DNScrypt Dnscrypt Proxy Installer For Asuswrt-Merlin(Nov.)

[SomeWhereOverTheRainBow]

For those wanting quick access for the thread that has been discontinued.
Dnscrypt Installer for Asuswrt (DI_VERSION="v2.1.7")
There are installation instructions on the page or users can simply use option di courtesy of our favorite AMTM provided by @thelonelycoder .
This installer evolved from Dnscrypt-Proxy originally to supporting the newer Dnscrypt-Proxy-2.
Features of the Installer:

• Dnscrypt-proxy version 2 with DoH and DNSCrypt version 2 protocols, multiple resolvers, and other features
• Running as nobody through nonroot binary (using --user requires change to passwd)
• Support ARM based routers
• Support OpenDNS dynamic IP update by entering your OpenDNS account information
• Handling ntp update at router boot up by starting dnscrypt-proxy with cert_ignore_timestamp option
• Redirect all DNS queries on your network to dnscrypt if user chooses to using DNS Filter Option
• Install haveged/rngd for better speed with dnscrypt and other cryptographic applications
• Support various HW RNG such as TrueRNG (tested with v3), TrueRNGpro, OneRNG, EntropyKey
• Ability to setup a swap file
• Ability to setup timezone file (/etc/localtime) used by dnscrypt-proxy and other apps
• Ability to reconfigure dnscrypt-proxy without reinstalling unlike previous installer for dnscrypt-proxy version 1.x.x
• Ability to configure anonymized relay support per Dnscrypt server through menu option or Wildcard Relay Support to cover all dnscrypt servers.
• Support for NextDNS.io Account SDNS stamp as Static server.
• Support for addition of multiple static servers using SDNS Stamp and Custom Server Naming - can be mixed with servers on the resolvers list.
• Improved Installer/Update Functions.
• Installer can Backup Entire Dnscrypt-Proxy Setup for quick restore.

This is mainly to reference for those who are wishing to see the status of this project.
Any future adjustment to this installer will focus more on the future developments released by Dnscrypt-Proxy-2.
For those that wish to follow the progress of dnscrypt-proxy 2, information can be found on their github:

GitHub - DNSCrypt/dnscrypt-proxy: dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols.

dnscrypt-proxy 2 - A flexible DNS proxy, with support for encrypted DNS protocols. - DNSCrypt/dnscrypt-proxy

github.com

 

[finite9]

where do I go for help with this now when the original thread has been shutdown for new comments? Im interested in knowing how to test that it's working. pidof is ok, but dnsleaktest.com is all over the place. it's not working, but i don't know how to troubleshoot it.

 

[Zastoff]

where do I go for help with this now when the original thread has been shutdown for new comments? Im interested in knowing how to test that it's working. pidof is ok, but dnsleaktest.com is all over the place. it's not working, but i don't know how to troubleshoot it.

Looks like you found the correct thread
What servers have you configured/chosen in your setup?
Edit
Some servers are cdn's (cloudflare quad9) and those will give many servers in dnsleaktest.
And for example sth-dnscrypt server use all server in public-resolvers.md on their end as a sort of increased privacy (confusing in dnsleaktests).

 

[SomeWhereOverTheRainBow]

Ping @Zastoff

where do I go for help with this now when the original thread has been shutdown for new comments? Im interested in knowing how to test that it's working. pidof is ok, but dnsleaktest.com is all over the place. it's not working, but i don't know how to troubleshoot it.

When you say dnsleaktest.com is all over the place? can you post a screen shot of what you mean? to me, this sounds like you have it configured to automatic. which is the path i believe @Zastoff is heading down.

 

[finite9]

This is what I install (Ive also installed options 4,6 & 8 after the initial install):

ASUSWRT-Merlin RT-AC68U 384.14-0 Sat Dec 14 00:39:28 UTC 2019
admin@RT-AC68U-09F0:/tmp/home/root# curl -L -s -k -O https://raw.githubusercontent.com/thuantran/dnscrypt-asuswrt-in
staller/master/installer && sh installer ; rm installer
Info:  Detected ARMv7 architecture.
Info:  JFFS custom scripts and configs are already enabled
Info:  DNS Environment is Ready.
Info:  DI_VERSION=v2.1.6
Info:  DNSCRYPT_VER=2.0.44
Info:  Manager file is Up-To-Date!
Info:  Choose what you want to do:
  1) Install/Update dnscrypt-proxy
  2) Uninstall dnscrypt-proxy
  3) Configure dnscrypt-proxy
  4) Set timezone
  5) Unset timezone
  6) Install (P)RNG
  7) Uninstall (P)RNG
  8) Install swap file
  9) Uninstall ALL
  b) Backup
  q) Quit
=>  Please enter the number that designates your selection:, [1-9/b/q]: 3
Info:  This operation allows you to configure dnscrypt-proxy

=>  Do you want to proceed? [y/n]: y
Info:  Configuring dnscrypt-proxy...
Info:  Checking dnscrypt-proxy configuration...
[2020-11-11 13:27:25] [NOTICE] dnscrypt-proxy 2.0.44
[2020-11-11 13:27:25] [NOTICE] Dropping privileges
[2020-11-11 13:27:25] [NOTICE] Source [relays] loaded
[2020-11-11 13:27:25] [NOTICE] Source [public-resolvers] loaded
[2020-11-11 13:27:25] [NOTICE] Anonymized DNS: routing everything via [anon-sth-se anon-cs-se anon-dnscrypt.one]
[2020-11-11 13:27:25] [NOTICE] Configuration successfully checked
Info:  Found previous dnscrypt-proxy config file
Info:  How do you want to reconfigure:
Info:    1) Start from previous settings file
Info:    2) Start from default config
=>  Your selection, [1-2]: 2
Info:  Backing up previous settings file...
=>  Do you want to redirect all DNS resolutions on your network through this proxy? [y/n]: y
Info:  DNSFilter is Already on.
Info:  User can choose to keep any custom dnsfilter values and only redirect non-custom traffic.
=>  Do you want to redirect only SOME DNS resolutions on your network through this proxy? [y/n]: n
Info:  User chose to continue redirecting All DNS resolutions instead.
=>  Do you want to use DNS server over IPv6 (yes only if your connection has IPv6)? [y/n]: n
Info:  Choose DNS resolving load balancing strategy:
  1) p2 (default)
  2) ph
  3) first
  4) random
=>  Select your mode, [1-4]: 1
=>  Do you want to use load balance estimator to adjust resolvers based on latency calculations? [y/n]: y
Info:  Choose how your DNS servers are selected:
  1) Automatically
  2) Manually
  3) Static
=>  Select your mode, [1-3]: 1
=>  Use only servers that support the DNSCrypt protocol [y/n]: y
=>  Use only servers that support the DNS-over-HTTPS protocol [y/n]: y
=>  Use only servers that support DNSSEC [y/n]: y
=>  Use only servers that do not log user's queries [y/n]: y
=>  Use only servers that do not filter result [y/n]: n
=>  Do you want to choose which servers to disable (this can be a long process)? [y/n]: n
Info:  Continuing without disabling any DNS servers.
Info:  Set the DNS server(s) for initializing dnscrypt-proxy
Info:  and router services (e.g. ntp) at boot
=>  Default is 9.9.9.9:
=>  2nd Default is 8.8.8.8:
=>  Set log level, default is 2, 0 is the most verbose, [0-6]: 2
Info:  Writing dnscrypt-proxy configuration...
Info:  Evaluating other possibilities for dnscrypt-proxy configuration...
Info:  Checking for Anonymized Dnscrypt Support
Info:  Users may specify Wild-card Relay Support (server_name *) with option 1 (this supports only DNSCrypt Servers).
* Warning:  All DNSCRYPT Server traffic will be sent through same set of chosen Relays with Wild-Card Option.
Info:  Option 2 gives users the choice to Setup Relays per Dnscrypt-Server.
Info:  Option 3 allows the users to skip relay configuration or remove old relays configurations.
* Warning:  Option 1 & 2 delete old relay configurations.
* Warning:  Issues may occur if user is not using same servers as defined in relays.
Info:  What do you want to do:
  1) All Servers with Wild-Card Relay Support.
  2) Pick Relays for DNSCRYPT servers (Per Server).
  3) Skip Setting-up/Modifying Relay Support.
=>  Your choice, [1-3]: 1
Info:  This allows users to setup wildcard relay support for all compatible servers
=>  Do you want to skip using incompatible resolvers instead of using them directly? [y/n]: y
Info:  Available Relay servers:
  1) anon-acsacsar-ams-ipv4: Anonymized DNS relay hosted in AMS on Scaleway
  2) anon-ams-nl: Anonymized DNS relay hosted in Netherlands - NL
  3) anon-bcn: Anonymized DNS relay hosted in Barcelona, Spain.
  4) anon-cs-ca2: Anonymized DNS relay hosted in CA - Vancouver provided by https://cryptostorm.is/
  5) anon-cs-de2: Anonymized DNS relay hosted in Frankfurt, Germany provided by https://cryptostorm.is/
  6) anon-cs-fr: Anonymized DNS relay hosted in Paris, France provided by https://cryptostorm.is/
  7) anon-cs-fr2: Anonymized DNS relay hosted in Paris, France (secondary) provided by https://cryptostorm.is/
  8) anon-cs-md: Anonymized DNS relay hosted in Chisinau, Moldova provided by https://cryptostorm.is/
  9) anon-cs-nl: Anonymized DNS relay hosted in Roosendaal, Netherlands provided by https://cryptostorm.is/
  10) anon-cs-nl2: Anonymized DNS relay hosted in Rotterdam, Netherlands provided by https://cryptostorm.is/
  11) anon-cs-pt: Anonymized DNS relay hosted in Lisbon, Portugal provided by https://cryptostorm.is/
  12) anon-cs-se: Anonymized DNS relay hosted in Stockholm, Sweden provided by https://cryptostorm.is/
  13) anon-cs-sk: Anonymized DNS relay hosted in South Korea provided by https://cryptostorm.is/
  14) anon-cs-usca: Anonymized DNS relay hosted in US - Los Angeles, CA provided by https://cryptostorm.is/
  15) anon-cs-usga: Anonymized DNS relay hosted in US - Atlanta, GA provided by https://cryptostorm.is/
  16) anon-cs-usnc: Anonymized DNS relay hosted in US - Charlotte, NC provided by https://cryptostorm.is/
  17) anon-cs-usnv: Anonymized DNS relay hosted in US - Las Vegas, NV provided by https://cryptostorm.is/
  18) anon-cs-usor: Anonymized DNS relay hosted in US - Roseburg, OR provided by https://cryptostorm.is/
  19) anon-cs-ustx: Anonymized DNS relay hosted in US - Dallas, TX provided by https://cryptostorm.is/
  20) anon-dnscrypt.one: Anonymized DNS relay hosted in Germany (Nuremberg), https://dnscrypt.one
  21) anon-dnscrypt.uk-ipv4: Anonymized DNS relay hosted in UK on DigitalOcean
  22) anon-ev-to: Anonymized DNS relay provided by evilvibes.com Location: Toronto, Canada
  23) anon-ev-va: Anonymized DNS relay provided by evilvibes.com Location: Vancouver, Canada
  24) anon-ibksturm: Hosted in Switzerland and maintained by @ibksturm, aka Andreas Ziegler.
  25) anon-inconnu: Anonymized DNS relay hosted in Seattle, WA (USA), maintained by Eric
  26) anon-kama: Anonymized DNS relay hosted in France and maintained by Frank Denis (@jedisct1).
  27) anon-meganerd: Anonymized DNS relay hosted by MegaNerd.nl (https://www.meganerd.nl/encrypted-dns-server) in Amsterdam, The Netherlands
  28) anon-plan9-dns: Anonymized DNS relay hosted in New Jersey, USA. Running the official Docker image on Vultr by @jlongua1
  29) anon-publicarray: Anonymized DNS relay hosted in Sydney, Australia and maintained by Sebastian Schmidt (@publicarray)
  30) anon-scaleway: Anonymized DNS relay hosted in France and maintained by Frank Denis (@jedisct1).
  31) anon-scaleway-ams: Anonymized DNS relay hosted in Amsterdam and maintained by Frank Denis (@jedisct1).
  32) anon-skyfighter: Anonymized DNS relay hosted in Netherlands (https://scaleway.com) and maintained by @tuttimann.
  33) anon-sth-se: Anonymized DNS relay hosted in Sweden - SE
  34) anon-tiarap: Anonymized DNS relay hosted in Singapore
  35) anon-v.dnscrypt.uk-ipv4: Anonymized DNS relay hosted in UK on Vultr
  36) anon-yofiji-se-ipv4: Anonymized DNS relay hosted in Sweden and maintained by yofiji.
=>  Please choose RELAY server, [1-36]: 12
=>  Please choose next RELAY server or press n to stop, [1-36/n]: 33
=>  Please choose next RELAY server or press n to stop, [1-36/n]: 5
=>  Please choose next RELAY server or press n to stop, [1-36/n]: n
Info:  Checking dnscrypt-proxy configuration...
[2020-11-11 13:29:27] [NOTICE] dnscrypt-proxy 2.0.44
[2020-11-11 13:29:27] [NOTICE] Dropping privileges
[2020-11-11 13:29:27] [NOTICE] Source [public-resolvers] loaded
[2020-11-11 13:29:27] [NOTICE] Source [relays] loaded
[2020-11-11 13:29:27] [NOTICE] Anonymized DNS: routing everything via [anon-cs-se anon-sth-se anon-cs-de2]
[2020-11-11 13:29:27] [NOTICE] Configuration successfully checked
Info:  Restarting dnscrypt-proxy with new config...
Info:  Operation completed. You can quit or continue
=====================================================

Ive taken away the configuration of my ISP's DNS servers that I had manually entered into the webgui. Im still getting DNS so something is working.

pidof dnscrypt-proxy gives:
27099

I've not yet restarted my router.

when I visit dnsleaktest.com, it says Welcome visitor from <hometown, country>, which is spot on my little village. Not impressed. (EDIT: errr maybe im misinterpretting how DNSCrypt works?)
When I do the standard test it shows:

leak test

 

[SomeWhereOverTheRainBow]

This is what I install (Ive also installed options 4,6 & 8 after the initial install):

=>  Do you want to use load balance estimator to adjust resolvers based on latency calculations? [y/n]: y
Info:  Choose how your DNS servers are selected:
  1) Automatically
  2) Manually
  3) Static
=>  Select your mode, [1-3]: 1
=>  Use only servers that support the DNSCrypt protocol [y/n]: y
=>  Use only servers that support the DNS-over-HTTPS protocol [y/n]: y
=>  Use only servers that support DNSSEC [y/n]: y
=>  Use only servers that do not log user's queries [y/n]: y
=>  Use only servers that do not filter result [y/n]: n
=>  Do you want to choose which servers to disable (this can be a long process)? [y/n]: n

That is normal because you told it to automatically select your servers. When you tell it automatic, it sends all your traffic through to every server on the list. So when you do dnsleaktest, you will see all those random servers pop up because your traffic is being sent to it.

=>  Do you want to use load balance estimator to adjust resolvers based on latency calculations? [y/n]: y
Info:  Choose how your DNS servers are selected:
  1) Automatically
  2) Manually
  3) Static
=>  Select your mode, [1-3]: 1
=>  Use only servers that support the DNSCrypt protocol [y/n]: y
=>  Use only servers that support the DNS-over-HTTPS protocol [y/n]: y
=>  Use only servers that support DNSSEC [y/n]: y
=>  Use only servers that do not log user's queries [y/n]: y
=>  Use only servers that do not filter result [y/n]: n
=>  Do you want to choose which servers to disable (this can be a long process)? [y/n]: n

On the first page of the test you are still going to see it say Welcome to whatever your IP address is unless you are using a VPN server.

What is different is when you run the test you see all those different DNS servers. That is where your traffic is routed to. It is because you chose for it to automatic choose where your traffic is sent.

 

[finite9]

Yes, it was probably me misinterpretting everything. If I run

/jffs/scripts/services-stop

to shutdown dnscrypt, then I can no longer ping a server from my PC. As soon as I start it again I can ping again.

Im not sure how to interpret dnsleaktest.com. I thought all the servers were supposed to be from the resolvers?

 

[finite9]

ok, thanks for the clarification. Have I chosen sane defaults or do people usually set other options during the install? And how to I test if DoH/DoT is working if I've only chosen servers that support those?

 

[SomeWhereOverTheRainBow]

ok, thanks for the clarification. Have I chosen sane defaults or do people usually set other options during the install? And how to I test if DoH/DoT is working if I've only chosen servers that support those?

Well not every server has their own legitimacy test, but you can rest assured that all servers listed are infact whatever protocol they support. Cloudflare is one server i can think of you can actually test. https://1.1.1.1/help ,but it wont work if you have dnssec turned on manually in the gui settings because their test does not like dnssec validation. If you use option 2 for choosing servers, you can actually pick which servers you want to use from a list.

 

[finite9]

I found the performance of my internet dropped significantly (random delays in accessing web sites or within apps in iOS devices), so i've been testing different options. I turned off the relays, and I chose my servers manually to be servers in my own country (sweden), and only chose max 2 servers. I get mixed results... Im just using ping to judge the results and I dont know if thats the best way, but pinging google.se and amazon.se is 39ms with dnscrypt servers and <10ms for super local resources like netnod.se or kth.se. turn off dnscrypt (by uninstalling it) and bouncing my network card, and I get 10ms for google.se and the local swedish sites but still 39ms for amazon.se. Cant seem to get any better than 10ms for anything, but on my local network pinging the router is .3ms most of the time. is 10ms a good ping time for Internet sites?

with my ISP DNS servers, web sites load instantly. using DNScrypt there is a very noticeable delay in initial load times (maybe 1-2s) and i get continued delays as the pages load. Is this dependent on getting a fast DNS server configured in dnscrypt? My understanding is that the pages are loading noticeably slower because there are several domain lookups when browing a standard page to get all that sites resources, so the faster the DNS response the faster the page load time?

So my question is, does anyone know of Swedish DNScrypt servers that have high performance?

Next question is: whats the difference between scripting in the dnscrypt installation as per this guide, and just choosing the asuswrt-merlin gui options in 384.14 in the WAN tab DNS settings? There I can choose DNSSEC/DoT, add quad9 or cloudfare or adult-filtered servers etc. What benefit does this script give over the gui options?

 

[Zastoff]

I found the performance of my internet dropped significantly (random delays in accessing web sites or within apps in iOS devices), so i've been testing different options. I turned off the relays, and I chose my servers manually to be servers in my own country (sweden), and only chose max 2 servers. I get mixed results... Im just using ping to judge the results and I dont know if thats the best way, but pinging google.se and amazon.se is 39ms with dnscrypt servers and <10ms for super local resources like netnod.se or kth.se. turn off dnscrypt (by uninstalling it) and bouncing my network card, and I get 10ms for google.se and the local swedish sites but still 39ms for amazon.se. Cant seem to get any better than 10ms for anything, but on my local network pinging the router is .3ms most of the time. is 10ms a good ping time for Internet sites?

with my ISP DNS servers, web sites load instantly. using DNScrypt there is a very noticeable delay in initial load times (maybe 1-2s) and i get continued delays as the pages load. Is this dependent on getting a fast DNS server configured in dnscrypt? My understanding is that the pages are loading noticeably slower because there are several domain lookups when browing a standard page to get all that sites resources, so the faster the DNS response the faster the page load time?

So my question is, does anyone know of Swedish DNScrypt servers that have high performance?

Next question is: whats the difference between scripting in the dnscrypt installation as per this guide, and just choosing the asuswrt-merlin gui options in 384.14 in the WAN tab DNS settings? There I can choose DNSSEC/DoT, add quad9 or cloudfare or adult-filtered servers etc. What benefit does this script give over the gui options?

Sweden here also, I use anonymized DNSCrypt(relays) and it feels fast for me.
What i use at the moment:

routes = [ { server_name='*', via=['anon-sth-se', 'anon-cs-se', 'anon-yofiji-se-ipv4'] } ]

Isp`s DNS servers will always be one of the fastest option or Unbound manager (running sort of your own dns server)
DNSCrypt, DoH and DoT adds encryption and more security that dns will not be tampered with even more so with DNSSec enabled but a bit slower(Don`t know if i notice it thou) DNSCrypt protocol is faster then DoH & DoT i think (not 100% on that)
The DNS over TLS in firmware gui is a good option, Less server to choose from, almost no info in syslog.
DNSCrypt-proxy has more options, Load balancing (4 different), Good info in syslog and some extra features that helps to prevent fingerprinting devices and more (wiki)

 

[SomeWhereOverTheRainBow]

I found the performance of my internet dropped significantly (random delays in accessing web sites or within apps in iOS devices), so i've been testing different options. I turned off the relays, and I chose my servers manually to be servers in my own country (sweden), and only chose max 2 servers. I get mixed results... Im just using ping to judge the results and I dont know if thats the best way, but pinging google.se and amazon.se is 39ms with dnscrypt servers and <10ms for super local resources like netnod.se or kth.se. turn off dnscrypt (by uninstalling it) and bouncing my network card, and I get 10ms for google.se and the local swedish sites but still 39ms for amazon.se. Cant seem to get any better than 10ms for anything, but on my local network pinging the router is .3ms most of the time. is 10ms a good ping time for Internet sites?

with my ISP DNS servers, web sites load instantly. using DNScrypt there is a very noticeable delay in initial load times (maybe 1-2s) and i get continued delays as the pages load. Is this dependent on getting a fast DNS server configured in dnscrypt? My understanding is that the pages are loading noticeably slower because there are several domain lookups when browing a standard page to get all that sites resources, so the faster the DNS response the faster the page load time?

So my question is, does anyone know of Swedish DNScrypt servers that have high performance?

Next question is: whats the difference between scripting in the dnscrypt installation as per this guide, and just choosing the asuswrt-merlin gui options in 384.14 in the WAN tab DNS settings? There I can choose DNSSEC/DoT, add quad9 or cloudfare or adult-filtered servers etc. What benefit does this script give over the gui options?

I cannot tell you the benefits of one versus the other that is for you to decide, but the dnscrypt-proxy using cloud flare as server uses DoH, the routers gui using cloud flare as server uses DoT or as plaintext only. Your use depends on if you prefer DoH or DoT. BTW you also have the option to use dnscrypt protocol with quad 9 or DoH with quad 9 using this script. Using the gui you only have the option for DoT or plain text

 

[SomeWhereOverTheRainBow]

RELEASE (DI_VERSION="v2.1.7")

• Overall improvements to the installer (the installer has a new feel).

 

[Zastoff]

RELEASE (DI_VERSION="v2.1.7")

• Overall improvements to the installer (the installer has a new feel).

Love the new look and feel of the Installer, Works great !
Big Thanks @SomeWhereOverTheRainBow

 

[rankok]

Hi,

I have configured dnscrypt-proxy and it is working fine. The only problem I have is that it does not start automatically after router boot.

Probably something simple I am missing but I dont see it

using Asus RT-AC87U: amtm 3.1.8, dnscrypt-proxy 1.9.5

Any help is appreciated,
Ranko

 

[SomeWhereOverTheRainBow]

Hi,

I have configured dnscrypt-proxy and it is working fine. The only problem I have is that it does not start automatically after router boot.

Probably something simple I am missing but I dont see it

using Asus RT-AC87U: amtm 3.1.8, dnscrypt-proxy 1.9.5

Any help is appreciated,
Ranko

Did you install dnscrypt proxy with the installer or by using entware? Can you send some logs so I can inspect what may be preventing it from starting at reboot? Uninstaller the entware version and use the version amtm supplies by typing in di into the amtm terminal. This will install the one supplied by amtm which is much newer than version 1.9.5 and is already configured to work at reboot. All you need to do is pick the servers you want to use. Note you will have to remove your old dnscrypt configuration as this script installs much newer more sufficient version.

 

[rankok]

@SomeWhereOverTheRainBow
First of all, thank you for the fast answer.

Did you install dnscrypt proxy with the installer or by using entware?

I install it by using AMTM.

Can you send some logs so I can inspect what may be preventing it from starting at reboot?

Yes, I can send you the log, no problem, I'll send to you right now. I'll send in PM.

Note you will have to remove your old dnscrypt configuration as this script installs a much newer more sufficient version.

As I am in the testing phase I will remove all (AMTM) and format /jffs and try it all over again.

it would be very significant for me to learn what the problem is and how to make it work edit: will wait for you check Syslog first

Best regards

 

[SomeWhereOverTheRainBow]

@SomeWhereOverTheRainBow
First of all, thank you for the fast answer.


I install it by using AMTM.


Yes, I can send you the log, no problem, I'll send to you right now. I'll send in PM.


As I am in the testing phase I will remove all (AMTM) and format /jffs and try it all over again.

it would be very significant for me to learn what the problem is and how to make it work edit: will wait for you check Syslog first

Best regards

What is inside your /jffs/scripts/dnsmasq.postconf script because this is what launches dnscrypt proxy. My next thought from examining your logs you may need to do a factory reset. It seems you have a lot of issues occuring at reboot than just a simple script not starting. It looks like there are several processes that are being hanged instead of starting potentially a corrupt jffs.. I would format JFFS and Factory reset starting with the basics.

 

[Zastoff]

New version of DNSCrypt-proxy v2 released--> 2.0.45
Update/install thru amtm & di
Note: A lot of changes in this version so recommend to reconfigure from a new config.

Also recommend doing a backup in the DNSCrypt installer or backup JFFS in webui before update, For easy rollback if something is not working with a newer version
Administration - Restore/Save/Upload Setting: Backup JFFS partition: Save

Restore JFFS backup if needed and reboot router

 

[SomeWhereOverTheRainBow]

Pushed Version v2.1.8 of the installer.
As mentioned in previous post, users will have to reconfigure with a new .TOML file if they plan to upgrade to 2.0.45.
This is due to changes made by dnscrypt-proxy 2 devs upstream. They have made several changes to the .TOML formatting. (including naming of blocked_names allowed_names, blocked_ips, etc.)

Release 2.0.45 · DNSCrypt/dnscrypt-proxy

Configuration changes (to be required in versions 2.1.x): [blacklist] has been renamed to [blocked_names] [ip_blacklist] has been renamed to [blocked_ips] [whitelist] has been renamed to [allowed_...

github.com