DNS over TLS or DNS over HTTPS (DoT / DoH)

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Author Message
mbze430
DD-WRT User


Joined: 14 May 2012
Posts: 239

PostPosted: Wed May 15, 2019 20:00    Post subject: DNS over TLS or DNS over HTTPS (DoT / DoH) Reply with quote
I have been looking at the request threads for DoT and DoH support since mid-last year (also seen some request on the SVN as well). I was wondering if there have been any new development on adding these features into DDWRT (including a GUI)

I believe Stubby is the forefront spear in with DoT. I believe DNSCrypt-Proxy is the forefront of DoH.

I tried both on my ASUS Merlin and pretty simple. Even the latest Merlin has integrated GUI for Stubby.

Just waiting for DDWRT!

_________________
ASUS RT-AC3200 - Deployed Client's site
ASUS RT-AC5200 - Merlin
ASUS RT-AX88U - Merlin
Sponsor
Mile-Lile
DD-WRT Guru


Joined: 24 Feb 2013
Posts: 1516
Location: Belgrade

PostPosted: Wed May 15, 2019 20:57    Post subject: Reply with quote
since https://svn.dd-wrt.com/changeset/30220 you can use custom Unbound configs from jffs... Unbound suports DNS over TLS...

something like this:

Code:

server:
  access-control: 10.0.0.0/8 allow
  access-control: 192.168.0.0/16 allow
 #access-control: fddd::/48 allow
  aggressive-nsec: yes
 #auto-trust-anchor-file: /usr/local/etc/unbound/root.key
  cache-max-ttl: 14400
  cache-min-ttl: 1200
  chroot: /usr/local/etc/unbound
  directory: /usr/local/etc/unbound
  do-ip4: yes
  do-ip6: yes
  do-tcp: yes
  hide-identity: yes
  hide-version: yes
  interface: 0.0.0.0
 #interface: ::0
  pidfile: /var/run/local_unbound.pid
  port: 53
  prefetch: yes
  rrset-roundrobin: yes
  tls-cert-bundle: "/usr/local/share/certs/ca-root-nss.crt"
  use-caps-for-id: yes
  username: unbound

# num-threads: 4
# msg-cache-slabs: 4
# rrset-cache-slabs: 4
# infra-cache-slabs: 4
# key-cache-slabs: 4
# msg-cache-size: 256M
# rrset-cache-size: 512M
# outgoing-range: 8192
# num-queries-per-thread: 4096

 # forward-addr format must be ip "@" port number "#" followed by the valid public hostname
 # in order for unbound to use the tls-cert-bundle to validate the dns server certificate.
 forward-zone:
   name: "."
   forward-tls-upstream: yes
   forward-addr: 1.0.0.1@853#one.one.one.one
   forward-addr: 1.1.1.1@853#one.one.one.one
   forward-addr: 8.8.4.4@853#dns.google
   forward-addr: 8.8.8.8@853#dns.google
mbze430
DD-WRT User


Joined: 14 May 2012
Posts: 239

PostPosted: Wed May 15, 2019 21:30    Post subject: Reply with quote
Where do you exactly get Unbound to start?

I see in the "Setup -> Basic Setup -> Network Setup -> Network Address Server Settings (DHCP) -> Recursive DNS Resolving (Unbound)" Is that the part where you can enable Unbound?

or simply creating /jffs/etc/unbound.conf automagically start Unbound?

_________________
ASUS RT-AC3200 - Deployed Client's site
ASUS RT-AC5200 - Merlin
ASUS RT-AX88U - Merlin
wabe
DD-WRT Guru


Joined: 17 Jun 2006
Posts: 773

PostPosted: Sat May 18, 2019 14:23    Post subject: Reply with quote
Mile-Lile wrote:
since https://svn.dd-wrt.com/changeset/30220 you can use custom Unbound configs from jffs... Unbound suports DNS over TLS...

something like this:


Mike-Lile
Is that a tested configuration on dd-wrt?
I tried something similar, worked in general but not in DNS-tls mode unfortunately. Hard to debug also since switching on logging doesn’t seem to work

_________________
AC-68U rev. C1 on Build 44849
AC-68U rev. A1 on Build 44715
AC-68U rev. A1 on Build 44340
wabe
DD-WRT Guru


Joined: 17 Jun 2006
Posts: 773

PostPosted: Sat May 18, 2019 14:25    Post subject: Reply with quote
mbze430 wrote:
Where do you exactly get Unbound to start?

I see in the "Setup -> Basic Setup -> Network Setup -> Network Address Server Settings (DHCP) -> Recursive DNS Resolving (Unbound)" Is that the part where you can enable Unbound?

Yes

_________________
AC-68U rev. C1 on Build 44849
AC-68U rev. A1 on Build 44715
AC-68U rev. A1 on Build 44340
mbze430
DD-WRT User


Joined: 14 May 2012
Posts: 239

PostPosted: Wed May 22, 2019 16:59    Post subject: Reply with quote
According to the latest DD-WRT v3.0-r39827 std (05/20/19). DNSCrypt-Proxy is part of the firmware.. and I can confirm that the app is there

Code:
root@ddwrt-ac3200:~# dnscrypt-proxy
Wed May 22 09:48:43 2019 [ERROR] Error: no resolver name given, no configuration file either.
Wed May 22 09:48:43 2019 [ERROR] The easiest way to get started is to edit the example configuration file
Wed May 22 09:48:43 2019 [ERROR] and to append the full path to that file to the dnscrypt-proxy command.
Wed May 22 09:48:43 2019 [ERROR] Example: dnscrypt-proxy /usr/local/etc/dnscrypt-proxy.conf
Wed May 22 09:48:43 2019 [ERROR] The local list of public resolvers is loaded from: [/usr/share/dnscrypt-proxy/dnscrypt-resolvers.csv]
Wed May 22 09:48:43 2019 [ERROR] Consult https://dnscrypt.org for more information about dnscrypt-proxy.



However I don't see an GUI to enable it. Assuming right now if I want to use DNSCrypt-Proxy on the router itself I have to set up my own startup script?

_________________
ASUS RT-AC3200 - Deployed Client's site
ASUS RT-AC5200 - Merlin
ASUS RT-AX88U - Merlin
tinkeruntilitworks
Guest





PostPosted: Thu May 23, 2019 16:19    Post subject: Reply with quote
sorry to hijack thread

question

is there any privacy gained by using encrypted dns?

can't our isp's still see all of our traffic?
mbze430
DD-WRT User


Joined: 14 May 2012
Posts: 239

PostPosted: Thu May 23, 2019 17:47    Post subject: Reply with quote
they will see traffic but it will be encrypted. DNS from the beginning are all clear text. with DNS over HTTPS/TLS it's now encrypted.

Information why DNS needs to be protected

https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+-+The+Problem

_________________
ASUS RT-AC3200 - Deployed Client's site
ASUS RT-AC5200 - Merlin
ASUS RT-AX88U - Merlin
tinkeruntilitworks
Guest





PostPosted: Thu May 23, 2019 19:06    Post subject: Reply with quote
thanks for the reply
tinkeruntilitworks
Guest





PostPosted: Thu May 23, 2019 19:14    Post subject: Reply with quote
I have a Netgear r7000p
the bs builds have option for recursive dns. is this encrypted by default? or do I have to alter a config file?

the kong build(last stable) had dnscrypt-proxy but the available listed servers don't seem to be up to date.

wondering best way to set up
wabe
DD-WRT Guru


Joined: 17 Jun 2006
Posts: 773

PostPosted: Thu May 23, 2019 21:50    Post subject: Reply with quote
tinkeruntilitworks wrote:
I have a Netgear r7000p
the bs builds have option for recursive dns. is this encrypted by default? or do I have to alter a config file?

the kong build(last stable) had dnscrypt-proxy but the available listed servers don't seem to be up to date.

wondering best way to set up


Enabling recursive dns will not get you encryption by default. The config needs to be altered. Have experimented with this option and it seems to be broken. My router takes about 10 minutes to start after enabling, without altering the config

_________________
AC-68U rev. C1 on Build 44849
AC-68U rev. A1 on Build 44715
AC-68U rev. A1 on Build 44340
tinkeruntilitworks
Guest





PostPosted: Thu May 23, 2019 22:12    Post subject: Reply with quote
thanks for the reply
vibranto
DD-WRT User


Joined: 30 Apr 2010
Posts: 64

PostPosted: Fri May 24, 2019 12:37    Post subject: Re: DNS over TLS or DNS over HTTPS (DoT / DoH) Reply with quote
Oh dang just realized I posted in a Broadcom forum thread about my Atheros stubby. Doh. Stoopit n00b.

I'll find better place for it. Bottom line, stubby installed easy/great for me.

_________________
Site1: R6400v2 FreshTomato 2019.10.2 | WNDR4300 DD-WRT v3.0-r39800 | WNDR3700v4 Bricked 0.0
Site2: RT-AC3200 Merlin 384.13.0 Site3: R7000 FreshTomato 2019.2
Spares: DD-WRT v.othernumbers
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum