[Release] Asuswrt-Merlin 384.11 is available

[CriticJay]

Assuming you have entware installed.

thanks, guess it's finally time to install Entware

 

[Paliv]

Is it this simple? I enabled dnssec support, changed protocol to tls, added the preset and applied the changes.

Yep, although I had trouble with 9.9.9.9 failing to resolve pages about 1 in every 10-20. 1.1.1.1 has no problems, but no filtering.

 

[Swistheater]

I was looking to install dnscrypt or stubby, but does this version's new feature "dns-over-tls" do the same thing and eliminate the need to install those?

yes it runs stubby built into the firmware using DNS PRIVACY option

 

[Sonyrolfy]

yes it runs stubby built into the firmware using DNS PRIVACY option

Is there any need for Dns server 1 and 2.? I just left them empty and is working fine.

 

[skeal]

Is there any need for Dns server 1 and 2.? I just left them empty and is working fine.

In LAN settings leave them blank, In WAN settings set them to what ever you want things (that start early in the boot up process), to use for DNS. Enable DNSFilter and set to Router, if you don't want devices getting around your DoT.

 

[Sonyrolfy]

In LAN settings leave them blank, In WAN settings set them to what ever you want things (that start early in the boot up process), to use for DNS. Enable DNSFilter and set to Router, if you don't want devices getting around your DoT.

Thanks for the heads up! I have them empty at LAN and WAN as well. The rest is as stated. Just wondering why i need DNS server 1 and 2 on WAN side as Dot is is set.

 

[Butterfly Bones]

Thanks for the heads up! I have them empty at LAN and WAN as well. The rest is as stated. Just wondering why i need DNS server 1 and 2 on WAN side as Dot is is set.

Just like asking Maps for directions. Can you say "Send me there" without stating where?
You need to give DoT where you want your TLS DNS domain queries to be processed.

 

[Sonyrolfy]

Just like asking Maps for directions. Can you say "Send me there" without stating where?
You need to give DoT where you want your TLS DNS domain queries to be processed.

I get that, but the internet works without setting any dns number in the fields 1 and 2 as DoT is set to 1.1.1.1. Any cons? i have set Connect to DNS Server automatically to NO.

 

[skeal]

Thanks for the heads up! I have them empty at LAN and WAN as well. The rest is as stated. Just wondering why i need DNS server 1 and 2 on WAN side as Dot is is set.

The WAN DNS Server entries can be set to auto (using your ISP DNS) or hard coded as anything you want. You configure this so that NTP update has some way to complete it's task. NTP being time. In early boot processes.

 

[dave14305]

I get that, but the internet works without setting any dns number in the fields 1 and 2 as DoT is set to 1.1.1.1. Any cons? i have set Connect to DNS Server automatically to NO.

If you enabled DoT after the router has already been up and running with regular DNS, you might not see the effects yet. If you reboot without any WAN DNS 1 or 2 servers populated, things might not work as well after the reboot. Better to have WAN DNS explicitly set to something so the router, NTP and DoT can bootstrap themselves before DoT(stubby) is started.

 

[Sonyrolfy]

If you enabled DoT after the router has already been up and running with regular DNS, you might not see the effects yet. If you reboot without any WAN DNS 1 or 2 servers populated, things might not work as well after the reboot. Better to have WAN DNS explicitly set to something so the router, NTP and DoT can bootstrap themselves before DoT(stubby) is started.

Thanks, i will set them.

 

[martinr]

Just like asking Maps for directions. Can you say "Send me there" without stating where?
You need to give DoT where you want your TLS DNS domain queries to be processed.

Maybe the question is: if DoT is enabled and the DNS server is specified in the DNS-over-TLS Server List at the bottom of the page, does there really need to be an entry in the DNS Servers 1 and 2 slots further up the page or can they be left blank? The entry in DNS Server 1 will no doubt be identical to the DoT server selected from the list at the bottom. But suppose a different server were defined as DNS Server 1; would that perhaps act as a fallback server if DoT fell over?

Edit: Dave14305, above, has, as usual, answered the question thoroughly

 

[dave14305]

Thanks, i will set them.

I edited my post to strike the word "explicitly." You can use automatic DNS servers from your ISP or your own preferred servers. Something is better than nothing.

 

[Jack Yaz]

Run:

opkg update
opkg install htop
run htop to use

Assuming you have entware installed.

I'm probably going to add this to scmerlin

 

[Sonyrolfy]

I edited my post to strike the word "explicitly." You can use automatic DNS servers from your ISP or your own preferred servers. Something is better than nothing.

Thanks again. i just asked because i couldn't find anything strange when i powered on after a upgrade and later found out that i had forgot to set these dns numers at wan side all was working.

 

[bluepoint]

no round robin means only one sever gets used until it fails round robin in stubby =0

If you want to, how do you set stubby to not use round robin?

 

[Gar]

In LAN settings leave them blank, In WAN settings set them to what ever you want things (that start early in the boot up process), to use for DNS. Enable DNSFilter and set to Router, if you don't want devices getting around your DoT.

Enabling dnsfilter and choosing "router" bypasses dot? I thought that forced everything, including hard coded devices, to use dot. I may have misunderstood your post as I refer to choosing router under the global menu.

 

[martinr]

I edited my post to strike the word "explicitly." You can use automatic DNS servers from your ISP or your own preferred servers. Something is better than nothing.

This all makes sense to me now, including why the option Connect to DNS Server automatically is still there and valid. Having said that, if Connect to DNS Server automatically is set to Yes, is there not a case for hiding from view the options for DNS Server 1 and 2? Or perhaps, similarly, specifying those 2 servers still allows DNS resolution if there’s a problem with the ISP’s DNS server?

 

[dave14305]

This all makes sense to me now, including why the option Connect to DNS Server automatically is still there and valid. Having said that, if Connect to DNS Server automatically is set to Yes, is there not a case for hiding from view the options for DNS Server 1 and 2?

The fields do toggle on or off depending on the setting, at least on my router/browser.

Or perhaps, similarly, specifying those 2 servers still allows DNS resolution if there’s a problem with the ISP’s DNS server?

I started thinking about whether a failsafe is possible if Stubby fails to start for any reason, and if dnsmasq would continue to resolve using the WAN DNS servers (I don't believe it will). That's not the same as the question you pose above, but I think in general, the world already solved the redundancy of old-style DNS. Yet I still remember the day I vowed never to use Comcast's DNS servers after they had multiple outages several years ago.

 

[Swistheater]

Enabling dnsfilter and choosing "router" bypasses dot? I thought that forced everything, including hard coded devices, to use dot. I may have misunderstood your post as I refer to choosing router under the global menu.

I think you misunderstood what he said he means the opposite of what you said.