NextDNS Installer

[rgnldo]

If the proposal is fully agreed with the FW Merlin development team and commits not to use traffic data for commercial use, the Unbound-Asuswrt-Merlin project adds the option to NEXTDNS.

forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 45.90.28.0#XXXX.dns1.nextdns.io
  forward-addr: 2a07:a8c0::#XXXX.dns1.nextdns.io
  forward-addr: 45.90.30.0#XXXX.dns2.nextdns.io
  forward-addr: 2a07:a8c1::#XXXX.dns2.nextdns.io

 

[dave14305]

https://blog.mozilla.org/blog/2019/...ing-private-and-secure-dns-services-to-users/

Take it for what it's worth depending how you feel about Mozilla and Firefox, but whatever vetting Mozilla does to admit a partner like NextDNS into its Trusted Recursive Resolver program, it's a mark in their favor in terms of transparency.

 

[SomeWhereOverTheRainBow]

https://blog.mozilla.org/blog/2019/...ing-private-and-secure-dns-services-to-users/

Take it for what it's worth depending how you feel about Mozilla and Firefox, but whatever vetting Mozilla does to admit a partner like NextDNS into its Trusted Recursive Resolver program, it's a mark in their favor in terms of transparency.

I concur with this statement Ye'Ol'Wise Dave. Like pearls of wisdom from a miss spent youth.

 

[L&LD]

@dave14305, I don't have that level of trust in Firefox or Mozilla. When I see collaborations at this level like this, I rather think the opposite; oh-oh! What's happening here? (Next level of fail in 3, 2, 1...).

Trusting big names to protect the little person has never been a thing, in my experience.

 

[dave14305]

@dave14305, I don't have that level of trust in Firefox or Mozilla. When I see collaborations at this level like this, I rather think the opposite; oh-oh! What's happening here? (Next level of fail in 3, 2, 1...).

Trusting big names to protect the little person has never been a thing, in my experience.

I hear you, especially now that Mozilla is looking for more ways to monetize. But they are banking on privacy vs. Google as much as Apple is.

Just because you’re paranoid doesn’t mean they’re not out to get you.

 

[Treadler]

I hear you, especially now that Mozilla is looking for more ways to monetize. But they are banking on privacy vs. Google as much as Apple is.

Just because you’re paranoid doesn’t mean they’re not out to get you.

 

[PeterR]

I wonder how long this service will last before Google et al puts them out of business.

 

[Hanston Dsouza]

If the proposal is fully agreed with the FW Merlin development team and commits not to use traffic data for commercial use, the Unbound-Asuswrt-Merlin project adds the option to NEXTDNS.

forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 45.90.28.0#XXXX.dns1.nextdns.io
  forward-addr: 2a07:a8c0::#XXXX.dns1.nextdns.io
  forward-addr: 45.90.30.0#XXXX.dns2.nextdns.io
  forward-addr: 2a07:a8c1::#XXXX.dns2.nextdns.io

can i add this noow itself to unbound

i tried added my config is to this and placed it in unbound.conf file but it dosent cannot

also do i need studdy for this ??

 

[rgnldo]

can i add this noow itself to unbound

i tried added my config is to this and placed it in unbound.conf file but it dosent cannot

also do i need studdy for this ??

On post:
Post#526

 

[XIII]

Nice!

So this is with unbound instead of stubby or the Nextdns CLI client?

How is traffic from unbound to NextDNS encrypted? DoT, DoH, or unencrypted?

 

[rgnldo]

In order not to blur the post, more information on the post:
Post#526

 

[dave14305]

New issue after switching to John’s fork 39E3j9527 and running the latest DoH client 1.4.18.

Endpoints cannot be found on startup due to an unknown cert issue.

Jan  9 03:49:01 nextdns[8531]: Endpoint provider failed: https://router.nextdns.io?stack=dual: Get https://216.239.32.21:443?stack=dual: x509: certificate signed by unknown authority
Jan  9 03:49:02 nextdns[8531]: Endpoint failed: https://dns1.nextdns.io#45.90.28.0,2a07:a8c0::: roundtrip: x509: certificate signed by unknown authority
Jan  9 03:49:02 nextdns[8531]: Endpoint failed: https://dns2.nextdns.io#45.90.30.0,2a07:a8c1::: roundtrip: x509: certificate signed by unknown authority

This seems to be due to the non standard location of the CA bundle in John’s firmware. I was able to workaround it by linking to the bundle.

mkdir -p /tmp/etc/ssl/certs
ln -fs /rom/ca-bundle.crt /tmp/etc/ssl/certs/ca-certificates.crt

This should go into /jffs/scripts/services-start before the nextdns.init command.

 

[dave14305]

Can you please test last version. Client reporting should work much better.

Looking really nice now with real device names.

 

[Olivier Poitrey]

On post:
Post#526

I do not recommend using unbound with NextDNS (or even as a caching stub in general) because of this issue: https://github.com/NLnetLabs/unbound/issues/132

 

[Olivier Poitrey]

New issue after switching to John’s fork 39E3j9527 and running the latest DoH client 1.4.18.

Endpoints cannot be found on startup due to an unknown cert issue.

Jan  9 03:49:01 nextdns[8531]: Endpoint provider failed: https://router.nextdns.io?stack=dual: Get https://216.239.32.21:443?stack=dual: x509: certificate signed by unknown authority
Jan  9 03:49:02 nextdns[8531]: Endpoint failed: https://dns1.nextdns.io#45.90.28.0,2a07:a8c0::: roundtrip: x509: certificate signed by unknown authority
Jan  9 03:49:02 nextdns[8531]: Endpoint failed: https://dns2.nextdns.io#45.90.30.0,2a07:a8c1::: roundtrip: x509: certificate signed by unknown authority

This seems to be due to the non standard location of the CA bundle in John’s firmware. I was able to workaround it by linking to the bundle.

mkdir -p /tmp/etc/ssl/certs
ln -fs /rom/ca-bundle.crt /tmp/etc/ssl/certs/ca-certificates.crt

This should go into /jffs/scripts/services-start before the nextdns.init command.

Thanks for the heads up, it's fixed in master: https://github.com/nextdns/nextdns/commit/6dbbfa21d0d2388f975791669e3be818fb9cfd43

 

[dave14305]

Thanks for the heads up, it's fixed in master: https://github.com/nextdns/nextdns/commit/6dbbfa21d0d2388f975791669e3be818fb9cfd43

Thanks. Another minor cosmetic issue is the syslog messages’ timestamps do not respect the local timezone, which makes the log hard to follow jumping between UTC and local time. Usually with Entware packages we can just export the TZ variable.

export TZ=$(cat /etc/TZ)

 

[ajp2k14]

I'm proud to announce NextDNS is now officially supporting Merlin. You can find the installation procedure on our Github Wiki.

We are also working with @RMerlin to add a UI to this integration. Stay tuned.

You can post your questions or concerns to this thread or contact us directly through our support chat on https://nextdns.io.

Enjoy and happy new year.

Now I've had more time to troubleshoot. Turned off all TrendMicro services and did a power cycle but it still doesn't work. I ran the installer with the debug:

ASUSWRT-Merlin RT-AC86U 384.14-2 Wed Jan  1 03:24:39 UTC 2020
ac86admin@RT-AC86U:/tmp/home/root# DEBUG=1 sh -c "$(curl -sL https://nextdns.io/install)"
INFO: OS: asuswrt-merlin
INFO: GOARCH: arm64
INFO: GOOS: linux
DEBUG: Start install loop with CURRENT_RELEASE=
DEBUG: NextDNS is not installed
i) Install NextDNS
e) Exit
Choice (default=i): i
INFO: Installing NextDNS...
DEBUG: Using bin install type
DEBUG: Installing 1.4.18 binary for linux/arm64 to /jffs/nextdns/nextdns
DEBUG: Start configure
DEBUG: Get configuration ID
NextDNS Configuration ID: XXXXX
DEBUG: Add arg -config=XXXXX
Report device name? [Y|n]:
DEBUG: Add arg -report-client-info=true
Enable hardened privacy mode (may increase latency)? [y|N]:
DEBUG: Add arg -hardened-privacy=false
DEBUG: Add arg -setup-router=true
Automatically configure host DNS on daemon startup? [Y|n]:
DEBUG: Add arg -auto-activate=true
NextDNS installed and started using sysv init
Error: open /etc/init.d/nextdns: read-only file system
ERROR: install: exit 0
DEBUG: Start install loop with CURRENT_RELEASE=1.4.18
DEBUG: NextDNS is up to date (1.4.18)
c) Configure NextDNS
r) Remove NextDNS
e) Exit
Choice (default=c): e
ac86admin@RT-AC86U:/tmp/home/root#


ac86admin@RT-AC86U:/jffs/nextdns# ./nextdns status
Error: "service" failed: fork/exec /sbin/service: cannot allocate memory
ac86admin@RT-AC86U:/jffs/nextdns#

I have now done a complete factory reset and will try again later when I have a chance.

 

[XIII]

I just did my first upgrade of NextDNS.

Is it expected that I still have to "install" NextDNS manually after the update?

 

[Olivier Poitrey]

Now I've had more time to troubleshoot. Turned off all TrendMicro services and did a power cycle but it still doesn't work. I ran the installer with the debug:

ASUSWRT-Merlin RT-AC86U 384.14-2 Wed Jan  1 03:24:39 UTC 2020
ac86admin@RT-AC86U:/tmp/home/root# DEBUG=1 sh -c "$(curl -sL https://nextdns.io/install)"
INFO: OS: asuswrt-merlin
INFO: GOARCH: arm64
INFO: GOOS: linux
DEBUG: Start install loop with CURRENT_RELEASE=
DEBUG: NextDNS is not installed
i) Install NextDNS
e) Exit
Choice (default=i): i
INFO: Installing NextDNS...
DEBUG: Using bin install type
DEBUG: Installing 1.4.18 binary for linux/arm64 to /jffs/nextdns/nextdns
DEBUG: Start configure
DEBUG: Get configuration ID
NextDNS Configuration ID: XXXXX
DEBUG: Add arg -config=XXXXX
Report device name? [Y|n]:
DEBUG: Add arg -report-client-info=true
Enable hardened privacy mode (may increase latency)? [y|N]:
DEBUG: Add arg -hardened-privacy=false
DEBUG: Add arg -setup-router=true
Automatically configure host DNS on daemon startup? [Y|n]:
DEBUG: Add arg -auto-activate=true
NextDNS installed and started using sysv init
Error: open /etc/init.d/nextdns: read-only file system
ERROR: install: exit 0
DEBUG: Start install loop with CURRENT_RELEASE=1.4.18
DEBUG: NextDNS is up to date (1.4.18)
c) Configure NextDNS
r) Remove NextDNS
e) Exit
Choice (default=c): e
ac86admin@RT-AC86U:/tmp/home/root#


ac86admin@RT-AC86U:/jffs/nextdns# ./nextdns status
Error: "service" failed: fork/exec /sbin/service: cannot allocate memory
ac86admin@RT-AC86U:/jffs/nextdns#

I have now done a complete factory reset and will try again later when I have a chance.

Just pushed the v1.4.19 that should fix this issue (should be available in a few minutes).

 

[Olivier Poitrey]

I just did my first upgrade of NextDNS.

Is it expected that I still have to "install" NextDNS manually after the update?

No, it should reinstall itself with the same configuration. Didn't work for you?