[ciscodlink]

I already posted this a few times in the "Kong Firmware Threads" but it doesn't seem to get any attention.

So here I am trying again with a dedicated thread this time:

- DNSCrypt development has stopped.
- A new developer has taken over and continues developing DNSCrypt under the name "DNSCrypt v2".
- Most (if not all) resolvers stopped supporting the old DNSCrypt v1 and only work with DNSCrypt v2 from now on (e.g. Cisco, d0wn, dnscrypt-eu.nl,.....)
- DNSCrypt v2 brings a lot of major fixes and improvements

DNSCrypt v2 Github:
https://github.com/jedisct1/dnscrypt-proxy

@Kong:
If you read this, please update DNSCrypt in the next firmware. I have had to jump between resolvers every few days now and today it seems like none of the available resolvers in the firmware are working anymore. So I had to completely disable DNSCrypt today.

Thanks in advance!

[<Kong>]

[ciscodlink]

[jwh7]

[Dr_K]

[James2k]

So I ended up troubleshooting a network issue for a while not realising it was DNSCrypt all a long. Oops. Wish I'd seen this post earlier!

Potenitally Entware is an option to continue using DNSCrypt, currently has the old 1x version, but will be updated soonish, or perhaps move over to ubound as others have said.

In fact the arm binary on the official GitHub page works on armv7:

https://github.com/jedisct1/dnscrypt-proxy/releases

I personally have too much dependency on dnsmasq currently with ipset (split VPN tunnel stuff), so I'll be sticking with dnsmasq.

[mac913]

I have 4 r7000s (families and my own) using dnsmasq's DNSCrypt without issues with an uptime of over 45 days.

Thanks James2k for the link, if DNSCrypt v1 stops working on the servers I use but so far DNSCrypt v1 is Golden.

[HalfBit]

This doesn't fix things for DD-WRT, and I've been out of pocket on these forums for a while, but I recently moved DNSCrypt to a Raspberry Pi that is also running Pi-Hole.

Router/clients -> Pi-Hole -> loopback to DNSCrypt port -> out to OpenDNS

Took me a bit to get the Pi-Hole and DNSCrypt pieces to both work on start up and some other desired config with correct user permissions etc., but is all working very nicely now.

Let me know if you would like more information.

[Brimmy]

[buffalo0207]

@HalfBit - Could you PM to let me know your configuration for DNSCRYPT and PiHOLE. I currently use PiHole on a TinkerBoard (almost the same as a Raspberry Pi, just faster) using DietPi, but would like to have DNSCRYPT on the TB, as I believe it's not possible to have it and YaMON installed on the R9000.

Cheers...

[ludacrisvp]

[HalfBit]

[Alozaros]

yep DNSCrypt is a killer, its a nice thing to have..
i don't have any troubles with it its been working fairly with no issues at all its very much about the correct server used as many of them tend to go down for either maintenance or anything else quite often...
those once i choose are stable and do work most of the time...
DNSCrypt is also very NTP time dependant so if its not working DNSCrypt makes an issues so those one that complain check your NTP time servers
DNSCrypt encrypts and DNSSEC all the DNS requests in both directions so UNbound and DNS over TLS or Doh are not the same at all...DNSCrypt provides much more security as well DNSSEC, DoH and Tls
sadly the new DNSCrypt is using Go Lang and its huge
so if there is any compress trick to be able to fit it in to the Flash size than it will be awesome to have it otherwise we can use it on computer level if so...
the other alternative will be DoH POST option as tls is more easy to monitor and hack unless its not tls 1.3 but most of the openDNS like 9.9.9.9 & 1.1.1.1 already support DoH and Tls
i guess this thing might even help on router level... https://blog.technitium.com/2018/12/configuring-dns-over-tls-and-dns-over.html

[Dr_K]

I agree....DNScrypt still running strong here with four servers all also using DNSSEC

Although one of them has a rekey issue for an hour or two each day.....assuming that would be a timezone issue

As far as the NTP issues many have reported......here are my two cents

<Kong> fixed that a long time ago

You have to leave the box blank and only select a timezone

Now here is the catch that seams to get many

In my testing in the past...once you enter anything...whether it be a name or ip address....then delete it...something gets left behind in the nvram....causing it to not work properly

Only solution is to "erase nvram" if on an older firmware or "nvram erase" if on a more current build......gui reset to default may also work...but personally I never tested it for this issue

For completeness....if I only use one DNScrypt server through the gui...it sometimes takes up to five minutes to get the enitial time after a reboot?

When run from command line in a startup script using the four servers....the time is always set on the first try?

[Alozaros]

216.239.35.4 paste it in the NTP box and select your time zone it never failed... its one of the GGL ntp time servers and if you use a name instead of IP its buggy..