Stubby-Installer-Asuswrt-Merlin

[Marin]

You still need Stubby as your queries (DNS) to your server (cloudflare) will not be encrypted. With Stubby installed locally (and listening on loopback addresses such as 127.0.0.1) they will be encrypted via TLS connection. Lots if info about it here:

https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby

 

[maxbraketorque]

Thanks much. Is DoT via Cloudflare going provide reliable domain name resolution with acceptable response times?

 

[skeal]

Thanks much. Is DoT via Cloudflare going provide reliable domain name resolution with acceptable response times?

Works for me!!

 

[maxbraketorque]

Sorry for another question, but is Stubby best installed via AMTM?

 

[Marin]

Sorry for another question, but is Stubby best installed via AMTM?

Yes it is fairly easy to do so. If you don’t have AMTM then feel free to download via the install curl on the Github link provided on the first post of this thread.


Sent from my iPhone using Tapatalk

 

[Swistheater]

Thanks much. Is DoT via Cloudflare going provide reliable domain name resolution with acceptable response times?

Yea I have noticed a slight delay in several browsers when using this, like i will click a link and it takes a while to decide if it wants to load it, but once it makes up its mind it does load it.

 

[Swistheater]

Yea I have noticed a slight delay in several browsers when using this, like i will click a link and it takes a while to decide if it wants to load it, but once it makes up its mind it does load it.

This might be because of the lack of fall back option support if certain browsers do not support certain lvls of security.

 

[Xentrk]

This might be because of the lack of fall back option support if certain browsers do not support certain lvls of security.

My primary browser is Firefox. They seem to be ahead of the curve on supporting security features. I also use Chrome and Edge. I run Stubby on my Asuswrt-Merlin router and my gl-iNet travel router and have not issues with delays. I also use DNS over TLS in Unbound on pfSense and no delays there either.

You may want to change the round_robin_upstreams: from 1 to 0 in stubby.yml to see if that makes a difference for you. See https://www.getdnsapi.net/documentation/manpages/stubby/ for the parameters you can set in stubby.yml file.

Remember to bounce Stubby after making the change. Instructions on the GitHub site.

 

[Swistheater]

My primary browser is Firefox. They seem to be ahead of the curve on supporting security features. I also use Chrome and Edge. I run Stubby on my Asuswrt-Merlin router and my gl-iNet travel router and have not issues with delays. I also use DNS over TLS in Unbound on pfSense and no delays there either.

You may want to change the round_robin_upstreams: from 1 to 0 in stubby.yml to see if that makes a difference for you. See https://www.getdnsapi.net/documentation/manpages/stubby/ for the parameters you can set in stubby.yml file.

Remember to bounce Stubby after making the change. Instructions on the GitHub site.

I will give this a try on one of my other testing days. it is only on a couple of older devices i have this issue. (being oooolllldddd devices i would have to root and put custom builds on to support newer gen tls). The kids was complaining about it--- so i grudgingly went back to dnscrypt----DOH. -- As far as firefox and Chrome and Edge on my newer devices worked like a charm.

 

[maxbraketorque]

There's a lot to figure out here. Is Stubby is supposed to better than dnscrypt?

 

[dave14305]

There's a lot to figure out here. Is Stubby is supposed to better than dnscrypt?

In a word, yes. But neither are truly mainstream yet. But someone has to be on the bleeding edge.

 

[bbunge]

There's a lot to figure out here. Is Stubby is supposed to better than dnscrypt?

Yes as DNSCRYPT will likely go the way of the dodo bird.

As for the install I prefer to install Entware then Stubby. I use a rather small USB drive (2 GB) with a 512 MB swap partition and another EXT2 partition for Entware and Stubby. I have DNSSEC enabled in Stubby with the Cloudflare upstream resolvers IPV4 only as IPV6 on my ISP is 6RD and why should I tunnel a connection via IPV4?

You will get lots of opinions with any software. Try them all if you must and choose what works best for you.

 

[Swistheater]

from what i understand stubby is soon going to support DOH, once that happens i suspect alot of people will be bleeding over to test stubby's new DOH functions lol.

 

[maxbraketorque]

Are other people seeing slower domain name resolution using Stubby when compared to not using it or any other encryption method?

 

[skeal]

Are other people seeing slower domain name resolution using Stubby when compared to not using it or any other encryption method?

Not so sure I ever did. But I'm fine with it now.

 

[cmkelley]

Are other people seeing slower domain name resolution using Stubby when compared to not using it or any other encryption method?

Are you using cloudfare? I had cloudfare DNS go out completely for about an hour today. No clue what was going on there. That was a pain to troubleshoot, it literally came back on about 5 minutes after I figured out what the problem was.

 

[maxbraketorque]

Are you using cloudfare? I had cloudfare DNS go out completely for about an hour today. No clue what was going on there. That was a pain to troubleshoot, it literally came back on about 5 minutes after I figured out what the problem was.

I just switched over from Comcast and Spectrum DNS (routers at two different locations) to Cloudflare today. I enabled DNSSEC at the same time. No loss of domain name resolution while I was online today, but I've mostly been away my home networks. Interesting that Cloudflare DNS went offline. I wouldn't have expected that based on how awesome they claim their DNS system to be.

 

[dave14305]

Are other people seeing slower domain name resolution using Stubby when compared to not using it or any other encryption method?

By definition TLS over TCP will be slower than legacy DNS over UDP. Stubby is about privacy not speed, of course. But as configured here your router will cache responses to avoid repetitive external calls.

 

[cmkelley]

I just switched over from Comcast and Spectrum DNS (routers at two different locations) to Cloudflare today. I enabled DNSSEC at the same time. No loss of domain name resolution while I was online today, but I've mostly been away my home networks. Interesting that Cloudflare DNS went offline. I wouldn't have expected that based on how awesome they claim their DNS system to be.

Not all of cloudfare, it's regional. https://downdetector.com/status/cloudflare/map/ has a map of problem areas for cloudfare. Where I live in socal was a brighter orange earlier.

 

[maxbraketorque]

By definition TLS over TCP will be slower than legacy DNS over UDP. Stubby is about privacy not speed, of course. But as configured here your router will cache responses to avoid repetitive external calls.

I suspected as much, but I have to deal with a family that has become accustomed to responsiveness of standard DNS. I guess I'll have to try and see.