Help configuring and testing DNS-over-TLS on 384.13

[djphilosophy]

I'm trying to setup DNS over TLS on 384.13. Both the Cloudflare help page and the Tenta test page report that TLS over DNS is not enabled (DNSSEC currently disabled).

Is this a configuration problem? A shortcoming of the testing pages? Might I need to do a factory reset (didn't do one after recent upgrade to 384.13)?

Here are my current WAN DNS settings (DNSFilter is set to "Router"):

I've spent an hour doing searches for solutions, followed one thread here which got me to where I am (the settings above). Any help is much appreciated.

 

[Butterfly Bones]

I'm trying to setup DNS over TLS on 384.13. Both the Cloudflare help page and the Tenta test page report that TLS over DNS is not enabled (DNSSEC currently disabled).

Is this a configuration problem? A shortcoming of the testing pages? Might I need to do a factory reset (didn't do one after recent upgrade to 384.13)?

Here are my current WAN DNS settings (DNSFilter is set to "Router"):

I've spent an hour doing searches for solutions, followed one thread here which got me to where I am (the settings above). Any help is much appreciated.

Have you tried this thread?
https://www.snbforums.com/threads/how-to-set-up-dns-over-tls-384-13.59461/

 

[krgck]

Cloudflare test doesn't work dnssec enabled. Their issue.

Tenta's test works only when using their public dns.

Your config is fine.

 

[Mutzli]

Your configuration looks good and it probably works, but the online tests are flawed. You can do a DNS over TLS check from your SSH console with the following command:
tcpdump -ni eth0 -p port 53 or port 853

Watch the traffic and you should see DNS requests being routed through port 853 to quad9 or cloudflare deepening on your configuration. It will look something like this:
15:59:18.936390 IP your.ip.address.43711 > 1.0.0.1.853: Flags [.], ack 1, win 229, length 0

If you see port 53 instead then you have it not working correctly.

 

[djphilosophy]

Have you tried this thread?
https://www.snbforums.com/threads/how-to-set-up-dns-over-tls-384-13.59461/

Yes, that's the thread that got me to where I am now. If I use the Cloudflare Encrypted SNI Checker page listed in that thread, I see orange for Secure DNS (again, it's currently not enabled on the router, as shown in the screenshot), green for DNSSEC and TLS 1.3 (but the latter isn't relevant to DNS-over-TLS I'm guessing), red for encrypted SNI.

 

[djphilosophy]

Your configuration looks good and it probably works, but the online tests are flawed. You can do a DNS over TLS check from your SSH console with the following command:
tcpdump -ni eth0 -p port 53 or port 853

Watch the traffic and you should see DNS requests being routed through port 853 to quad9 or cloudflare deepening on your configuration. It will look something like this:
15:59:18.936390 IP your.ip.address.43711 > 1.0.0.1.853: Flags [.], ack 1, win 229, length 0

If you see port 53 instead then you have it not working correctly.

Connecting via SSH to the router I get "-sh: tcpdump: not found". I'm guessing I have to install it via package manager?

 

[Mutzli]

Connecting via SSH to the router I get "-sh: tcpdump: not found". I'm guessing I have to install it via package manager?

Yes, sorry forgot that little info.
Run: At a ssh prompt.

opkg update
opkg install tcpdump

 

[dave14305]

(DNSFilter is set to "Router"):

Is LAN / DHCP Server / DNS Server 1 entry blank?

 

[DocUmibozu]

the following command:
tcpdump -ni eth0 -p port 53 or port 853

Change eth0 with ppp0 if you use pppoe....

 

[djphilosophy]

Yes, sorry forgot that little info.
Run: At a ssh prompt.

opkg update
opkg install tcpdump

Looks like opkg isn't installed either: "-sh: opkg: not found"

This is from /tmp/home/root. Do I need to change directories?

Is LAN / DHCP Server / DNS Server 1 entry blank?

Yup, both 1 and 2.

 

[dave14305]

Do you have any reason to think it's not working? It looks right as rain to me. If it were "broken" you would be having trouble getting to the Internet at all.

You can switch your DNS Privacy servers from Quad9 to Cloudflare and retest their 1.1.1.1/help site if it makes it any better. If it still comes back as WoodyNet it means it's using your WAN DNS servers, and DoT is not working.

Using tcpdump from Entware requires a USB drive attached to your router.

 

[djphilosophy]

Do you have any reason to think it's not working? It looks right as rain to me. If it were "broken" you would be having trouble getting to the Internet at all.

You can switch your DNS Privacy servers from Quad9 to Cloudflare and retest their 1.1.1.1/help site if it makes it any better. If it still comes back as WoodyNet it means it's using your WAN DNS servers, and DoT is not working.

Using tcpdump from Entware requires a USB drive attached to your router.

I don't have any reason to think it's not working, I just figured that there was a way to reliably test that it is. If I switch the DNS servers in the DNS-over-TLS Server List to Cloudflare's, I do see Cloudflare instead of WoodyNet on Cloudflare's test site. I guess that means it's working?

 

[dave14305]

If I switch the DNS servers in the DNS-over-TLS Server List to Cloudflare's, I do see Cloudflare instead of WoodyNet on Cloudflare's test site. I guess that means it's working?

Does it show connected with TLS in that help page? Or still No?

 

[djphilosophy]

Does it show connected with TLS in that help page? Or still No?

Still "No".

 

[krgck]

Still "No".

Set cloudflare as your dot dns

1.1.1.1/help will show DOT enabled when you turn off dnssec it will break this test. Well known issue at their end.

Already told you this on 3rd post.

 

[MarkRH]

You can try going to the Network Tools menu -> Netstat Tab and click Diagnose. You should see under the Foreign Address something like

one.one.one.one:853

when using Cloudflare or perhaps

9.9.9.9:853

if using Quad9.

 

[djphilosophy]

Set cloudflare as your dot dns

1.1.1.1/help will show DOT enabled when you turn off dnssec it will break this test. Well known issue at their end.

Already told you this on 3rd post.

Assuming you mean that DNSSEC should be disabled in the WAN DNS settings, as you can see from my screenshot in post #1, it already is disabled.

 

[krgck]

Assuming you mean that DNSSEC should be disabled in the WAN DNS settings, as you can see from my screenshot in post #1, it already is disabled.

Set "Connect to DNS Server automatically" to yes.

 

[djphilosophy]

You can try going to the Network Tools menu -> Netstat Tab and click Diagnose. You should see under the Foreign Address something like

one.one.one.one:853

when using Cloudflare or perhaps

9.9.9.9:853

if using Quad9.

Doing this, I do see "one.one.one.one:853", preceded by and address connected to my local ISP. Changed it to Quad9 and I see "dns9.quad9.net:853". This confirms it's working?

 

[MarkRH]

Doing this, I do see "one.one.one.one:853", preceded by and address connected to my local ISP. Changed it to Quad9 and I see "dns9.quad9.net:853". This confirms it's working?

Yes. 853 is the port used by DNS over TLS.