Ok this is my steps.
First you need to have entware do the command below.
Code:
opkg update
opkg install stubby
opkg install ca-certificates
Create a file S61stubby in /opt/etc/init.d/
Code:
nano /opt/etc/init.d/S61stubby
Copy the following inside and save
Code:
#!/bin/sh
ENABLED=yes
PROCS=stubby
ARGS="-g -v 5 -C /opt/etc/stubby/stubby.yml 2>/opt/var/log/stubby.log"
PREARGS="nohup"
DESC=$PROCS
PATH=/opt/sbin:/opt/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
. /opt/etc/init.d/rc.func
After you save the above file. You need to make it executable.
Code:
chmod +755 /opt/etc/init.d/S61stubby
You probably already have ca-certificates installed. Look in /opt/etc/ssl
nano /opt/etc/stubby/stubby.yml
Copy this inside.
Code:
#NOTE: See '/etc/stubby/stubby.yml.default' for original config file and descriptions
resolution_type: GETDNS_RESOLUTION_STUB
dnssec_return_status: GETDNS_EXTENSION_TRUE
appdata_dir: "/opt/var/cache/stubby"
tls_ca_file: "/opt/etc/ssl/certs/ca-certificates.crt"
dns_transport_list:
- GETDNS_TRANSPORT_TLS
tls_authentication: GETDNS_AUTHENTICATION_REQUIRED
tls_query_padding_blocksize: 256
edns_client_subnet_private : 1
round_robin_upstreams: 1
idle_timeout: 10000
tls_backoff_time: 900
listen_addresses:
- 127.0.0.1@5453
upstream_recursive_servers:
# IPv4 addresses
# # Cloudflare servers
- address_data: 1.1.1.1
tls_port: 853
tls_auth_name: "cloudflare-dns.com"
# # Cloudflare servers
- address_data: 1.0.0.1
tls_port: 853
tls_auth_name: "cloudflare-dns.com"
nano /jffs/configs/dnsmasq.conf.add (also, disable DNSSEC in webgui)
Code:
no-resolv
server=127.0.0.1#5453
Lastly, go to web GUI, under WAN, Internet Connection, WAN DNS Setting
Set DNS to Manual.
Dns#1 : your router ip eg. 192.168.1.1
Dns#2 : leave blank
Now final step. You can immediately start stubby to see if working by using the following command
Code:
/opt/etc/init.d/S61stubby start
If you want restart
/opt/etc/init.d/S61stubby restart
Or stop
/opt/etc/init.d/S61stubby stop
Next try save net and go
https://1.1.1.1/help to see if tls working.
Last final test, restart router to see if everything goes well.
These are not my steps. I am just summarising what
@Xentrk did over the past weeks. For those who are impatient to try it out.