What's new

DNScrypt dnscrypt installer for asuswrt

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Aug 8 02:02:20 dnscrypt-proxy[482]: Too many connections (max=250)
Aug 7 22:03:25 dnsmasq[26702]: Maximum number of concurrent DNS queries reached (max: 150)
I've been getting those errors lately. It's making the router unuseable. I think the CPU is 100%peg. I could not log on. Anyone here know how I can diagnose the attempts?
 
I also noticed that in the config file you have set cert_ignore_timestamp = true in the global settings..... does this mean this setting is maintained even after ntp is valid?

Digging around i found the answer to this query if anyone was wondering..

  • Adding 'cert_ignore_timestamp = true' to config file will result in the same effect as -I in dnscrypt-proxy version 1.
  • The flag will be automatically clear if dnscrypt-proxy v2 connects to a server with correct timestamp.
It ignores the timestamp when fetching certificates the first time, but then the flag will automatically turns itself off, since you will probably have a properly set clock afterwards.
 
Aug 8 02:02:20 dnscrypt-proxy[482]: Too many connections (max=250)
Aug 7 22:03:25 dnsmasq[26702]: Maximum number of concurrent DNS queries reached (max: 150)
I've been getting those errors lately. It's making the router unuseable. I think the CPU is 100%peg. I could not log on. Anyone here know how I can diagnose the attempts?

I came here for the same issue. Also running an ac-68u, running 384.5. I see it from time to time, usually just one line, not always repeated entries like below.

Code:
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
 
I came here for the same issue. Also running an ac-68u, running 384.5. I see it from time to time, usually just one line, not always repeated entries like below.

Code:
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
Aug 10 09:23:37 dnscrypt-proxy[27431]: Too many connections (max=250)
It is hard to see 250 concurrent dns queries unless you have a lot of users surfing net at same time. If not your devices may have been affected by malware making multiple dns queries like advertisement in the background etc.

Try see your dnsmasq log to see which devices is making all these queries. If your dns queries is genuine, then you can edit the toml to increase the connection higher. But it will also mean more resources will be utilised making router unstable.
 
It is hard to see 250 concurrent dns queries unless you have a lot of users surfing net at same time. If not your devices may have been affected by malware making multiple dns queries like advertisement in the background etc.

Try see your dnsmasq log to see which devices is making all these queries. If your dns queries is genuine, then you can edit the toml to increase the connection higher. But it will also mean more resources will be utilised making router unstable.
I have this messages when skynet updates his lists. I think it is when creates ip from shared list of ab-solution.
when the issue occurs, this interrupts the banmalware update and i have to do it manually.
 
I have this messages when skynet updates his lists. I think it is when creates ip from shared list of ab-solution.
when the issue occurs, this interrupts the banmalware update and i have to do it manually.
@Adamm possible? Too much lookup at one time?
 
@Adamm possible? Too much lookup at one time?

I don't see this on my installation without dnscrypt. In any case the limit just needs to be raised in the config.

Code:
-0, --dns-forward-max={queries}
Set the maximum number of concurrent DNS queries. The default value is 150
which should be fine for most setups. The only known situation where this
needs to be increased is when using web-server log file resolvers, which can
generate large numbers of concurrent queries.
 
The reason this page does not work is because it is intended for a simpler purpose than has been assumed.

It is simply looking for your dns to be set to 1.1.1.1. !!!

If I change the DNS settings on windows 7 (Sp1) to 1.1.1.1 the 1st line of the 'Debug Information' box changes to 'Yes' !!!
[This means that dnsmasq & dnscrypt-proxy are completely missed out and the dns query goes directly to 1.1.1.1. This is not what we want.]

This page is setup to test the settings as per cloudflare's installation instructions (see https://1.1.1.1/ ) which does not mirror the setup we have on our routers.
Our routers have dnsmasq on port 53 (default unless changed) redirecting dns queries via dnscrypt-proxy on port 65053 (default unless changed).
The DNS Server address we use is the address of our router NOT 1.1.1.1 !!!

This page failing proves little in relation to the setup on our routers.

I can enable all the logs in the dnscrypt-proxy .toml file and 'prove' doh is working when this page 'fails'.
Thank you for this, makes sense now!

Can you give details on how to check in the logs to make sure doh is enabled on our dnscrypt setups?

Edit: In the logs obviously..*DOH* :p
 
Last edited:
Try see your dnsmasq log to see which devices is making all these queries. If your dns queries is genuine, then you can edit the toml to increase the connection higher. But it will also mean more resources will be utilised making router unstable.
How do I do all this? where's the log?
 
Wow - I've been struggling with this for like 4 hours now :/ - hoping someone can help me.

Let's start with the requested file:
https://drive.google.com/file/d/1rU1v1Dd5L2h0yddzix1evRHw-MPtVnTA/view?usp=sharing

Additional info:
- Which dns server you selected during dnscrypt installtion
Automatic (no go at all), and the Google Anycast (still problems - see below)
- Which router you're using
RT-AC68U
- Firmware and its version
Merlin 384.6

Ok - so...
Basically, I can't get this to run - stable at least.
I'm running an RT-AC68U with Firmware 384.6.
This was all loaded fresh last night, the entire device was reloaded.
I did however restore my config from my stock ASUS firmware to prevent having to setup all my port forwards.

I then installed ab-solution and a basic entware install onto a 1 GB USB flash drive (older, just something I had sitting around). I played around with that stuff for a while and it seemed to work great. I then download amtm and tried to install this dnscrypt script.

I had tons of issues at first with my internet (presumably dns) just stopping to work and then all sorts of memory errors when trying to run this script. It took me a while to figure out - or at least I thought I did. As I'll show it appears that even without a swap file I have plenty of free memory, so why this script should give me memory errors I have no idea. However even without those errors I get very erratic behavior.

This will be lengthy because I want to include everything you may need to assist.

Let's start with the memory errors I mention. I don't have the ones from the initial install, but this is a good example of what I was/am getting. This particular output was when I tried to run the installer again with the configure option while I was experiencing connection issues:

Code:
 Info:  This operation allows you to configure dnscrypt-proxy

 =>  Do you want to proceed? [y/n]: y
 Info:  Configuring dnscrypt-proxy...
 Info:  Checking dnscrypt-proxy configuration...
fatal error: runtime: out of memory

runtime stack:
runtime.throw(0x428843, 0x16)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/panic.go:616 +0x60 fp=0xbe97cb88 sp=0xbe97cb7c pc=0x3b658
runtime.sysMap(0xf870000, 0x1090000, 0x1f401, 0x6895c0)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mem_linux.go:227 +0x11c fp=0xbe97cbb4 sp=0xbe97cb88 pc=0x24e38
runtime.(*mheap).mapBits(0x67c820, 0x10900000)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mbitmap.go:160 +0x8c fp=0xbe97cbcc sp=0xbe97cbb4 pc=0x21954
runtime.(*mheap).setArenaUsed(0x67c820, 0x10900000, 0x700000)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mheap.go:545 +0x24 fp=0xbe97cbd8 sp=0xbe97cbcc pc=0x32a40
runtime.(*mheap).init(0x67c820, 0x700000, 0x200000)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mheap.go:530 +0x414 fp=0xbe97cbec sp=0xbe97cbd8 pc=0x326dc
runtime.mallocinit()
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/malloc.go:392 +0x1e0 fp=0xbe97cc30 sp=0xbe97cbec pc=0x1f5d0
runtime.schedinit()
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/proc.go:490 +0x58 fp=0xbe97cc60 sp=0xbe97cc30 pc=0x3deb8
runtime.rt0_go(0xbe97cdb1, 0xbe97cdcf, 0xbe97cdd6, 0xbe97cdde, 0x0, 0xbe97ce01, 0xbe97ce0c, 0xbe97ce2d, 0xbe97ce35, 0xbe97ce40, ...)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/asm_arm.s:159 +0x7c fp=0xbe97cca0 sp=0xbe97cc60 pc=0x692e4
 Info:  Move invalid configuration file to /jffs/dnscrypt/dnscrypt-proxy.toml.err
 Info:  Operation will continue with clean config file
 =>  Do you want to redirect all DNS resolutions on your network through this proxy? [y/n]:

I immediately exited from this and looked at my free memory:

Code:
admin@RT-AC68U-4C30:/jffs/scripts# free
             total       used       free     shared    buffers     cached
Mem:        255700     101024     154676          0        356      11140
-/+ buffers/cache:      89528     166172
Swap:            0          0          0

So you can see I had disabled my swap however there appears plenty of free memory - I don't see how this is the issue. Onto the next problem...

It seems I am only able to get things working (or at least the semblance of working - I am able to get to the internet) when choosing the "google: Google DNS (anycast)" server as "Manual" during the install. Any attempt I make to use the "Automatic" option leaves me unable to communicate out. When I do get things working - it isn't for long. I observe the following running after a successful install:

Code:
 4444 admin     777m S    /jffs/dnscrypt/dnscrypt-proxy -syslog -config /jffs/dnscrypt/dnscrypt-proxy.toml
 4463 admin     1424 S    {manager} /bin/sh /jffs/dnscrypt/manager monitor-start
 4477 nobody    778m S    /jffs/dnscrypt/dnscrypt-proxy -syslog -config /jffs/dnscrypt/dnscrypt-proxy.toml -child

However anywhere from 30 seconds to a few minutes I will no longer be able to get out to any sites. When I look at running processes, all I see is:

Code:
admin@RT-AC68U-4C30:/jffs/scripts# ps | grep dnscrypt
 4444 admin     777m S    /jffs/dnscrypt/dnscrypt-proxy -syslog -config /jffs/dnscrypt/dnscrypt-proxy.toml
 4463 admin     1424 S    {manager} /bin/sh /jffs/dnscrypt/manager monitor-start

So it appears the "-child" process is killed some how - and I'm guessing that's important :/ ?

One strange thing (to me) is that when in this state I am unable to ping any sites at all with the exception of google.com. I have checked and this information is not cached anywhere on my windows client - so I'm not sure why this behavior exists. Perhaps it has something to do with the fact that I have set using the Google server or 8.8.8.8 during the config? Not sure - but wanted to mention it.

So that's where I'm at. I'm at a total loss and have spend a lot of time getting this to load on what I would consider a pretty basic merlin install. I do have a couple of closing questions too to help in my understanding troubleshooting:

1) "Do you want to redirect all DNS resolutions on your network through this proxy? [y/n]:" - What does this mean? What is the difference of selecting yes/no here? My only guess is that if I set "n" then only my clients which are pointed to use this DNS server will go through proxy, whereas if I say "y" then the router will actually intercept ALL DNS queries that pass through it even if those clients aren't configured to use it? Please explain.

2) Why is the RNG and/or Timezone so important for this?

3) How can I stop/start these services manually while troubleshooting, or if they crash? Right now the only thing I can do that works is either reboot the device or do an uninstall/reinstall.

4) How can you determine if this is actually working (apart from being able to get out to the internet)?
The OP says to type:
Code:
nslookup -type=txt debug.opendns.com
but my output from that (even when everything else works) is:
Code:
C:\Users\xxxxxx> nslookup -type=txt debug.opendns.com
Server:  router.asus.com
Address:  10.10.10.1

*** No text (TXT) records available for debug.opendns.com

I'm going to re-enable my swap file...even though I can't see how that's the issue and do a reinstall with the settings that worked for me and see if I'm still getting crashes. If not, and we say its a memory issue - how could it possibly be with so much memory showing available?

Thanks in advance for all the help I'll need! :)
 
Is it possible to bypass DNSCrypt on one device and add 2 custom DNS servers? Sometimes I want to watch netflix in another region and the only possible way I found out without removing dnscrypt is to use DNS Filtering and even then it only allows me to enter one single IP.
 
Your problem may be that you restored the config from the stock Asus. Start over with a fresh factory initialize.
Wow - I've been struggling with this for like 4 hours now :/ - hoping someone can help me.

Let's start with the requested file:
https://drive.google.com/file/d/1rU1v1Dd5L2h0yddzix1evRHw-MPtVnTA/view?usp=sharing

Additional info:
- Which dns server you selected during dnscrypt installtion
Automatic (no go at all), and the Google Anycast (still problems - see below)
- Which router you're using
RT-AC68U
- Firmware and its version
Merlin 384.6

Ok - so...
Basically, I can't get this to run - stable at least.
I'm running an RT-AC68U with Firmware 384.6.
This was all loaded fresh last night, the entire device was reloaded.
I did however restore my config from my stock ASUS firmware to prevent having to setup all my port forwards.

I then installed ab-solution and a basic entware install onto a 1 GB USB flash drive (older, just something I had sitting around). I played around with that stuff for a while and it seemed to work great. I then download amtm and tried to install this dnscrypt script.

I had tons of issues at first with my internet (presumably dns) just stopping to work and then all sorts of memory errors when trying to run this script. It took me a while to figure out - or at least I thought I did. As I'll show it appears that even without a swap file I have plenty of free memory, so why this script should give me memory errors I have no idea. However even without those errors I get very erratic behavior.

This will be lengthy because I want to include everything you may need to assist.

Let's start with the memory errors I mention. I don't have the ones from the initial install, but this is a good example of what I was/am getting. This particular output was when I tried to run the installer again with the configure option while I was experiencing connection issues:

Code:
 Info:  This operation allows you to configure dnscrypt-proxy

 =>  Do you want to proceed? [y/n]: y
 Info:  Configuring dnscrypt-proxy...
 Info:  Checking dnscrypt-proxy configuration...
fatal error: runtime: out of memory

runtime stack:
runtime.throw(0x428843, 0x16)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/panic.go:616 +0x60 fp=0xbe97cb88 sp=0xbe97cb7c pc=0x3b658
runtime.sysMap(0xf870000, 0x1090000, 0x1f401, 0x6895c0)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mem_linux.go:227 +0x11c fp=0xbe97cbb4 sp=0xbe97cb88 pc=0x24e38
runtime.(*mheap).mapBits(0x67c820, 0x10900000)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mbitmap.go:160 +0x8c fp=0xbe97cbcc sp=0xbe97cbb4 pc=[emoji663]4
runtime.(*mheap).setArenaUsed(0x67c820, 0x10900000, 0x700000)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mheap.go:545 +0x24 fp=0xbe97cbd8 sp=0xbe97cbcc pc=0x32a40
runtime.(*mheap).init(0x67c820, 0x700000, 0x200000)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/mheap.go:530 +0x414 fp=0xbe97cbec sp=0xbe97cbd8 pc=0x326dc
runtime.mallocinit()
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/malloc.go:392 +0x1e0 fp=0xbe97cc30 sp=0xbe97cbec pc=0x1f5d0
runtime.schedinit()
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/proc.go:490 +0x58 fp=0xbe97cc60 sp=0xbe97cc30 pc=0x3deb8
runtime.rt0_go(0xbe97cdb1, 0xbe97cdcf, 0xbe97cdd6, 0xbe97cdde, 0x0, 0xbe97ce01, 0xbe97ce0c, 0xbe97ce2d, 0xbe97ce35, 0xbe97ce40, ...)
        /home/travis/.gimme/versions/go1.10.3.linux.amd64/src/runtime/asm_arm.s:159 +0x7c fp=0xbe97cca0 sp=0xbe97cc60 pc=0x692e4
 Info:  Move invalid configuration file to /jffs/dnscrypt/dnscrypt-proxy.toml.err
 Info:  Operation will continue with clean config file
 =>  Do you want to redirect all DNS resolutions on your network through this proxy? [y/n]:

I immediately exited from this and looked at my free memory:

Code:
admin@RT-AC68U-4C30:/jffs/scripts# free
             total       used       free     shared    buffers     cached
Mem:        255700     101024     154676          0        356      11140
-/+ buffers/cache:      89528     166172
Swap:            0          0          0

So you can see I had disabled my swap however there appears plenty of free memory - I don't see how this is the issue. Onto the next problem...

It seems I am only able to get things working (or at least the semblance of working - I am able to get to the internet) when choosing the "google: Google DNS (anycast)" server as "Manual" during the install. Any attempt I make to use the "Automatic" option leaves me unable to communicate out. When I do get things working - it isn't for long. I observe the following running after a successful install:

Code:
 4444 admin     777m S    /jffs/dnscrypt/dnscrypt-proxy -syslog -config /jffs/dnscrypt/dnscrypt-proxy.toml
 4463 admin     1424 S    {manager} /bin/sh /jffs/dnscrypt/manager monitor-start
 4477 nobody    778m S    /jffs/dnscrypt/dnscrypt-proxy -syslog -config /jffs/dnscrypt/dnscrypt-proxy.toml -child

However anywhere from 30 seconds to a few minutes I will no longer be able to get out to any sites. When I look at running processes, all I see is:

Code:
admin@RT-AC68U-4C30:/jffs/scripts# ps | grep dnscrypt
 4444 admin     777m S    /jffs/dnscrypt/dnscrypt-proxy -syslog -config /jffs/dnscrypt/dnscrypt-proxy.toml
 4463 admin     1424 S    {manager} /bin/sh /jffs/dnscrypt/manager monitor-start

So it appears the "-child" process is killed some how - and I'm guessing that's important :/ ?

One strange thing (to me) is that when in this state I am unable to ping any sites at all with the exception of google.com. I have checked and this information is not cached anywhere on my windows client - so I'm not sure why this behavior exists. Perhaps it has something to do with the fact that I have set using the Google server or 8.8.8.8 during the config? Not sure - but wanted to mention it.

So that's where I'm at. I'm at a total loss and have spend a lot of time getting this to load on what I would consider a pretty basic merlin install. I do have a couple of closing questions too to help in my understanding troubleshooting:

1) "Do you want to redirect all DNS resolutions on your network through this proxy? [y/n]:" - What does this mean? What is the difference of selecting yes/no here? My only guess is that if I set "n" then only my clients which are pointed to use this DNS server will go through proxy, whereas if I say "y" then the router will actually intercept ALL DNS queries that pass through it even if those clients aren't configured to use it? Please explain.

2) Why is the RNG and/or Timezone so important for this?

3) How can I stop/start these services manually while troubleshooting, or if they crash? Right now the only thing I can do that works is either reboot the device or do an uninstall/reinstall.

4) How can you determine if this is actually working (apart from being able to get out to the internet)?
The OP says to type:
Code:
nslookup -type=txt debug.opendns.com
but my output from that (even when everything else works) is:
Code:
C:\Users\xxxxxx> nslookup -type=txt debug.opendns.com
Server:  router.asus.com
Address:  10.10.10.1

*** No text (TXT) records available for debug.opendns.com

I'm going to re-enable my swap file...even though I can't see how that's the issue and do a reinstall with the settings that worked for me and see if I'm still getting crashes. If not, and we say its a memory issue - how could it possibly be with so much memory showing available?

Thanks in advance for all the help I'll need! :)

Sent from my P01M using Tapatalk
 
Several sites are not accessible with dnssec and doh. What's the next best option?

Or should I just avoid those?



I don't have 'rebind protection' on my 87U running 384.5.

Try choosing/find DNS servers that support Dnscrypt v2+DNSSEC or DoH+DNSSEC
 
Last edited:
Your problem may be that you restored the config from the stock Asus. Start over with a fresh factory initialize.

Sent from my P01M using Tapatalk

Ok I have built my router up from scratch after an "nvram erase."
All the issues I have reported a few posts up still apply.

Namely:
1) Dnscrypt crashes (and thus blocks all dns queries) unless I am using a swap file. This is the case even though virtually nothing else is running on the router (other an ab-solution) and "free" shows more than 50% memory free.
2) I am not able to do an nslookup test against opendns to see if dnscrypt is working. Thus I can't verify if anything is actually working (I don't know another way).
3) The only thing that seems resolved from previous post is that it seems I am able to use the "automatic" option instead of manually specifying a server.

The only type of test that I have performed which indicates there is something working is dnsleak.com will shows me a different dns server on every query.

Honestly I'm new to dnscrypt in general, so I'm not sure what I'm supposed to be seeing/testing to verify.
I'm also concerned that something is wrong with this version on my router as these out of memory messages and crashes are very strange considering that the system believes I have over 50% mem free.

Can someone assist on any of the above?

thanks.
 
Is there a way to run dnscrypt in such a way that if dnscrypt is not working for any reason that dns queries can still be serviced ? I know in that setup that dns leaks can and will occur but I rather that then having no internet access when dnscrypt decides to no work.
 
Is there a way to run dnscrypt in such a way that if dnscrypt is not working for any reason that dns queries can still be serviced ? I know in that setup that dns leaks can and will occur but I rather that then having no internet access when dnscrypt decides to no work.
The installer already have mechanism to check for dnscrypt availability. If in the event of disruption, likely due to the dns server you used you are using rather than dnscrypt-proxy itself. So choose your dns server wisely. Use the stable one.
 

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top