Joined: 04 Aug 2018 Posts: 1420 Location: Appalachian mountains, USA
Posted: Thu May 06, 2021 15:40 Post subject:
On the WRT3200ACM the fallback build currently regarded as the relatively "stable" option is 44048. Before that one, 40009 was the goto build for some time. Newer builds are giving 3200 owners considerable stress, but if you want to try, 46069 is working for some people, particularly those without Apple devices in their networks. See the new-build threads for more detail. _________________ Netgear XR500 and 4x Linksys WRT1900ACSv2 on 52955: VLANs, VAPs, NAS, station mode, OpenVPN client (AirVPN), wireguard server (AirVPN port forward) and clients (AzireVPN, AirVPN, private), 3 DNSCrypt providers via VPN.
Joined: 14 Dec 2015 Posts: 774 Location: 127.0.0.1
Posted: Sun Jun 20, 2021 6:44 Post subject:
whatsashell wrote:
Has anyone had their ISP's say anything about this?
Just a quick wireshark test and it becomes painfully clear you're running a DNS server with all these encrypted requests.
I haven't been doing it this way, but I have Raspberry Pis doing the DNS with encryption for 4 months and no problems here. _________________ Tutorial for flashing WRT series WRT Installation,Upgrade & Basic Setup–Cliff Notes
r52242: WRT3200ACM, WRT1200ACv1 & 1 Velop in bridge mode(IoT subnet), r52242 WRT1900ACv1 AP
Velop:2 WHW0101, RE6500, RE9000(AP)
Spectrum - 1000/50
SysLog Watcher 5, New security Onion box coming soon, Fingboxes, PiHoles, NEMS, Cacti, rpisurv
Joined: 16 Nov 2015 Posts: 6038 Location: UK, London, just across the river..
Posted: Sun Jun 20, 2021 12:14 Post subject:
whatsashell wrote:
Has anyone had their ISP's say anything about this?
Just a quick wireshark test and it becomes painfully clear you're running a DNS server with all these encrypted requests.
Its up to your ISP agreement, but in most of the cases they shouldn't have a word against it..as all goes encrypted....via firewall bypassing ports 443, 853 and ect.. _________________ Atheros
TP-Link WR740Nv1 ---DD-WRT 53045 WAP
TP-Link WR1043NDv2 -DD-WRT 53469 Gateway/DoT,Forced DNS,AP Isolation,Ad-Block,Firewall,VPN,x1VLAN
TP-Link WR1043NDv2 -DD-WRT 53469 Gateway/DoT,Forced DNS,Ad-Block,Firewall,x4VLAN(no-wifi)
TP-Link WR1043NDv2 -Gargoyle OS 1.15.x AP,DNS,QoS,Quotas
Qualcomm-Atheros
Netgear R7800 --DD-WRT 53469 Gateway/DoT,AD-Block,AP&Net Isolation,x3VLAN,Firewall,Vanilla
Netgear R9000 --DD-WRT 53469 Gateway/Stubby DoT,AD-Block,AP Isolation,Firewall,Forced DNS,x2VLAN,Vanilla
Broadcom
Netgear R7000 --DD-WRT 53469 Gateway/SmartDNS/DoH,AD-Block,Firewall,Forced DNS,x3VLAN,VPN
NOT USING 5Ghz ANYWHERE
------------------------------------------------------
Stubby DNS over TLS I DNSCrypt v2 by mac913
04/26/20: If Cloudflare's DoT checker is not verifying encrypted DNS
Cloudflare's DNS over TLS checker has recently been unable to verify if DoT is set up for me using multiple routers with different firmwares (DD-WRT and Merlin).
The easiest way to verify it is to disable NTP and reboot your router. Your router must have the correct time for DoT to work. If DNS stops working, then you can be reasonably sure that DoT is set up correctly.
The other option that will truly verify it is by plugging a switch in between your modem and the router and running Wireshark on another device on the same switch. Filter it down to port 853. It is working if DNS queries are going out of port 853.
04/19/20: Updated for unbound v1.10.0
- unbound.conf should be stored in /jffs/unbound
- Additional files needed (updates in Configuration steps 1-5)
I recently just got DNS over TLS (DoT) set up on my WRT1900AC. Here's a guide on how I got it set up. If nothing works, it's completely reversible by unchecking Recursive DNS Resolving (Unbound) on the Setup page.
This works successfully on a WRT1900AC v1 with Firmware Version r39572. This will probably work on other models as well, especially those of the WRT type, but I have not tested them.
GUI Settings
1. Set a time server by IP Address
DoT requires that your time be set correctly, otherwise nothing can be validated and the DNS server gets all fussy. Since you need DNS to resolve a domain name, you have to use an IP address of a time server.
Check the NIST International Time Server List for one that will work for you. This must work on boot-up, so try out a few to see which ones respond right away. For me, 128.138.141.172 (utcnist2.colorado.edu) worked great.
2. Enable Recursive DNS Resolving (Unbound)
On your Setup page, check the "Recursive DNS Resolving (Unbound)" box under DHCP.
When you check this box, you're effectively giving control over from DNSMasq to Unbound for your DNS queries. Wanna know more about Unbound? The nice folks on the DD-WRT Wiki made this handy dandy guide.
3. Get a JFFS share set up
You'll need this to save your Unbound configuration file permanently, but it can also be used to install Entware.
Head over to the Administration page and check "Enable" under JFFS2 Support for Internal Flash Storage and check "Clean internal flash storage." Once you do this, reboot your router. You should now have JFFS space available. The router will automatically uncheck the "Clean internal flash storage" option after the reboot to prevent clearing all of your JFFS space every time you reboot.
Command Line Settings
Now's the fun part where you get to play around as root in Bash. How often do you get to do that without needing to document why you made every keystroke to some 450-question million-dollar documentation system that asks you if you're really really really sure you copied and pasted a 32kb text document correctly? At home where you can break your own shit without consequence, that's when.
The preferred method is to plug a USB stick into the back of the router and install Entware there. If you're lazy like me, you have plenty of extra Flash storage available to do this.
If you go the flash route, remember that it has a limited write life and was not designed for write-heavy applications. You'll probably never write to it enough to get to that point, but keep that in mind if you decide to install additional software on it.
Important Note: If your JFFS space is mounted in flash, you'll need to mount it to /opt before installing Entware. Do that with this script.
Code:
mkdir /jffs/opt
mount -o bind /jffs/opt /opt
The first line creates a new directory called opt in JFFS. This is where all of your stuff will get written. The second mounts it to /opt where Entware is looking during the install. This forces Entware to install to the internal flash JFFS.
Configuring Unbound
A temporary configuration file for Unbound has been created for you already. You just need to make a few slight modifications to it and save it as a permanent file.
1. Create the unbound directory in JFFS
Unbound will look for a permanent configuration file here, if it exists.
Code:
mkdir /jffs/unbound
2. Copy the pre-made Unbound config file to /jffs/unbound
5. Edit the unbound configuration file to use DNS over TLS
You'll have to do this through.....vi. Yes, I know. It's weird if you haven't used it. Look, it's not that bad. It's just from a different time! I'll walk you through it. It's going to be okay.
Code:
vi /jffs/unbound/unbound.conf
Here's all you need to know.
1. Hit 'i' to start inserting and writing text. Navigate with the arrow keys (it's all you'll need with how small this is)
2. When you're done, hit 'esc'
3. Type ':', then hit 'wq'. This means write the changes and quit.
Use the below unbound.conf as a template. You'll need to edit the locations of chroot, directory , and root-hints. You'll also be adding a few different lines under forward-zone:.
Lines under forward-zone: tell Unbound that you'd like to use DNS over TLS, and give it the DNS servers that you'd like to use. Copy these verbatim. If you would like to use other DNS servers or want to know more about what these settings are doing, check out this more detailed guide.
You should now be all set. Reboot your router and give it a whirl. If successful, you will be able to access the internet and also pass the Cloudflare DNS over TLS test.
Troubleshooting
Literally no website works
1. Check that your time server is successfully setting your time. Syslog will be your friend here
2. Make sure that your time zone is set correctly
3. Make sure that you spelled the name of the DNS servers after the # correctly in your unbound config file
4. Check that your CA certificate bundle is actually there
5. Check that your unbound.conf file points to your CA certificate bundle and that you didn't misspell anything while fiddling around in vi
Remember: you can always go back by unchecking Recursive DNS Resolving (Unbound) on the Setup page. If nothing is working right and you can't figure it out, simply turn it off and let DNSMasq take over. Grab a drink and take a whack at it tomorrow. Unless you're Edward Snowden or Jason Bourne, you can live another day with someone potentially knowing how many times your IP address visited that kinky site that day.
Cloudflare can't verify if DNS over TLS is working
From what I can tell, you need to use Cloudflare's DNS server for it to verify. Once you have it all verified and are certain that DNS over TLS is set up properly, you can use any DNS server that supports DNS over TLS.
Alternatively, you can use Wireshark between your modem and router to review your DNS queries. If your DNS queries are going out over port 853, then congratulations! It's set up!
Hey, I'm trying to follow your DNS to TLS guide here. One problem I am having is that I already have entware installed to a USB stick, and my usb is mounted at
Code:
/opt
. So I have modified your guide so that anytime you have
Code:
/jffs/*
in your path or commands, I replaced
Code:
/jffs
with
Code:
/opt/
. I completed the guide, but it looks like unbound is still using the configuration file
Code:
unbound.conf
located int
Code:
/tmp/unbound.conf
. I don't think its using my
Code:
unbound.conf
located in
Code:
/opt/unbound/unbound.conf
. How can I get unbound to use my
Code:
unbound.conf
file as opposed to the default
Code:
/tmp/unbound.conf
file? How can I get this guide to fully work with using entware on a usb and NOT using jffs2 or the
Code:
/jffs
directory? Let me know if you can! Thanks! _________________ DanRanRocks - Tech Tutorials by Dan Ran
Read. Through. The. Entire. Thread. And. All. Linked. Resources. _________________ "The woods are lovely, dark and deep,
But I have promises to keep,
And miles to go before I sleep,
And miles to go before I sleep." - Robert Frost
"I am one of the noticeable ones - notice me" - Dale Frances McKenzie Bozzio
