", I'm not sure what, if anything, should be changed.

Code:

:/# cat /opt/etc/init.d/S09dnscrypt-proxy #!/bin/sh ENABLED=yes PROCS=dnscrypt-proxy ARGS="--local-address=127.0.0.1:65053 --daemonize -R opendns" PREARGS="" DESC=$PROCS PATH=/opt/sbin:/opt/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin . /opt/etc/init.d/rc.func

That looks fine if you want to use opendns. you can change it later. For now verify on boot that your clock is set correctly very early in your syslog.log after boot. That way we know the fa_ke-hwclock.is working. That is neccessary dependency.

ILMostro · Sep 14, 2015

Something like this?

Code:

:/tmp/home/root# dmesg |grep -i clock
CCA UART Clock rate 100000000Hz
Switching to clocksource mpcore_gtimer

Actually, that might not be it....

Dnscrypt from opendns

Regular Contributor

Very Senior Member

Regular Contributor

Very Senior Member

Senior Member

Senior Member

Occasional Visitor

Regular Contributor

Senior Member

Occasional Visitor

Senior Member

Occasional Visitor

Senior Member

Senior Member

Occasional Visitor

Occasional Visitor

Senior Member

Occasional Visitor

Senior Member

Occasional Visitor

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest