caribpa
commented
6 years ago After playing a little more with your scripts I believe that there's a better way to do what I said above so that the user doesn't have to care about DNSSEC in the UI. Also I've fixed some other issues regarding dnsmasq waiting and timing out because dnscrypt is not ready at startup.
I've changed the dnsmasq section in the manager's file (/jffs/dnscrypt/manager) to:
dnsmasq)
sed -i "/^servers-file=.*$/d" /etc/dnsmasq.conf
append_on_demand /etc/dnsmasq.conf "no-resolv"
if [ -f /tmp/dnscrypt-start ]; then
sed -i "/^dnssec.*$/d; /^trust-anchor=.*$/d" /etc/dnsmasq.conf
append_on_demand /etc/dnsmasq.conf "proxy-dnssec" "server=127.0.0.1#65053"
else
for i in `nvram get wan0_dns1_x` `nvram get wan0_dns2_x`; do
append_on_demand /etc/dnsmasq.conf "server=$i"
done
grep "^dnssec$" /etc/dnsmasq.conf && append_on_demand /etc/dnsmasq.conf "dnssec-check-unsigned"
fi
;;Now I'm going to explain what happened before this fix:
Let's start saying that dnsmasq starts with errors because the script /jffs/scripts/dnsmasq.postconf is executed before /jffs/scripts/wan-start, so the file /tmp/resolv.dnsmasq doesn't exist when dnsmasq is trying to open it, which means that it won't be able to connect to the internet right away (but eventually will once the file is created). Also we know that dnscrypt starts after the execution of /jffs/scripts/wan-start which means that dnsmasq will timeout a lot waiting for it at startup (I believe it's because it will try to connect to the NTP servers to set the system's time), making the startup of the router and the network very slow.
Now that we know the issues, I'm going to try to explain how I fixed it:
First, we need to remove the servers-file option and append no-resolv to /etc/dnsmasq.conf to prevent it from using any other resolver and waiting for a file that doesn't exist at startup. Second, to know when dnscrypt is ready, we will create a file (/tmp/dnscrypt-start) when /jffs/scripts/wan-start is executed, and then we will restart dnsmasq's service.
The first time dnsmasq launches has to be without dnscrypt. So, if the file /tmp/dnscrypt-start doesn't exist, we append the WAN's DNS servers we chose manually (I didn't try with the automatic option) in the UI (WAN (Advanced Settings) → Internet Connection → WAN DNS Settings) using a for loop so internet will be available right away, and if the user enabled DNSSEC in the UI (LAN (Advanced Settings) → DHCP Server → DNS and WINS Server Setting → Enable DNSSEC support) then we also append the dnsmasq option dnssec-check-unsigned for further protection, as we will be using dnsmasq to validate DNSSEC until dnscrypt is ready.
When dnscrypt is ready (the file /tmp/dnscrypt-start exists), we delete all the dnssec options and append the option proxy-dnssec and server=127.0.0.1#65053 to the file /etc/dnsmasq.conf because we want to use dnscrypt as upstream server and proxy it the DNSSEC requests.
For all this process to work, we also have to edit one of the startup scripts (/jffs/scripts/) as follow:
/jffs/scripts/wan-start
----------------------------
#!/bin/sh
[ -x /jffs/dnscrypt/manager ] && touch /tmp/dnscrypt-start && service restart_dnsmasqSo, in the end there's no need in starting dnscrypt in /jffs/scripts/wan-start as the manager (/jffs/dnscrypt/manager) will automatically launch it.
You can find my scripts here: dnscrypt-files.zip
Note that I'm using a RT-AC86U with firmware AsusWRT-Merlin 384.3, so I don't know if this applies to other firmwares and routers.
thuantran
Hi, I've found out that DNSSEC is being validated by dnsmasq (if enabled in the UI) instead of dnscrypt-proxy. To change this behavior we have to append to dnsmasq.conf the option proxy-dnssec, to do that we edit the line 86 of the file manager like this:
Then we have to disable DNSSEC in the UI to prevent it from adding the option dnssec to dnsmasq.conf:
And then we reboot the router.
I know that this proxy-dnssec option is not well known and does not appear in every manual but it's the way to take advantage of dnscrypt's full potential.
You can read about proxy-dnssec here and it's recommended in the Arch Wiki.