1

I want to use DNSCrypt to encrypt all my DNS packets, so I tried to do this:

on /etc/rc.local :

/usr/local/sbin/dnscrypt-proxy -a 127.0.0.1:40 -u _dnscrypt-proxy -d -l /dev/null -R dnscrypt.eu-dk

Then I ran : sudo /usr/local/sbin/dnscrypt-proxy -a 127.0.0.1:40 -u _dnscrypt-proxy -d -l /dev/null -R dnscrypt.eu-dk

On /var/unbound/etc/unbound.conf

enter image description here

Is that configured properly to route all my DNS requests via dnscrypt ?

When I do host openbsd.org I get the same IP address I get when running the same command on another virtual OpenBSD machine, but when I try google.com and youtube.com I get different IP results? This made me think I did some mistake or the DNS resolver is rogue.

And how I can check that is actually doing DNS requests over port 80? If possible would like to know if can check that if it's using the DNS resolver and encrypting my requests since I only know I can resolve domains but not the route used.

My OS is OpenBSD 5.7 i386.

  • 2
    I don't think there is a fixed IP you get when trying to resolve YouTube or Google. I always assumed they were returned in some random fashion out of a pool for load balancing. – Anthon Jun 16 '15 at 6:13
  • I don't know, that is why I commented and did not answer ;-) – Anthon Jun 16 '15 at 6:35
2

Youtube and Google are served via a CDN, and having the DNS names they use map to many different IP addresses is normal and expected.

If you want to make sure that queries are actually going through DNSCrypt, temporarily stop it:

# pkill -STOP dnscrypt-proxy

And see if you still get responses to new DNS queries. It shouldn't be the case any more.

Then, resume it:

# pkill -CONT dnscrypt-proxy

According to your Unbound configuration file, the proxy is listening to port 40, so you can also run tcpdump on this port and verify that the output looks like gibberish instead of decodable DNS packets:

# tcpdump -n udp port 40

There is nothing wrong with Unbound listening to incoming connections on port 80, as long as your /etc/resolv.conf file contains a line such as:

nameserver [127.0.0.1]:80

80 is a weird choice, though, as you won't be able to run a web server on the same port (DNS uses both UDP and TCP).

Launching tcpdump on port 80 should show regular, unauthenticated, unencrypted queries.

  • Thanks so much! I'm going to try this right now ! Yeah i know 80 is a weird choice, but i need my application to be run in very restrictive firewalls too (only port 80/443, no udp) or i'm thinking wrong? My server is free from firewalls limitations, but my clients may only be able to reach me from 80/443 ports. Would this prevent them to use my DNS chain instead of their? This is a VPN server – Freedo Jul 11 '15 at 22:09
  • If the clients are also running OpenBSD, you're fine.But other operating systems do not have an option to force queries over TCP and can only send queries to the default DNS port, 53. – Frank Denis Jul 12 '15 at 9:30
  • Are you saying that even on most restrictive networks port 53 with UDP will be allowed? I plan to have clients on most OS. I haven't accept your answer yet because i'm having problems...after i kill the proxy i my nslookup is using 8.8.8.8#53....i'm running it on a virtual box under windows and the router DNS is 8.8.8.8 could be because that? I'm going to re-do everything and test again – Freedo Jul 12 '15 at 10:01
  • You need to consider two things: what can be configured on the client, and what can go through the network. OpenBSD accepts port numbers in /etc/resolv.conf entries. Linux, Windows, OSX, routers don't. So if you want clients to communicate to a port which is not 53, and using TCP, you will need to run a proxy on the client (Unbound can do the trick). If this is fine in your case, you can use port 80, but port 443 would be a better choice, as it's less likely to be blocked by a transparent HTTP proxy. – Frank Denis Jul 12 '15 at 18:22
  • Are you using nslookup on Windows? You need to change your TCP/IP settings to use the Virtualbox IP, or else it will keep using the default settings provided by your router, which apparently are 8.8.8.8. Or after starting nslookup, type: set port=80 followed by server <virtualbox ip> to have it use the name server of your Virtualbox instance. – Frank Denis Jul 12 '15 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.