How-To: Routing DNSCrypt service through the OpenVPN client

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Goto page Previous  1, 2
Author Message
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 988
Location: Appalachian mountains, USA

PostPosted: Mon Dec 02, 2019 23:15    Post subject: Reply with quote
Alozaros wrote:
donno why so much hassle....you running that long script...
Edit: Because this is specific to DNSCrypt! If you are not using DNSCrypt and just want to use the DNS server pushed by your VPN provider, you don't need it. A modern build will manage DNS just fine as you connect/disconnect/reconnect the VPN. If you are using Unbound or Stubby to manage DNSCrypt, I don't know the details of how things will go, but I doubt seriously that it will restart dnscrypt-proxy each time you switch between WAN and the VPN for DNS, which is the heart of what is happening here. I also don't know whether Unbound/Stubby can handle multiple DNSCrypt servers. This script can.

As to why so long, that's easy... I thought it would be a short script when I started! It just got longer and longer as I discovered I needed more tests to see when to switch back to WAN and as I added more and more logging and controllability to it. Bit like boiling the proverbial frog. (It's getting really hot in here! Shocked )

And if I didn't have a bit of the bulldog that never gives up in me, I'd never have survived an engineering career. Wink

_________________
Five WRT1900ACSv2's on 42926, 44048.
VLANs, multiple VAPs, NAS, client-mode travel router, OpenVPN client (AirVPN), DDNS, wireguard server, two wireguard clients (AzireVPN), use of two DNSCrypt DNS providers (inc Quad9) through OpenVPN and wireguard clients.


Last edited by SurprisedItWorks on Mon Dec 30, 2019 16:31; edited 1 time in total
Sponsor
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 988
Location: Appalachian mountains, USA

PostPosted: Sun Dec 08, 2019 19:49    Post subject: Reply with quote
Important update to the first post today. See the Change Log at the end of the post. If you're using a version of the script with braces { } around everything, you need this small fix. Without it, if dd-wrt runs the script twice -- it will occasionally do this -- your router will crash!
_________________
Five WRT1900ACSv2's on 42926, 44048.
VLANs, multiple VAPs, NAS, client-mode travel router, OpenVPN client (AirVPN), DDNS, wireguard server, two wireguard clients (AzireVPN), use of two DNSCrypt DNS providers (inc Quad9) through OpenVPN and wireguard clients.
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 988
Location: Appalachian mountains, USA

PostPosted: Mon Dec 30, 2019 16:49    Post subject: Reply with quote
My post before last now has an edit.

And the original script has been edited to wait longer before trying to route through the VPN again if the last block of time with routes through the VPN was less than ten minutes. Most extreme case: Route through VPN and immediately fail back out because, for example, the VPN gateway is not responding quickly. In that case, the script will move DNS back to the WAN and then wait an extra (nearly) five minutes before attempting to route DNS through the VPN again. This change is to prevent quickly and repeatedly thrashing back and forth between VPN and WAN in the case when things just aren't right with the VPN. It gives the VPN server a little time to sort matters out and get running right before we try the fancy stuff again. See the change log entry there made just before this post.

I made this change here after seing a case in the log a month or so ago when thrashing was a problem because a VPN gateway was responding slowly to pings. I've actually had these changes running here for a few weeks, but I haven't yet seen a case when the extra delay kicks in. So this is actually a very minor change that will affect things only in rare cases.

One can also attempt to address the problem of occasional slow gateway ping times by changing the way the ping tests are done to give the gateway more time or more pings (but while keeping the pings quick for the DNS servers). I'm testing such a change now, but it will take at least weeks to see whether the occasional (weeks between) to-WAN-and-back responses to slow gateway ping responses cease appearing in the system log. I won't update the posted script until I have more experience with these ping changes.

Sorry about discussing the messy details here. It's intended as a bit of a confidence builder rather than anything a user (I suspect I'm still the only one!) need be concerned with.

_________________
Five WRT1900ACSv2's on 42926, 44048.
VLANs, multiple VAPs, NAS, client-mode travel router, OpenVPN client (AirVPN), DDNS, wireguard server, two wireguard clients (AzireVPN), use of two DNSCrypt DNS providers (inc Quad9) through OpenVPN and wireguard clients.
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 3958
Location: UK, London, just across the river..

PostPosted: Thu Feb 20, 2020 9:54    Post subject: Reply with quote
i can confidently say, that both DNSCrypt-proxy v2 and Stubby for DNS over TLS, are both working out of the box along with DNSmasq and VPN... all DNS hits go over the VPN, inside in the VPN pool...so no DNS leaks outside via WAN IP or so...
you dont need any other rules other than
no-resolv and server=xxx.xxx.xxx.xxx in DNSmasq...

tested both with tcpdump and wireshark...

p.s. 'If you are using Unbound or Stubby to manage DNSCrypt...' --- honestly that claim in this blue text is bombastic and makes me laugh...no, Unbound, nor Stubby can manage DNScrypt, but its DNSmasq that manages those...
just don't tell me, that you are the next security freak, that wants to use all those Unbound, Stubby and DNScrypt at once, all via bitcoin prepaid VPN just to improve security

_________________
Atheros
TP-Link WR740Nv1 -----DD-WRT 44538 BS AP,NAT
TP-Link WR740Nv4 -----DD-WRT 44251 BS WAP/Switch
TP-Link WR1043NDv2 ---DD-WRT 44715 BS AP,NAT,AP Isolation,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---DD-WRT 44772 BS AP,NAT,AD Block,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---Gargoyle OS 1.12.0 AP,NAT,QoS,Quotas
Qualcomm/IPQ8065
Netgear R7800 -----DD-WRT 44849 BS AP,NAT,AD-Block,AP&Net Isolation,VLAN's,Firewall,Local DNS,DoT
Broadcom
Netgear R7000 -----DD-WRT 44849 BS AP,Wi-Fi OFF,NAT,AD-Block,Firewall,Local DNS,Forced DNS,DoT,VPN
-----------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 by mac913
SurprisedItWorks
DD-WRT Guru


Joined: 04 Aug 2018
Posts: 988
Location: Appalachian mountains, USA

PostPosted: Thu Feb 20, 2020 19:46    Post subject: Reply with quote
Alozaros wrote:
p.s. 'If you are using Unbound or Stubby to manage DNSCrypt...' --- honestly that claim in this blue text is bombastic and makes me laugh...no, Unbound, nor Stubby can manage DNScrypt, but its DNSmasq that manages those...
just don't tell me, that you are the next security freak, that wants to use all those Unbound, Stubby and DNScrypt at once, all via bitcoin prepaid VPN just to improve security

That's a bit rough, don't you think? I don't consider myself a security freak (more a gently curious party) have never used bitcoin, and have never used Unbound or Stubby, much less simultaneously with whatever else. Having not used them, I have claimed no expertise or even basic understanding of their use. I assumed (but based on what long-ago too-quick reading, I have no idea) that they were alternatives to having dnsmasq handle DNS. If it's not so, please educate us all. But laughing accusations of bombast for simply trying to help people is out of line.

_________________
Five WRT1900ACSv2's on 42926, 44048.
VLANs, multiple VAPs, NAS, client-mode travel router, OpenVPN client (AirVPN), DDNS, wireguard server, two wireguard clients (AzireVPN), use of two DNSCrypt DNS providers (inc Quad9) through OpenVPN and wireguard clients.
Alozaros
DD-WRT Guru


Joined: 16 Nov 2015
Posts: 3958
Location: UK, London, just across the river..

PostPosted: Thu Feb 20, 2020 21:20    Post subject: Reply with quote
SurprisedItWorks wrote:
Alozaros wrote:
p.s. 'If you are using Unbound or Stubby to manage DNSCrypt...' --- honestly that claim in this blue text is bombastic and makes me laugh...no, Unbound, nor Stubby can manage DNScrypt, but its DNSmasq that manages those...
just don't tell me, that you are the next security freak, that wants to use all those Unbound, Stubby and DNScrypt at once, all via bitcoin prepaid VPN just to improve security

That's a bit rough, don't you think? I don't consider myself a security freak (more a gently curious party) have never used bitcoin, and have never used Unbound or Stubby, much less simultaneously with whatever else. Having not used them, I have claimed no expertise or even basic understanding of their use. I assumed (but based on what long-ago too-quick reading, I have no idea) that they were alternatives to having dnsmasq handle DNS. If it's not so, please educate us all. But laughing accusations of bombast for simply trying to help people is out of line.


oops, sorry no offense.....i just wrote that for a laugh ... I know you are not one of those...i ve to apologize if....any offense...

To my understanding Unbound, Stubby, and DNScrypt are DNS clients/resolvers and DNSmasq
is a small client/server (the backbone of DDWRT) ...that can go along and utilize/manage
the work of those clients Wink

_________________
Atheros
TP-Link WR740Nv1 -----DD-WRT 44538 BS AP,NAT
TP-Link WR740Nv4 -----DD-WRT 44251 BS WAP/Switch
TP-Link WR1043NDv2 ---DD-WRT 44715 BS AP,NAT,AP Isolation,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---DD-WRT 44772 BS AP,NAT,AD Block,Firewall,Local DNS,Forced DNS,DoT,VPN,VLAN
TP-Link WR1043NDv2 ---Gargoyle OS 1.12.0 AP,NAT,QoS,Quotas
Qualcomm/IPQ8065
Netgear R7800 -----DD-WRT 44849 BS AP,NAT,AD-Block,AP&Net Isolation,VLAN's,Firewall,Local DNS,DoT
Broadcom
Netgear R7000 -----DD-WRT 44849 BS AP,Wi-Fi OFF,NAT,AD-Block,Firewall,Local DNS,Forced DNS,DoT,VPN
-----------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 by mac913
Goto page Previous  1, 2 Display posts from previous:    Page 2 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum