Have not encountered this before, not sure how to advise on this.
Sadly no..
Aug 16 09:24:57 admin: Start dnscrypt-proxy
Aug 16 09:24:57 dnscrypt-proxy[26255]: dnscrypt-proxy 2.0.44
Aug 16 09:24:57 dnscrypt-proxy[26255]: Network connectivity detected
Aug 16 09:24:57 dnscrypt-proxy[26255]: Dropping privileges
Aug 16 09:24:57 dnscrypt-proxy[26255]: Unable to drop additional groups: [function not implemented]
Aug 16 09:25:08 admin: Warning: dnscrypt-proxy is dead
Aug 16 09:25:08 admin: Start dnscrypt-proxy
Aug 16 09:25:08 dnscrypt-proxy[26477]: dnscrypt-proxy 2.0.44
Aug 16 09:25:08 dnscrypt-proxy[26477]: Network connectivity detected
Aug 16 09:25:08 dnscrypt-proxy[26477]: Dropping privileges
Aug 16 09:25:08 dnscrypt-proxy[26477]: Unable to drop additional groups: [function not implemented]
looks like your permissions may be messed up. post what the out put of
I have it uninstalled right now as it breaks my internet connection..
admin@RT-AX56U-2F78:/jffs/dnscrypt# ls -la
drwxrwxrwx 2 admin root 0 Aug 16 10:27 . drwxr-xr-x 12 admin root 0 Aug 16 10:27 ..
-rw-r--r-- 1 admin root 823 Jun 12 01:51 LICENSE
-rwxr-xr-x 1 admin root 8781824 Jun 12 01:55 dnscrypt-proxy
-rw-r--r-- 1 admin root 23575 Aug 16 10:27 dnscrypt-proxy.toml.err
-rw-r--r-- 1 admin root 897 Jun 12 01:51 example-blacklist.txt
-rw-r--r-- 1 admin root 1277 Jun 12 01:51 example-cloaking-rules.txt
-rw-r--r-- 1 admin root 23553 Jun 12 01:51 example-dnscrypt-proxy.toml
-rw-r--r-- 1 admin root 970 Jun 12 01:51 example-forwarding-rules.txt
-rw-r--r-- 1 admin root 457 Jun 12 01:51 example-ip-blacklist.txt
-rw-r--r-- 1 admin root 743 Jun 12 01:51 example-whitelist.txt
-rwxr-xr-x 1 admin root 68069 Aug 15 09:26 installer
-rw-r--r-- 1 admin root 2807 Jun 12 01:51 localhost.pem
-rw-r--r-- 1 admin root 392 Jan 24 2018 localtime
-rwxr-xr-x 1 admin root 4206 Aug 16 10:22 manager
-rw-r--r-- 1 nobody nobody 65522 Aug 15 18:27 public-resolvers.md
-rw-r--r-- 1 nobody nobody 307 Aug 15 18:27 public-resolvers.md.minisig
-rw-r--r-- 1 nobody nobody 6542 Aug 15 09:27 relays.md
-rw-r--r-- 1 nobody nobody 297 Aug 15 09:27 relays.md.minisig
-rw-r--r-- 1 admin root 17 Aug 16 10:26 resolv.dnsmasq
admin@RT-AX56U-2F78:/jffs/dnscrypt#listen_addresses = ['127.0.1.1:53']Yea i am not quite sure either, from my test it is working fine. I am only configured using a fresh . toml file. Could be a compatibility issue with this and the new ax56u because i noticed all of your file permissions are set to admin, this is usually suppose to be your admin user name for the router. My testing platform is the ax88u
You are using an older version of the .toml file the current .toml file uses their sources as
[sources]
## An example of a remote source from https://github.com/DNSCrypt/dnscrypt-resolvers
[sources.'public-resolvers']
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md']
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
prefix = ''
## Anonymized DNS relays
[sources.'relays']
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md', 'https://download.dnscrypt.info/resolvers-list/v3/relays.md']
cache_file = 'relays.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''
## Quad9 over DNSCrypt - https://quad9.net/
# [sources.quad9-resolvers]
# urls = ['https://www.quad9.net/quad9-resolvers.md']
# minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN'
# cache_file = 'quad9-resolvers.md'
# prefix = 'quad9-'
## Another example source, with resolvers censoring some websites not appropriate for children
## This is a subset of the `public-resolvers` list, so enabling both is useless
# [sources.'parental-control']
# urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/parental-control.md', 'https://download.dnscrypt.info/resolvers-list/v3/parental-control.md']
# cache_file = 'parental-control.md'
# minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'[sources]
## An example of a remote source from https://github.com/DNSCrypt/dnscrypt-resolvers
[sources.'public-resolvers']
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md']
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
prefix = ''
## Anonymized DNS relays
[sources.'relays']
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/relays.md', 'https://download.dnscrypt.info/resolvers-list/v2/relays.md']
cache_file = 'relays.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 72
prefix = ''
## Quad9 over DNSCrypt - https://quad9.net/
# [sources.quad9-resolvers]
# urls = ['https://www.quad9.net/quad9-resolvers.md']
# minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN'
# cache_file = 'quad9-resolvers.md'
# prefix = 'quad9-'
## Another example source, with resolvers censoring some websites not appropriate for children
## This is a subset of the `public-resolvers` list, so enabling both is useless
# [sources.'parental-control']
# urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v2/parental-control.md', 'https://download.dnscrypt.info/resolvers-list/v2/parental-control.md']
# cache_file = 'parental-control.md'
# minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'The biggest problem is dnscrypt-proxy devs continuously change the footprint of the .toml file. Just by changing a few operator words -- for example, when they changed the name of the whitelist and blacklist to allowed_names and blocked_names - this made it to where the .toml file was incompatible with their latest release as it requires the build to support those in the .toml file. For a temporary fix, I just push an update that allows the installer to update the example.toml when you run the install/update feature -- from there all you have to do is reconfigure using a new .toml file selection with the installer when prompted. This will place a .toml file with the correct V3 server list. Hopefully this will resolve this issue. Note: This is only a temporary fix until the next release at which time it will be removed.
user_name = 'nobody'That is correct for running it as well beause it runs as nobody under nonroot configuration. If you notice your server files use permission "nobody" at somepoint your dnscrypt proxy will crash if you comment out this line. Try reconfiguring with a new .toml file with the update i pushed. The problem was you are using v2 sources in .toml file while the installer is downloading v3.
BTW the installer sets it to false. Hopefully that is enough to tell you bigeyez stance as he was the one who added that as default.
Understood. Thanks for the explanation.
This script installs and manages dnscrypt-proxy on merlin asuswrt routers. Dnscrypt-proxy is a dns proxy that uses DoH and dnscrypt protocols/servers to serve dns to clients that are connected to the router. Basically it uses protocols that are classified as DNS Privacy. DNS Privacy protocols focus around encrypting the DNS traffic between you and the domain name server you are using. This encryption is there to prevent manipulation and spying on your DNS traffic by those who wish to do you harm, gain advantage, or control over you. Note this only protects your traffic between you and the dns server. It does not guarantee that the DNS service provider you are using has your best interest or is trust worthy. Also, it does not mean that your internet service provider cannot see your traffic either.
@SomeWhereOverTheRainBow :
Well unbound and dnscrypt-proxy are unrelated. Dnscrypt-proxy uses the concept of DNS-Privacy, while unbound uses dns obfuscation. With the dnsprivacy concept your traffic is encrypted between you and a DNS service provider and you place your trust in the provider for accurate information while still keeping that information private from outside prying eyes. Your DNS service provider gives you the responses about domains you request. With unbound, I use the term Dns obfuscation because when you use unbound you are acting as your own DNS server traveling the path of the domain asking root servers for information about the domain. You are your own server. Obviously with unbound your responses are in clear text, but you don't have to worry about trusting another dns server for responses since you are your own server. Your ISP can still sniff out your DNS traffic, but through obfuscation security features of unbound your traffic may not easy be to track, follow, or understand. This same logic applies to outside prying eyes- your traffic can be seen, but may not be easy to track, follow, or understand.
If you need a more detailed response please feel free to check out this thread
Thank you for the explanation. Much appreciated.
In both cases caching is done by dnsmasq unless it is disabled in dnsmasq. With dnscrypt-proxy installer dnscrypt-proxy cache gets disabled by default so dnsmasq can do the appropriate caching without conflict since dnsmasq is set to cache by default.
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
