1

I'm trying to setup a DNS cache server on a Raspberry, using Unbound and DNSCrypt.

The Raspberry runs the latest Jessie Lite (headless Debian 8).
I setup DNSCrypt using this popular script: https://github.com/simonclausen/dnscrypt-autoinstall

Both Unbound and DNSCrypt run fine: my main computer (192.168.1.64) is successfully using the DNS server on the Raspberry (192.168.1.65) and I can see Unbound using DNSCrypt through the log-file.

My issue is that I don't see any encryption when I dig a website and captures through Wireshark just return standard queries.

What am I missing?

Here's a screenshot from the dig response:
enter image description here

Here's a screenshot from the Wireshark capture:
enter image description here

Here's the log from Unbound:

[1483616499] unbound[5098:0] debug: module config: "iterator"
[1483616499] unbound[5098:0] notice: init module 0: iterator
[1483616499] unbound[5098:0] debug: target fetch policy for level 0 is 3
[1483616499] unbound[5098:0] debug: target fetch policy for level 1 is 2
[1483616499] unbound[5098:0] debug: target fetch policy for level 2 is 1
[1483616499] unbound[5098:0] debug: target fetch policy for level 3 is 0
[1483616499] unbound[5098:0] debug: target fetch policy for level 4 is 0
[1483616499] unbound[5098:0] debug: Forward zone server list:
[1483616499] unbound[5098:0] info: DelegationPoint<.>: 0 names (0 missing), 1 addrs (0 result, 1 avail) parentNS
[1483616499] unbound[5098:0] debug: cache memory msg=33040 rrset=33040 infra=1304 val=0
[1483616499] unbound[5098:0] info: start of service (unbound 1.4.22).
[1483616505] unbound[5098:0] debug: iterator[module 0] operate: extstate:module_state_initial event:module_event_new
[1483616505] unbound[5098:0] info: resolving www.google.com. A IN
[1483616505] unbound[5098:0] info: processQueryTargets: www.google.com. A IN
[1483616505] unbound[5098:0] info: sending query: www.google.com. A IN
[1483616505] unbound[5098:0] debug: sending to target: <.> 127.0.0.1#40
[1483616505] unbound[5098:0] debug: cache memory msg=33040 rrset=33040 infra=1533 val=0
[1483616505] unbound[5098:0] debug: iterator[module 0] operate: extstate:module_wait_reply event:module_event_reply
[1483616505] unbound[5098:0] info: iterator operate: query www.google.com. A IN
[1483616505] unbound[5098:0] info: response for www.google.com. A IN
[1483616505] unbound[5098:0] info: reply from <.> 127.0.0.1#40
[1483616505] unbound[5098:0] info: query response was ANSWER
[1483616505] unbound[5098:0] info: finishing processing for www.google.com. A IN

Here's the config file of Unbound:

server:
        auto-trust-anchor-file: "/var/lib/unbound/root.key"

server:
        username: unbound
        port: 53
        logfile: "/var/log/unbound/unbound.log"
        log-time-ascii: no
        use-syslog: no
        verbosity: 3
        module-config: "iterator"
        do-not-query-localhost: no
        interface: 0.0.0.0
        access-control: 127.0.0.1 allow
        access-control: 192.168.1.0/24 allow
        access-control: 10.8.0.0/24 allow

forward-zone:
        name: "."
        forward-addr: 127.0.0.1@40
        forward-first: no

remote-control:
        control-enable: no

And here's the config for DNSCrypt generated by the script:

DNSCRYPT_LOCALIP=127.0.0.1
DNSCRYPT_LOCALPORT=40
DNSCRYPT_USER=dnscrypt
DNSCRYPT_RESOLVER=ns0.dnscrypt.is
1

The Wireshark capture shows that both the source and the destination are local IP addresses.

So, this is only recording the traffic between your computer and the Raspberry Pi. This is regular DNS traffic. The encrypted traffic is between the Raspberry Pi and the ns0.dnscrypt.is resolver, i.e. what goes to the Internet.

This is where you should do a packet capture.

Alternatively, if what you want is authenticate the traffic between your computer and the Raspberry Pi, the client proxy needs to run on your computer, and on the Raspberry Pi, you need to to run a DNSCrypt server (dnscrypt-wrapper or dnsdist).

  • So I was just missing the most obvious part... Thanks for the clarification! – shroom Jan 6 '17 at 1:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.