Trying the new DoT feature

[tarassippo]

Today I decided to test the DoT feature on my RT-AC66U_B1 running Merlin v384.13 and it seems working fine - this is the configuration

but when I run the IPv6 test I get a lower score (without DoT it was 19/20).

Would someone please explain to me why the DNS6+IP4 and DN6+IP6 tests are failing ?

Tia.

 

[Mutzli]

I think you have to set 'Connect to DNS server automatically' to No. Otherwise your router will still get the DNS server from you ISP. Also in LAN set DNSFilter to ON and Global Filtering Mode to Router.

 

[tarassippo]

Thanks !

 

[bbunge]

Let us know if the suggestion works. I have not done that test on an AC68U on dual stack. When I ran DoT on dual stack I alternated the ipv4 and ipv6 resolvers. It seemed to work ok even though the internal connection between dnsmasq and stubby uses just the ipv4 loopback. Also, some ipv4 resolvers will resolve ipv6 requests. Don't think Cleanbrowsing does.

Sent from my SM-T380 using Tapatalk

 

[owine]

Also, some ipv4 resolvers will resolve ipv6 requests. Don't think Cleanbrowsing does.

Sent from my SM-T380 using Tapatalk

I believe this is the core of the issue. You are likely using different DNS servers when DoT is off which is why the test result is coming back differently.

 

[tarassippo]

Thanks all... I reckon the issue is with the CleanBrowsing servers... In the last couple of hours I've run the test several times trying different configurations with no luck, but if I change the DoT servers, i.e. Quad9 or Cloudflare (no matter whether 'Connect to DNS server automatically' is set to Yes or No) then I get 19/20...

 

[tarassippo]

And one more thing: using this link https://dnssec.vs.uni-due.de/ I can check whether the DNS server validates DNSSEC signatures, but how to check whether TLS has been enabled on that DNS server ?

 

[bbunge]

And one more thing: using this link https://dnssec.vs.uni-due.de/ I can check whether the DNS server validates DNSSEC signatures, but how to check whether TLS has been enabled on that DNS server ?

Cloudflare does have a test page that validates DoT/DoH. DNSSEC has to be off. Other sites publish that they support DoT or not. The resolvers loaded with Merlin all support DoT.

Sent from my SM-T380 using Tapatalk

 

[tarassippo]

Yes, that's what I thought and while running the test on https://tenta.com/test/ I got the following result, i.e. DoT not enabled on WoodyNet/Quad9 servers, but then I don't know how reliable that website is...

 

[SuperDuke]

Hi all....I would say I have the same verification issues as others with DoT but I have the configuration set like others....

One question I have is regarding the preferred server list and the DNSServer1/2 fields...….I have selected Cloudflare and put their DNS servers in the Server1/2 fields in WAN...and have added their servers in the preferred list....then Quad then CF IPv6, then Quad IPv6...….I understand (I believe) that the preferred listing is priority based so it will walk down the list.....so in the case of my setup, CF IPv4 first, then failing that Quad IPv4....

Now my likely naïve question....if the failover to Quad occurs....how does the DNSServer1/2 inputs change or effect the failover to the next preferred server in the list?

 

[SuperDuke]

I think you have to set 'Connect to DNS server automatically' to No. Otherwise your router will still get the DNS server from you ISP. Also in LAN set DNSFilter to ON and Global Filtering Mode to Router.
View attachment 18893

View attachment 18894

I have my setup as you do.....and it works as expected (I believe) but the DoT wiki would seem to indicate that setting DNS from automatic isn't required.....that's part of my confusion from my previous post.....

https://github.com/RMerl/asuswrt-merlin/wiki/DNS-Privacy

 

[Mutzli]

I have my setup as you do.....and it works as expected (I believe) but the DoT wiki would seem to indicate that setting DNS from automatic isn't required.....that's part of my confusion from my previous post.....

https://github.com/RMerl/asuswrt-merlin/wiki/DNS-Privacy

You can leave the DNS setting on automatic. If you leave it on automatic your router will during boot set your ISP's DNS server and once the DNS stack loads it will change over to your specified DNS. That means your time sync and AI services would be going through your ISP's DNS at first. When its entered manually your router will boot up without getting your ISP's DNS first and use whatever DNS is defined.

 

[shark]

Yes, that's what I thought and while running the test on https://tenta.com/test/ I got the following result, i.e. DoT not enabled on WoodyNet/Quad9 servers, but then I don't know how reliable that website is...

View attachment 18909

If I am not mistaken, this site is outdated.

 

[dave14305]

One question I have is regarding the preferred server list and the DNSServer1/2 fields...….I have selected Cloudflare and put their DNS servers in the Server1/2 fields in WAN...and have added their servers in the preferred list....then Quad then CF IPv6, then Quad IPv6...….I understand (I believe) that the preferred listing is priority based so it will walk down the list.....so in the case of my setup, CF IPv4 first, then failing that Quad IPv4....

It uses all the servers in a round-robin manner by default. So you’ll never know if you’re getting Quad9 malware filtering or not.

Now my likely naïve question....if the failover to Quad occurs....how does the DNSServer1/2 inputs change or effect the failover to the next preferred server in the list?

WAN DNS 1 and 2 function independently from DoT. Only the router will use them for its own lookups. Clients will use dnsmasq and DoT.

 

[lepa71]

I think you have to set 'Connect to DNS server automatically' to No. Otherwise your router will still get the DNS server from you ISP. Also in LAN set DNSFilter to ON and Global Filtering Mode to Router.
View attachment 18893

View attachment 18894

I tried to set up mine and I'm getting different behavior. I try to config DoT with QUAD9 but some of my laptops on the LAN DNS-filter page have been defined with CleanBrowsing-Security or CleanBrowsing-Family. My laptop is not part of the list. If I set up "Global Filter mode" to "Router", my laptop can't get anywhere. Where is my problem? What am I doing wrong? If I set it to "No filtering" then leaktest shows that my DNS is QUAD9.