Menu
What's new
By:
Filters Better Search

Stubby-Installer-Asuswrt-Merlin

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

bbunge said:
I am using iOS and android Dig apps. When I enabled proxy-dnssec I was able to get the AD flag on the apps.
Click to expand...
Do you mind me asking which apps? I can't get the AD flag on my Android device but can on iOS, but would appreciate a recommendation for both.
 
preacher65 said:
Do you mind me asking which apps? I can't get the AD flag on my Android device but can on iOS, but would appreciate a recommendation for both.
Click to expand...
iOS - ISC Dig
Android - DNSDig
 
From the man page of Dnsmasq:
--proxy-dnssec
Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients and cache it. This is an alternative to having dnsmasq validate DNSSEC, but it depends on the security of the network between dnsmasq and the upstream servers, and the trustworthiness of the upstream servers.
 
bbunge said:
iOS - ISC Dig
Android - DNSDig
Click to expand...
Thanks - that's what I'm using as well. I'd hoped it might be a problem with the Android app I was using but that was wishful thinking. I can't get the AD flag to show on Android, will do some more testing.
 
preacher65 said:
Thanks - that's what I'm using as well. I'd hoped it might be a problem with the Android app I was using but that was wishful thinking. I can't get the AD flag to show on Android, will do some more testing.
Click to expand...
Are you using Android 9 with built-in DNS privacy, bypassing your router?
 
skeal said:
So in fact they compliment each other?
Click to expand...

Think bbunge’s give the answer. Assuming we trust those big players like cloudflare, Google etc, having both dot and dnssec will be pretty safe from dns hijacking. Unless your clients (pc, web browser, router) is compromised, then that’s different story.

QUOTE="bbunge, post: 460367, member: 30783"]I am using iOS and android Dig apps. When I enabled proxy-dnssec I was able to get the AD flag on the apps. Yes, there are a lot of opinions on DoT/DoH and DNSSEC. There is a link in a prior post that has a good article on the topic

Edit link https://blog.apnic.net/2018/08/17/sunrise-dns-over-tls-sunset-dnssec/

Sent from my SM-T380 using Tapatalk[/QUOTE]
 
dave14305 said:
Are you using Android 9 with built-in DNS privacy, bypassing your router?
Click to expand...
Thanks - I am using Android 9, and hadn't checked (doh!) but no, DNS privacy is not enabled. Checking 1.1.1.1/help on the phone says I'm connecting to CF using DOT. Moreover following the Diversion log shows queries triggered by the phone, including the A record I'm querying to test DNSSEC. So it would appear to be using dnsmasq on the router to resolve DNS queries and Stubby would appear to be working, it's just not returning the AD flag when I use the DNSdig app, setting the router's IP as the resolver.

Using either Powershell "resolve-dnsname -dnssecok" or Bind Tools for Windows, or the ICS Dig app on iOS, seem to indicate those clients are receiving the AD flag. Just not Android (or at least not the DNSdig app).

I'm currently charging up a different Android device to see if it's something to do with Pie. However I've always been suspicious that Android does something a bit funky with DNS, I know my DNS can leak to my mobile carrier over IPv6 with some VPN client configs I've tried.

Update: Nope, same on Oreo. Also tried 2 other Android apps. I can live without it but it's an annoyance to not know why it's not working.
 
Last edited:
preacher65 said:
Update: Nope, same on Oreo. Also tried 2 other Android apps. I can live without it but it's an annoyance to not know why it's not working.
Click to expand...
Sorry for replying to my own post, but... installed Termux on my phone and installed the dnsutils package, then tried dig from a terminal window and got the AD flag. Not quite sure what's going on with those DNS apps, there doesn't seem to be any way in the gui for the equivalent of dig's "+dnssec" parameter, but perhaps I'm just using them incorrectly. DNSdig shows a greyed out AD flag so I assumed it would check dnssec automatically. (On iOS the app is from ISC so I guess it's to be expected it checks dnssec by default.)

This is why we should only ever trust the command line. ;)
 
Last edited:
I've pushed an update for IPv6 users. This update implements the suggestions by @cmkelley in this post.

Note; These changes I am unable to personally test due to IPv6 being unsupported by my ISP, so feedback is appreciated!
 
Adamm said:
I've pushed an update for IPv6 users. This update implements the suggestions by @cmkelley in this post.

Note; These changes I am unable to personally test due to IPv6 being unsupported by my ISP, so feedback is appreciated!
Click to expand...
Thanks for this. I didn't realize there was a flag for ipv6_service. Makes sense to only put the IPv6 stuff in if that's enabled.

Also, is there a way to have it re-run the install script after it updates the install script?
 
cmkelley said:
Also, is there a way to have it re-run the install script after it updates the install script?
Click to expand...

Its on the todo list, best to make sure everything works manually before automating it. Things have been progressing rapidly so this will happen sooner then later.
 
Adamm said:
I've pushed an update for IPv6 users. This update implements the suggestions by @cmkelley in this post.

Note; These changes I am unable to personally test due to IPv6 being unsupported by my ISP, so feedback is appreciated!
Click to expand...
Eeeep. I'm dangerous .... In the update_wan_and_resolv_settings section, once you've tested for ipv6 being enabled, looks like you should add:
Code: 
nvram set ipv6_dnsenable="0"
nvram set ipv61_dnsenable="0"
I wasn't thinking about the case where people had enabled connect to (ipv6) server automatically. Ooopsie.
 
cmkelley said:
Eeeep. I'm dangerous .... In the update_wan_and_resolv_settings section, once you've tested for ipv6 being enabled, looks like you should add:
Code: 
nvram set ipv6_dnsenable="0"
nvram set ipv61_dnsenable="0"
I wasn't thinking about the case where people had enabled connect to (ipv6) server automatically. Ooopsie.
Click to expand...

Someone else taking the blame, lucky me :p

I've committed the missing values (that I totally didn't overlook myself :rolleyes:)
 
Adamm said:
Someone else taking the blame, lucky me :p

I've committed the missing values (that I totally didn't overlook myself :rolleyes:)
Click to expand...
I just updated the installer, and it hangs when I attempt to Update Stubby Configuration (option 1).
 
Does it get through any of it? What's the last message? (it works for me)
 
visortgw said:
I just updated the installer, and it hangs when I attempt to Update Stubby Configuration (option 1).
Click to expand...

Works on my end;

Code: 
skynet@RT-AX88U-DC28:/tmp/home/root# install_stubby

_______________________________________________________________________
|                                                                     |
|  Welcome to the Stubby-Installer-Asuswrt-Merlin installation script |
|  Version 1.0.1 by Xentrk                                            |
|         ____        _         _                                     |
|        |__  |      | |       | |                                    |
|  __  __  _| |_ _ _ | |_  ___ | | __    ____ ____  _ _ _             |
|  \ \/ / |_  | ` ` \  __|/ _ \| |/ /   /  _//    \| ` ` \            |
|   /  /  __| | | | |  |_ | __/|   <   (  (_ | [] || | | |            |
|  /_/\_\|___ |_|_|_|\___|\___||_|\_\[] \___\\____/|_|_|_|            |
|_____________________________________________________________________|
|                                                                     |
| Requirements: jffs partition and USB drive with entware installed   |
|                                                                     |
| The use of Stubby on Asuswrt-Merlin is experimental.                |
| The install script will:                                            |
|   1. install the stubby entware package                             |
|   2. override how the firmware manages DNS                          |
|   3. disable the firmware DNSSEC setting                            |
|   4. default to Cloudflare DNS 1.1.1.1. You can change to other     |
|      supported DNS over TLS providers by modifying                  |
|      /opt/var/stubby/stubby.yml                                     |
|                                                                     |
| You can also use this script to uninstall Stubby to back out the    |
| changes made during the installation. See the project repository at |
| https://github.com/Xentrk/Stubby-Installer-Asuswrt-Merlin           |
| for helpful tips.                                                   |
|_____________________________________________________________________|

1 = Update Stubby Configuration
2 = Remove Existing Stubby Installation

e = Exit Script

Option ==> 1

Entware package list successfully updated
getdns-hnd-latest.ipk downloaded successfully
stubby-hnd-latest.ipk downloaded successfully
Installing getdns (1.5.0-tls1.3) to root...
Configuring getdns.
Patched getdns successfully installed
Installing stubby (0.2.4-tls1.3) to root...
Configuring stubby.
Collected errors:
 * resolve_conffiles: Existing conffile /opt/etc/stubby/stubby.yml is different from the conffile in the new package. The new conffile will be placed at /opt/etc/stubby/stubby.yml-opkg.
Patched stubby successfully installed
Existing haveged package found
Package haveged (1.9.4-1) installed in root is up to date.
Haveged successfully updated
Required dnsmasq parm no-resolv found in /tmp/etc/dnsmasq.conf
Required dnsmasq parm server=127.0.0.1#5453 found in /tmp/etc/dnsmasq.conf
Required dnsmasq parm server=0::1#5453 found in /tmp/etc/dnsmasq.conf
Required dnsmasq parm server=/pool.ntp.org/1.1.1.1 found in /tmp/etc/dnsmasq.conf
Existing stubby.yml found
stubby.yml backed up to stubby.yml.2019-01-21_05-27-14
stubby.yml downloaded successfully
S61stubby downloaded successfully


Would you like to cache DNSSEC Authenticated Data? (proxy-dnssec)
NOTE: This may cause issues with alternative DNS providers such as Quad9
[1]  --> Yes
[2]  --> No

[1-2]: 1

proxy-dnssec found in /jffs/configs/dnsmasq.conf.add
1 active OpenVPN Client found
Required entry already exists in /jffs/scripts/openvpn-event
Skipping update of /jffs/scripts/openvpn-event
 Shutting down stubby...              done.
 Starting stubby...              done.
Installation of Stubby completed

   https://github.com/Xentrk/Stubby-Installer-Asuswrt-Merlin

                      Have a Grateful Day!

           ____        _         _
          |__  |      | |       | |
    __  __  _| |_ _ _ | |_  ___ | | __    ____ ____  _ _ _
    \ \/ / |_  | ` ` \  __|/ _ \| |/ /   /  _//    \| ` ` \
     /  /  __| | | | |  |_ | __/|   <   (  (_ | [] || | | |
    /_/\_\|___ |_|_|_|\___|\___||_|\_\[] \___\\____/|_|_|_|


Can you give me the output of the following (assuming you can reproduce it).

Code: 
sh -x /jffs/scripts/install_stubby.sh

(try to navigate the menu with the debug print so we can get to the point where it hangs)
 
cmkelley said:
Does it get through any of it? What's the last message? (it works for me)
Click to expand...
No messages. Just a blank line...
Code: 
1 = Update Stubby Configuration
2 = Remove Existing Stubby Installation

e = Exit Script

Option ==> 1
 
visortgw said:
No messages. Just a blank line...
Code: 
1 = Update Stubby Configuration
2 = Remove Existing Stubby Installation

e = Exit Script

Option ==> 1
Click to expand...

Adamm said:
Can you give me the output of the following (assuming you can reproduce it).

Code: 
sh -x /jffs/scripts/install_stubby.sh
(try to navigate the menu with the debug print so we can get to the point where it hangs)
Click to expand...
 
Adamm said:
Works on my end;

Code: 
skynet@RT-AX88U-DC28:/tmp/home/root# install_stubby

_______________________________________________________________________
|                                                                     |
|  Welcome to the Stubby-Installer-Asuswrt-Merlin installation script |
|  Version 1.0.1 by Xentrk                                            |
|         ____        _         _                                     |
|        |__  |      | |       | |                                    |
|  __  __  _| |_ _ _ | |_  ___ | | __    ____ ____  _ _ _             |
|  \ \/ / |_  | ` ` \  __|/ _ \| |/ /   /  _//    \| ` ` \            |
|   /  /  __| | | | |  |_ | __/|   <   (  (_ | [] || | | |            |
|  /_/\_\|___ |_|_|_|\___|\___||_|\_\[] \___\\____/|_|_|_|            |
|_____________________________________________________________________|
|                                                                     |
| Requirements: jffs partition and USB drive with entware installed   |
|                                                                     |
| The use of Stubby on Asuswrt-Merlin is experimental.                |
| The install script will:                                            |
|   1. install the stubby entware package                             |
|   2. override how the firmware manages DNS                          |
|   3. disable the firmware DNSSEC setting                            |
|   4. default to Cloudflare DNS 1.1.1.1. You can change to other     |
|      supported DNS over TLS providers by modifying                  |
|      /opt/var/stubby/stubby.yml                                     |
|                                                                     |
| You can also use this script to uninstall Stubby to back out the    |
| changes made during the installation. See the project repository at |
| https://github.com/Xentrk/Stubby-Installer-Asuswrt-Merlin           |
| for helpful tips.                                                   |
|_____________________________________________________________________|

1 = Update Stubby Configuration
2 = Remove Existing Stubby Installation

e = Exit Script

Option ==> 1

Entware package list successfully updated
getdns-hnd-latest.ipk downloaded successfully
stubby-hnd-latest.ipk downloaded successfully
Installing getdns (1.5.0-tls1.3) to root...
Configuring getdns.
Patched getdns successfully installed
Installing stubby (0.2.4-tls1.3) to root...
Configuring stubby.
Collected errors:
 * resolve_conffiles: Existing conffile /opt/etc/stubby/stubby.yml is different from the conffile in the new package. The new conffile will be placed at /opt/etc/stubby/stubby.yml-opkg.
Patched stubby successfully installed
Existing haveged package found
Package haveged (1.9.4-1) installed in root is up to date.
Haveged successfully updated
Required dnsmasq parm no-resolv found in /tmp/etc/dnsmasq.conf
Required dnsmasq parm server=127.0.0.1#5453 found in /tmp/etc/dnsmasq.conf
Required dnsmasq parm server=0::1#5453 found in /tmp/etc/dnsmasq.conf
Required dnsmasq parm server=/pool.ntp.org/1.1.1.1 found in /tmp/etc/dnsmasq.conf
Existing stubby.yml found
stubby.yml backed up to stubby.yml.2019-01-21_05-27-14
stubby.yml downloaded successfully
S61stubby downloaded successfully


Would you like to cache DNSSEC Authenticated Data? (proxy-dnssec)
NOTE: This may cause issues with alternative DNS providers such as Quad9
[1]  --> Yes
[2]  --> No

[1-2]: 1

proxy-dnssec found in /jffs/configs/dnsmasq.conf.add
1 active OpenVPN Client found
Required entry already exists in /jffs/scripts/openvpn-event
Skipping update of /jffs/scripts/openvpn-event
 Shutting down stubby...              done.
 Starting stubby...              done.
Installation of Stubby completed

   https://github.com/Xentrk/Stubby-Installer-Asuswrt-Merlin

                      Have a Grateful Day!

           ____        _         _
          |__  |      | |       | |
    __  __  _| |_ _ _ | |_  ___ | | __    ____ ____  _ _ _
    \ \/ / |_  | ` ` \  __|/ _ \| |/ /   /  _//    \| ` ` \
     /  /  __| | | | |  |_ | __/|   <   (  (_ | [] || | | |
    /_/\_\|___ |_|_|_|\___|\___||_|\_\[] \___\\____/|_|_|_|


Can you give me the output of the following (assuming you can reproduce it).

Code: 
sh -x /jffs/scripts/install_stubby.sh

(try to navigate the menu with the debug print so we can get to the point where it hangs)
Click to expand...
Hung on "+ opkg update", which is strange.
 
visortgw said:
Hung on "+ opkg update", which is strange.
Click to expand...

Does "opkg update" work when manually run? If not that indicates a problem with entware in general.
 
You must log in or register to reply here.

Similar threads

RMerlin
Release Asuswrt-Merlin 3006.102.1 is now available for Wifi 7 devices
4 5 6
Replies
106
Views
17K
jksmurf
J
RMerlin
ANNOUNCEMENT: Asuswrt-Merlin support underway for 3 Wifi 7 routers
5 6 7
Replies
130
Views
27K
scasapending
S
DMcD-EMS-USMC
  • Locked
3006.102 alpha 2 Build(s) Now Available
Replies
2
Views
1K
octopus
octopus
RMerlin
Release Asuswrt-Merlin 3006.102.2 is now available for Wifi 7 devices
2 3 4
Replies
62
Views
7K
RMerlin
RMerlin
octopus
  • Locked
[ 3006.102 alpha Build(s) ] Testing available build(s)
2 3
Replies
59
Views
11K
octopus
octopus
Similar threads
Thread starter Title Forum Replies Date
RMerlin Release Asuswrt-Merlin 3004.388.8_4 is now available Asuswrt-Merlin 72
RMerlin Release Asuswrt-Merlin 3006.102.2 is now available for Wifi 7 devices Asuswrt-Merlin 62
B Unable to establish VPN connection to my PiVPN (ovpn) from my Asus RT-AC86U running Asuswrt-Merlin 386.14 Asuswrt-Merlin 1
F Several Questions Re:Asuswrt-Merlin Feature Implementation Asuswrt-Merlin 2
Yota How to enable port randomization in Asuswrt-Merlin? Asuswrt-Merlin 4
RMerlin Beta Asuswrt-Merlin 3006.102.2 Beta is now available for Wifi 7 devices Asuswrt-Merlin 70
J Does Asuswrt-Merlin support AiMesh over Wifi? Asuswrt-Merlin 4
Siff Printing from Guest Network (ASUSWRT-Merlin 3004.388.8_2) Asuswrt-Merlin 5
Siff Setting dnsmasq on Asuswrt-Merlin Asuswrt-Merlin 8
Rob Bowlby fwupdate.asuswrt-merlin.net - diversion.ch Down? Asuswrt-Merlin 7

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 850 (members: 28, guests: 822)
Top