Dnscrypt-proxy: EdgeOS: Prefer iptables redirect in place of dnsmasq DNS frowarding

[dduransseau]

Who is the bug affecting?

At least EdgeOSv2.0.8-hotfix.1 (tested on EdgeROuter Lite)

What is affected by this bug?

Some DNS query continue to be sent to system DNS in place of dnscrypt-proxy

When does this occur?

I was not able to understand what cause the resolution go sometimes to dnscrypt-proxy and sometimes to system DNS but by running a capture as suggested I clearly see some traffic sent to system DNS

How do we replicate the issue?

Just run capture as suggested in documentation:
tcpdump -i eth0 dst port 53 or src port 53 -n -x -X -v

Wait sometimes and see that some request are displayed

Expected behavior (i.e. solution)

I suggest to set two iptables REDIRECT rule in order to send all DNS request directly to dnscrypt-proxy in place of using dnsmasq that redirect request to dnscrypt-proxy (assuming eth1 is the lan interface):

iptables -A PREROUTING -t nat -i eth1 -p udp --dport 53 -j REDIRECT --to-port 5353
iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 53 -j REDIRECT --to-port 5353

Those two line should be added to dnscrypt.sh

Other Comments

After removing dns forwarding and added this configuration only few request continue to be send to ubiquiti DNS but majority of the request go through dnscrypt-proxy
By doing that you will also have the correct ip of the client that sent the DNS query in place of loopback IP.

[aniqueta]

For me, I had a similar issue. After some investigation, I saw that by default, EdgeOS adds the DNS servers provided by your ISP's DHCP server to /etc/resolv.conf. Dnsmasq will automatically add those DNS servers as forwarding targets, and you can see that in /var/log/dnsmasq.log. So, even after following the installation instructions on the wiki here for dnscrypt-proxy on EdgeOS, some DNS resolution will occur on those ISP provided servers in the clear on port 53. The solution that worked for me was to run the following commands to disable the automatic use of DHCP-provided DNS servers. This assumes WAN is on eth0.

set interfaces ethernet eth0 dhcp-options name-server no-update
commit
save
exit

If the folks agree, then I think the correct fix here is to update the wiki with the above step, given defaults on EdgeOS.

[welwood08]

I use this setting for this exact reason, so feel free to update the wiki.

[aniqueta]

Done

[welwood08]

@aniqueta Looks good, thanks for connecting the dots!

@dduransseau Since you haven't commented yet, please can you confirm this resolves things for you by closing this issue? If not, we can look into it more closely.

[dduransseau]

Yes, I confirm that by implementing dhcp-options name-server no-update it solve the issue. In addition, removing dns forwarding. after router restart, it's possible to make dnscrypt-proxy listen on port 53 (which was not possible with only disabling dns forwarding). Doing that also solved the client IP address on logs.