Setting up dnscrypt proxy on Gentoo Linux based gateway - DNSCrypt/dnscrypt-proxy GitHub Wiki

This article covers setting up dnscrypt-proxy on a Gentoo Linux-based gateway.

The legacy DNS mechanism is one of the most vulnerable parts of a network, so securing DNS requests is generally a good idea. Securing DNS may be useful in two different cases: when you want an untracked, uncensored connection (in conjunction with a good VPN, of course), or when you need to protect children from inappropriate content. It is also helpful in other cases, given how widespread DNS manipulation is, including phishing and malware. The fewer gaps you leave unattended, the safer you are.

The following example adds dnscrypt-proxy to an existing Gentoo Linux gateway where family-friendly DNS alone is not enough, even without considering an ISP's possible interference.

dnsmasq was already installed and configured as a DHCP server and DNS cache provider. DNSCrypt v2 also supports caching, but DHCP is still needed, so dnsmasq was reconfigured to use dnscrypt-proxy as an upstream server.

DNS requests are now processed as follows. All user requests are forced to the gateway's port 53 using Shorewall or iptables, where dnsmasq is listening. In turn, dnsmasq routes the requests to localhost's port 2053, where dnscrypt-proxy accepts them and forwards them upstream. Thus, all traffic outside the LAN is secured.

/etc/hosts:

127.0.0.1 localhost.lan localhost
192.168.1.1 server.lan server

/etc/resolv.conf:

nameserver 127.0.0.1
options edns0

Don't forget to prevent other programs from rewriting resolv.conf:

chattr +i /etc/resolv.conf

Modified /etc/dnsmasq.conf:

no-resolv
local=/lan/
server=127.0.0.1#2053
listen-address=127.0.0.1,192.168.1.1
domain=lan
dhcp-range=192.168.1.20,192.168.1.28,12h
localise-queries
proxy-dnssec

The dnscrypt-proxy.toml basics are covered in Configuration, so only a few settings are described here. First, make sure dnscrypt-proxy is listening on the correct port so dnsmasq can send requests to it: listen_addresses = ['127.0.0.1:2053']. To use family-friendly resolvers, comment out the first block in the [sources] section and uncomment the second. To make those resolvers available, set require_nofilter = false. You can also set require_nolog = false to avoid rejecting resolvers that log your activity. If you need cloaking or blacklisting, uncomment the appropriate lines and make sure the files to which those directives refer exist. These features are explained below.

Besides securing DNS requests, you can also use URL and IP blacklists, modifying them manually or retrieving them from the Internet regularly with a cron job. Some example lists are included and can be used immediately by removing the example- prefix and enabling them in the dnscrypt-proxy.toml file by uncommenting the corresponding lines.

Cloaking is also available. It allows you to maintain your own redirection list easily. You can use it to redirect requests to unsafe search engines to safe ones (for instance, a DNS request for any google clone will return forcefamilysearch.google.com). The destination can be either an IP address or another DNS domain, which exceeds dnsmasq's abilities because it accepts only IPs or names listed in the local /etc/hosts file.

However, the current version of dnscrypt-proxy is unable to reopen log files without a service restart, which is needed for log rotation. Developers are aware of this issue and will hopefully provide a solution in future releases.

It is quite easy to set up safe DNS on a Linux/BSD gateway. However, if DNS filtering is not enough for your purposes, consider a more advanced solution, such as using squid with filters. Such a solution will allow you to filter by URL in conjunction with simple DNS filtering.

Browse safely. Feel free to expand or modify this article.