Proposal to improve OpenWRT configuration instructions

[the-w1nd]

First of all - Thanks a lot to Frank (@jedisct1) and everyone else who contributed to such a great utility! Kudos!

In order to tighten the security, I would like to propose some changes to installation instructions for OpenWRT environments, so it does not leak DNS requests to the ISP. I've written my current tested changes in the OpenWRT forum and improved/finalized it with the help of others.

I would like to hear any comments or suggestions before changing the wiki page here. Or feel free to modify the wiki from my suggestions.

The important part is that the proper configuration should pass the tests (1) and (2) from the section "How to check what features are supported by your resolver".

Thanks

[jedisct1]

Hi!

And thanks for pointing out that dnsmasq was still used.

I thought DNS queries were redirected using firewall rules. But you are correct, port 53 was always bound to dnsmasq, and what happens is quite the opposite of the original intent.

The original intent was to use dnsmasq only for local domain names (DHCP device names).

This can still be easily achieved by having dnsmasq listen to a different port.

The Wiki was updated to do this, and as an unexpected result, everything is easier since there is no need to change the DNS settings on individual interfaces.

I just followed the steps on an OpenWRT router, and everything seems to work fine, but your reviews and additions are more than welcome.

[the-w1nd]

Well ... while your proposed configuration is going to hide dnsmasq from direct requests, the important part is that the /etc/resolv.conf is still there and pointing to the ISP. So, local programs running on the router (e.g. nslookup) would be able to use it and still hit the ISP.

Also, if you have static DHCP with hostnames populated, hosts on the local network would not be able to resolve other host names by their short names. They'd have to use fqdn with the ".lan" suffix (or the configured domain).

[jedisct1]

Doesn't /etc/resolv.conf have this by default?

search lan
nameserver 127.0.0.1

I just reinstalled OpenWRT from scratch and got this.

Resolving local names without the domain should also be fine if the DHCP server sends .dev as the default search domain.

[the-w1nd]

Most likely, you've done "sysupgrade" on your router and it preserved your old configuration. If you use the "*-factory.img" image of OpenWRT for your router, it will make it a sparkling clean default environment, which can be referenced under /rom/etc/config/ folder. You can see that /rom/etc/config/dhcp has the following option:
config dnsmasq option resolvfile '/tmp/resolv.conf.auto'
which is going to point to your ISP and get copied into /tmp/resolv.conf and sym-linked into /etc/resolv.conf.

You must've either customized your /etc/resolv.conf file or enabled option option localuse 1

On my Windows client, I can see that the DHCP server properly provided "DNS Suffix Search List", so maybe it was some old problem that I had experienced when looking up other machines by their short names. Or maybe I had it when using Windows shares, which uses WINS (if I remember it right).

Anyway, I believe using dnsmasq as the primary service is the right approach architecture wise, so everything goes through it. And making DNSCrypt v2 as a separate service for outside DNS requests only by dnsmasq is the right approach. Your suggested configuration puts DNSCrypt in front of dnsmasq and creates an unnecessary overhead and configuration loop (when either service can send a request to the other one). Could be just my opinion.

[jedisct1]

You know OpenWRT far better than I do, so feel free to update the Wiki with something great :)

[the-w1nd]

You know OpenWRT far better than I do

I would never make such a claim. That's why I need others' help in double-checking my proposals. :)

One other thing to add - DNSCrypt v1 was created many years ago and knowledgeable people integrated it properly into OpenWRT. I just tried to preserve that layout for DNSCrypt v2.

[the-w1nd]

Just updated the wiki: https://github.com/jedisct1/dnscrypt-proxy/wiki/Installation-on-OpenWRT
Could somebody double-check my changes, please?

[jedisct1]

This is awesome, thank you so much for this!

[the-w1nd]

You're welcome. Just added one small section to redirect all external DNS requests into the router,

One thing I wanted to check with with - you've listed this topic on the wiki:

Check that you are not using your ISP resolver any more:

openwrt > dnscrypt-proxy -resolve google.com

Resolver IP should not belong to your ISP.

Does it mean that "dnscrypt-proxy" would behave in "client" mode and use network's configuration to run the request? Or would it still try to use its toml-file and pick one of its servers to resolve the query?

[vanyaindigo]

Is there any way to use 2 separate blacklist.txt files in dnscrypt-proxy.toml config file (first for adblock and second for local domains)?

[the-w1nd]

Is there any way to use 2 separate blacklist.txt files in dnscrypt-proxy.toml config file (first for adblock and second for local domains)?

At the moment, there is no way to provide more than one entry for the blacklist_file configuration option. But anyone who builds their own black lists from external sources (e.g. adblock, etc.) should use a file with local domains that will be included into the black list by its generator. All examples provided with DNSCrypt v2 include the following line to do that:

# Local additions
file:domains-blacklist-local-additions.txt

I guess this can also be filed as an enhancement to configuration options of DNSCrypt v2 to support more than one blacklist file. @jedisct1, what's your opinion?

[vanyaindigo]

In fact, this is a half-measure: each time after the refirmware manually create one file blacklist.txt is not optimal. The peculiarity here is that one file is permanent, the second is variable. Of course, I can solve this problem by constantly adding local domains to the Adblock for manual blocking.

[vanyaindigo]

Don't like this new solution. Works with lag.

[the-w1nd]

What configuration did you have before? The same one as on the wiki before my change?
Have you been using adblock filters with DNSCrypt or dnsmasq? Have you tried disabling them? Any process spikes on the CPU when you run DNS queries?

[vanyaindigo]

My today configuration that was before:

/etc/config/dhcp

config dnsmasq
	option domainneeded '1'
	option boguspriv '1'
	option filterwin2k '0'
	option localise_queries '1'
	option rebind_protection '1'
	option rebind_localhost '1'
	option noresolv '1'	
	list server '/pool.ntp.org/1.0.0.1'
	list server '127.0.0.53#53'
	option local '/lan/'
	option domain 'lan'
	option expandhosts '1'
	option nonegcache '0'
	option authoritative '1'
	option readethers '1'
	option leasefile '/tmp/dhcp.leases'
	option ednspacket_max '1280'
	option cachesize '10000'
	option nonwildcard '1'
	option localservice '1'
        option dnsforwardmax '300'

/etc/dnsmasq.conf empty

/etc/config/dnscrypt-proxy.toml

listen_addresses = ['127.0.0.53:53']
forwarding_rules = 'forwarding-rules.txt'

forwarding-rules.txt

test 127.0.0.1
onion 127.0.0.1
localhost 127.0.0.1
local 127.0.0.1
invalid 127.0.0.1
bind 127.0.0.1
lan 127.0.0.1
internal 127.0.0.1
intranet 127.0.0.1
private 127.0.0.1
workgroup 127.0.0.1

10.in-addr.arpa 127.0.0.1
16.172.in-addr.arpa 127.0.0.1
168.192.in-addr.arpa 127.0.0.1
254.169.in-addr.arpa 127.0.0.1

/etc/config/firewall

config redirect 'force_dns_53'
	option name 'Force DNS'
        option src 'lan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '53'
        option target 'DNAT'
	option dest_port '53'        	

config redirect 'force_dns_853'
	option name 'Force DNS, port 853'
	option src 'lan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '853'
	option target 'DNAT'
	option dest_port '53'

config redirect 'force_dns_5353'
	option name 'Force DNS, port 5353'
	option src 'lan'
	option dest 'lan'
	option proto 'tcp udp'
	option src_dport '5353'
	option target 'DNAT'
	option dest_port '53'

Works perfect.