Dnscrypt-proxy: [OpenWRT] Wiki Suggestion: Use dnsmasq redirect rather than setting up DNS on the interfaces

[andrebrait]

Hi there,

Instead of having dnscrypt-proxy listen on 127.0.0.53:53, I think it should be better to have it listen to 127.0.0.1:5353 (and [::1]:5353) and have dnsmasq (or whatever DNS forwarder one would like to use) listen to it. That way, not only it's possible to have the requests forwarded more easily (doing that is easier than changing the interfaces) as it's possible to make dnsmasq intecept insecure DNS queries and force them through dnscrypt.

[jedisct1]

Why?

It just adds an additional layer and makes things more complicated.

[andrebrait]

Default DNS forwarder in OpenWRT
Just one point for configuring the whole system
Still allows resolving local domain addresses (kind of a big deal, sometimes)

I mean, maybe not switching for that, but adding it as a possible way to configure DNSCrypt 2?

[jedisct1]

This is something you can add in the section dedicated to OpenWRT. But pretty much everywhere else, dnsmasq is not installed or doesn't even exist (Windows).

[iefdev]

@andrebrait: I think it should be better to have it listen to 127.0.0.1:5353 (and [::1]:5353)

Yes, please, or another IP. The (really) old DNScrypt when OpenDNS had it, used 127.0.0.54. I need it to work with dnsmasq. For example, I have dnsmasq for all my local '//*.dev' sites (instead of in /etc/hosts).

[andrebrait]

@jedisct1 Oops, I thought I had made that clear in the OP. I didn't. Sorry, this is about OpenWRT only, yes.

I'll upload my current config that works pretty well with OpenWRT + dnsmasq, plus I got a nice firewall rule to make every request for an insecure DNS originated inside the local network to be intercepted and redirected to the router's DNS resolver (in OpenWRT's case, usually dnsmasq).

[andrebrait]

The reason I suggested a different port is just because using 127.0.0.53 didn't work for me but using 127.0.0.1:5353 did.

[jedisct1]

For example, I have dnsmasq for all my local '//*.dev' sites (instead of in /etc/hosts).

You don't need dnsmasq for that. Use cloaking.

[iefdev]

@jedisct1 Thx… It was old habits. ^^

[kontaxis]

@andrebrait port 5353 is reserved both in TCP and UDP for mDNS. I would suggest using 60053.

[andrebrait]

@kontaxis we better mention that the user should choose another port in case that one doesn't work.

Using a port in that range works too.

@jedisct1 cloaking works if the IP is static, but it doesn't for DHCP-assigned IPs, AFAIK. Does it?

[jedisct1]

@andrebrait The router is the one that assigns IP addresses for the local network. Its own IP is static, or else all devices would lose connectivity as soon as its IP changes.

[andrebrait]

@jedisct1 yes, of course. But dnsmasq (which also doubles as a DHCP server) is capable of resolving names for devices that are dynamically allocated by its DHCP.

Say you connect a computer with hostname "X" on my network which has the domain name "lan" configured in dnsmasq.

X.lan will resolve to that computer's IP address in my LAN, even if it was assigned with DHCP, as long as dnsmasq was the server who did the assignment.

That's useful for when you have a device that's most useful when using dynamically allocated IPs (say a laptop with WiFi) but you still do some stuff with it as a server at home. That spares you from changing drom dynamic to static IPs on the client every time you leave the house and then come back.

I do that with my laptop, for example.

Cloaking can't do that. That's what I meant. Overall, as far as the defsults for OpenWRT, using dnsmasq to redirect traffic is both easier and more convenient.

(I think Unbound with odhcpd can do that too, but I'm not sure. Anyway, the reason I'm talking about dnsmasq is that it's the default for OpenWRT and so uaing it is just a matter of convenience and keeping the rest of the functionality it provides intact).

[jedisct1]

If you want to improve the page about OpenWRT, go ahead :)

I use it on OpenWRT the other way round, with dnscrypt-proxy forwarding the local domain and in-addr.arpa to dnsmasq, so I get more accurate logging. But the end result is the same.