multiple netprobe addresses

[BPplays]

currently you can only use 1 value for netprobe_address this causes issues if you want a configuration to support IPv6 and IPv4, if you set netprobe_address to 9.9.9.9:53 in the config then it will only work on IPv4 supported networks, and if you put [2620:fe::fe]:53 then it will only work on IPv6 networks

IPv6-only

from 970c500 on master with an IPv6 only arch linux host, (IPv4 is disabled at the host level not the network level for this test):

netprobe_address = '9.9.9.9:53':

-> go run ./dnscrypt-proxy/ -config ./config.toml
[2026-09-28 23:29:30] [NOTICE] dnscrypt-proxy 2.1.19
[2026-09-28 23:29:30] [NOTICE] Using default Weighted Power of Two (WP2) load balancing strategy
[2026-09-28 23:29:30] [NOTICE] Network not available yet -- waiting...

netprobe_address = '[2620:fe::fe]:53':

-> go run ./dnscrypt-proxy/ -config ./config.toml
[2026-09-28 23:29:57] [NOTICE] dnscrypt-proxy 2.1.19
[2026-09-28 23:29:57] [NOTICE] Using default Weighted Power of Two (WP2) load balancing strategy
[2026-09-28 23:29:57] [NOTICE] Network connectivity detected
[2026-09-28 23:29:57] [NOTICE] Now listening to [::1]:58003 [UDP]
[2026-09-28 23:29:57] [NOTICE] Now listening to [::1]:58003 [TCP]

IPv4-only

from the same host with IPv4 enabled, and a v4 only docker network

netprobe_address = '[2620:fe::fe]:53':

-> docker run --rm -it \
                 --network v4only \
                 -v "$PWD:/work" \
                 -w /work \
                 golang:1.27-bookworm \
                 go run ./dnscrypt-proxy/ -config ./config.toml
[2026-09-29 06:40:13] [NOTICE] dnscrypt-proxy 2.1.19
[2026-09-29 06:40:13] [NOTICE] Using default Weighted Power of Two (WP2) load balancing strategy
[2026-09-29 06:40:13] [NOTICE] Network not available yet -- waiting...

netprobe_address = '9.9.9.9:53':

-> docker run --rm -it \
                 --network v4only \
                 -v "$PWD:/work" \
                 -w /work \
                 golang:1.27-bookworm \
                 go run ./dnscrypt-proxy/ -config ./config.toml
[2026-09-29 06:41:51] [NOTICE] dnscrypt-proxy 2.1.19
[2026-09-29 06:41:51] [NOTICE] Using default Weighted Power of Two (WP2) load balancing strategy
[2026-09-29 06:41:51] [NOTICE] Network connectivity detected
[2026-09-29 06:41:51] [NOTICE] Now listening to [::1]:58003 [UDP]
[2026-09-29 06:41:51] [NOTICE] Now listening to [::1]:58003 [TCP]

[lifenjoiner]

Not that complicated. What about using a domain name that has both IPv4 and IPv4 servers?
For example:

netprobe_address = 'dns.google:53'

PS: Seems not to serve itself here.
Specify its both types of IPs in combination with https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Captive-Portals, if it is.

[BPplays]

@lifenjoiner the docs for net.ResolveUDPAddr used in NetProbe say it returns at most one address so a hostname wouldn't check all IPs here,
for example you could be in a situation where you have working IPv4 but the resolver returns IPv6 first, then NetProbe would try that and fail since it only tries to resolve it once at the start of the function

also it would need to be in the hosts file anyway since net.ResolveUDPAddr failing once causes the function to return at the start, it doesn't try again, so the time it waits for network connectivity would be how long a DNS timeout takes if you try to use a DNS name.

i also just think it would be nicer to be able to input multiple addresses instead of needing to put it in the hosts file

for reference here is the current function for NetProbe (non-windows):

package main

import (
	"net"
	"time"

	"github.com/jedisct1/dlog"
)

func NetProbe(proxy *Proxy, address string, timeout int) error {
	if len(address) <= 0 || timeout == 0 {
		return nil
	}
	if captivePortalHandler, err := ColdStart(proxy); err == nil {
		if captivePortalHandler != nil {
			defer captivePortalHandler.Stop()
		}
	} else {
		dlog.Critical(err)
	}
	remoteUDPAddr, err := net.ResolveUDPAddr("udp", address)
	if err != nil {
		return err
	}
	retried := false
	if timeout < 0 {
		timeout = MaxTimeout
	} else {
		timeout = Min(MaxTimeout, timeout)
	}
	for tries := timeout; tries > 0; tries-- {
		pc, err := net.DialTimeout("udp", remoteUDPAddr.String(), proxy.timeout)
		if err != nil {
			if !retried {
				retried = true
				dlog.Notice("Network not available yet -- waiting...")
			}
			dlog.Debug(err)
			time.Sleep(1 * time.Second)
			continue
		}
		pc.Close()
		dlog.Notice("Network connectivity detected")
		return nil
	}
	dlog.Error("Timeout while waiting for network connectivity")
	return nil
}

this is what my LSP gives for a description of net.ResolveUDPAddr:

func net.ResolveUDPAddr(network string, address string) (*net.UDPAddr, error)

---

ResolveUDPAddr returns an address of UDP end point.

The network must be a UDP network name.

If the host in the address parameter is not a literal IP address or the port is not a literal port number, ResolveUDPAddr resolves the address to an address of UDP end point. Otherwise, it parses the address as a pair of literal IP address and port number. The address parameter can use a host name, but this is not recommended, because it will return at most one of the host name's IP addresses.

See func Dial (it references a file on my computer) for a description of the network and address parameters.

---

net.ResolveUDPAddr on pkg.go.dev

[jedisct1]

Resolving a name requires working DNS, so that would be a dead lock.

[BPplays]

@jedisct1 what is this in reference to? my original PR kept DNS related stuff mostly the same (aside from trying to resolve every loop and a few new error messages) because it resolves from /etc/hosts, i already said that resolving proper DNS doesn't work to the other reply, and this discussion doesn't even mention hostnames or DNS

[lifenjoiner]

[BPplays]

if this is a test showing the results of using the very strangely named Captive Portals feature, this (having an IPv6 and an IPv4 address assigned to a single name) also works adding it to the hosts file, i just think it's silly that manually adding a name to /etc/hosts or "captive portals" is a requirement to use multiple netprobe addresses

[Romulo-Romero]

It would be nice if we could add multiple probe addresses in case of censorship, this is something that could've been done a while ago.

[jedisct1]

It would be nice if we could add multiple probe addresses in case of censorship

No connection is made to these addresses