6 ms·

Dnscrypt-proxy 2 – A flexible DNS proxy with support for encrypted DNS protocols

58 points by known 7y ago

GrryDucape 7y ago
Is it just me or has this DNSCrypt project been doing things without any prior announcement? Last month or so, the main GitHub repo for DNSCrypt randomly got deleted. It wasn't until several days later, the author posted a tweet saying he/she are not supporting it anymore. Now it has seemingly been resurrected...after I have already configured my server to use a new project called getdns (and stubby).
- megous 7y ago
  Stubby is kind of limited. It has no cache, and I can't find a way to avoid resolving a list of my own domains via a specified resolver, so it's not that great for privacy.
  - megous 7y ago
    Though I like getdns C API, I'll probably use it in one of my projects.
  - deleted 7y ago
    [deleted]
- MindTooth 7y ago
  The project have a turbulent history IMO. Been using it for years, but did not know of the recent episode. Leaves you wondering..
- jedisct1 7y ago
  Hi! The GitHub repository for dnscrypt-proxy was simply moved from my personal GitHub account to the DNSCrypt organization. GitHub automatically adds redirections when a project is moved, so this should be transparent. dnscrypt-proxy 2 is actively supported since it was released in January 2018. What has been EOL'd is the legacy dnscrypt-proxy 1.x client, after having been supported for 7 years. The protocol itself is also still evolving, with the recent introduction of a lightweight alternative to Tor in order to hide IP addresses: https://raw.githubusercontent.com/DNSCrypt/dnscrypt-protocol/master/ANONYMIZED-DNSCRYPT.txt https://raw.githubusercontent.com/DNSCrypt/dnscrypt-protocol... Besides the main website https://dnscrypt.info https://dnscrypt.info, there is a subreddit for announcements: https://www.reddit.com/r/dnscrypt/ https://www.reddit.com/r/dnscrypt/
  - Fnoord 7y ago
    What happened to DNSCrypt-OSXClient Preferences? It was suddenly pulled from Homebrew.
    - jedisct1 7y ago
      I use a bitbar module for this: https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher/ https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher/
      - Fnoord 7y ago
        Yes, I'm aware of that, but I don't use Bitbar, and I'm wondering about what happened with that Homebrew Cask. Why was it pulled, and why was the orig. pulled? I normally use WireGuard and use a DNS server supplied by that. If WireGuard is offline, I automatically use DNSCrypt.
jedisct1 7y ago
And to run your own encrypted DNS server: https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server
agumonkey 7y ago
I wanted to setup a local dns (pdnsd) with dnscrypt but I lack knowledge on how to be sure everything is coupled the way it should.
- jedisct1 7y ago
  You can adds DNSCrypt support to pdnsd, simply by installing https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server - In `upstream_addr`, instead of `9.9.9.9:53`, just put the IP and port of your pdnsd server.
snvzz 7y ago
I'm a (former) user. It's bloated. Extremely bloated. Fortunately, openbsd added DoH support to their recursive resolver, allowing me to get rid of dnscrypt-proxy.
- iforgotpassword 7y ago
  Can you elaborate a bit? I'm not really a fan of go, but not all go projects are automatically bad. Is it slow, a memory hog, ...?
  - deleted 7y ago
    [deleted]
  - xfer 7y ago
    Not slow but it is cuurently using 23MB with default caching serving a single computer, i can see why the parent would consider it bloated.
  - alisonatwork 7y ago
    I can't speak for the parent since I am not a BSD user at home, but I tried a few different options for DNS on my Windows laptop and dnscrypt-proxy was the simplest to get up and running. Right now it's consuming 25 meg of RAM, which is perhaps a lot compared to built-in networking services, but not much compared to application software. It also saves installing ad block browser plugins, which feel far more heavyweight. My only complaint is that it doesn't stay running in the background waiting for connection if you boot up without wifi. There is a 1 hour timeout, but it doesn't seem to reliably keep the service hanging around till you connect to a wifi. Not a big deal - it starts up pretty much immediately from the Task Manager Services tab. I imagine if you have a dedicated router with limited RAM or are running a UNIX desktop there may be better options, but for a Windows laptop connecting direct to untrusted connections (e.g. 4G phone tether) it does the job just fine.
  - snvzz 7y ago
    >slow or memory hog. Both. It'll easily use several hundred mb of ram and, if you use its cache feature (enabled by default) and hit the cache while measuring the latency, you'll see it takes about 10x the time to respond compared to pdnsd's cache. Therefore, when I used it, I put pdnsd in front.
qwertox 7y ago
This post came at a right time for me. I already run a custom DNS server on premises and setting up dnscrypt-proxy took less than 5 minutes. It's good to see how encrypted DNS has evolved in the last year or so. It was actually the post "Big ISPs aren’t happy about Google’s plans for encrypted DNS" [1] which made me think that I will tackle this issue now, even though I was already thinking about this for months. [1] https://news.ycombinator.com/item?id=21124900 https://news.ycombinator.com/item?id=21124900
mosselman 7y ago
I use this as a local dns resolver in combination with a blacklist and a whitelist to do DNS-level ad/tracker blocking. Works pretty well. I see people here are using some DNS switchers in macos, but you can also configure an extra 'location' in your networking configuration. My default location uses the dnscrypt-proxy server I run locally and another uses CloudFlare, for the rare occasions where things break. I haven't had anything break really, but sometimes you want to test certain things and it is useful to be able to switch quickly.
- dngray 7y ago
  I have mine configured on my router: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... My DHCP server hands out the router's IP as a DNS server, then that DNS server forwards through the VPN to my VPN provider's DNS server, or to my DNSCrypt servers. The good thing about it is it works on every host no matter what platform, configuration, application without any installed software. When I am out and about I just use a VPN on my phone and use the accepted DNS server pushed to me (which is an internal one to my VPN provider).
  - mosselman 7y ago
    Cool. I am still looking into setting up a Pi-hole in order to block things on all devices. I haven't had the time though.
nominated1 7y ago
I looked into this but Go on a little OpenWrt router seemed… silly. If you’re interested in something lightweight for OpenWrt give this a try: https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq_https-dns-proxy https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq...
- rmilejczz 7y ago
  >I looked into this but Go on a little OpenWrt router seemed… silly. Why? Go compiles to distributable binaries, Go binaries do not depend on Go to run. You wouldn’t need to actually install Go on the router
  - nominated1 7y ago
    From their own documentation [1] > The dnscrypt-proxy file is quite large, but can be compressed for a massive reduction of its size, from ~12 Mb down to ~2 Mb. Routers typically have 8-16 Mb of storage. Even 2 Mb is a bit much but even if the size doesn’t bother you the memory usage is still relatively extreme when compared to the link I shared. [1] https://github.com/dnscrypt/dnscrypt-proxy/wiki/Installation-on-OpenWRT https://github.com/dnscrypt/dnscrypt-proxy/wiki/Installation...
    - rmilejczz 7y ago
      Sure that’s fair, not really specific to Go though
      - detaro 7y ago
        Go specifically makes a bunch of choices that lead to (somewhat, it's by no means extreme) larger executables. Which is fine, but means it's not the best choice for the specific usecase of targeting tiny devices.
- armitron 7y ago
  Get a better router, there's no excuse for openwrt these days, with plenty of ultra small, cheap, abundant devices that can run a full distribution without issues.
deleted 7y ago
[deleted]
js2 7y ago
I run https://github.com/m13253/dns-over-https https://github.com/m13253/dns-over-https on my EdgeOS based router. It was trivial to cross-compile the doh-client binary. I have doh-client listen on localhost:5353, then I point dnsmasq at doh-client. Works great, and gives me the full flexibility and caching of dnsmasq. e.g. There's a few domains that I don't send over doh.

58 points by known 7y ago

Is it just me or has this DNSCrypt project been doing things without any prior announcement? Last month or so, the main GitHub repo for DNSCrypt randomly got deleted. It wasn't until several days later, the author posted a tweet saying he/she are not supporting it anymore. Now it has seemingly been resurrected...after I have already configured my server to use a new project called getdns (and stubby).

megous 7y ago
Stubby is kind of limited. It has no cache, and I can't find a way to avoid resolving a list of my own domains via a specified resolver, so it's not that great for privacy.
- megous 7y ago
  Though I like getdns C API, I'll probably use it in one of my projects.
- deleted 7y ago
  [deleted]
MindTooth 7y ago
The project have a turbulent history IMO. Been using it for years, but did not know of the recent episode. Leaves you wondering..
jedisct1 7y ago
Hi! The GitHub repository for dnscrypt-proxy was simply moved from my personal GitHub account to the DNSCrypt organization. GitHub automatically adds redirections when a project is moved, so this should be transparent. dnscrypt-proxy 2 is actively supported since it was released in January 2018. What has been EOL'd is the legacy dnscrypt-proxy 1.x client, after having been supported for 7 years. The protocol itself is also still evolving, with the recent introduction of a lightweight alternative to Tor in order to hide IP addresses: https://raw.githubusercontent.com/DNSCrypt/dnscrypt-protocol/master/ANONYMIZED-DNSCRYPT.txt https://raw.githubusercontent.com/DNSCrypt/dnscrypt-protocol... Besides the main website https://dnscrypt.info https://dnscrypt.info, there is a subreddit for announcements: https://www.reddit.com/r/dnscrypt/ https://www.reddit.com/r/dnscrypt/
- Fnoord 7y ago
  What happened to DNSCrypt-OSXClient Preferences? It was suddenly pulled from Homebrew.
  - jedisct1 7y ago
    I use a bitbar module for this: https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher/ https://github.com/jedisct1/bitbar-dnscrypt-proxy-switcher/
    - Fnoord 7y ago
      Yes, I'm aware of that, but I don't use Bitbar, and I'm wondering about what happened with that Homebrew Cask. Why was it pulled, and why was the orig. pulled? I normally use WireGuard and use a DNS server supplied by that. If WireGuard is offline, I automatically use DNSCrypt.

jedisct1 7y ago

And to run your own encrypted DNS server: https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server

agumonkey 7y ago

I wanted to setup a local dns (pdnsd) with dnscrypt but I lack knowledge on how to be sure everything is coupled the way it should.

jedisct1 7y ago
You can adds DNSCrypt support to pdnsd, simply by installing https://github.com/jedisct1/encrypted-dns-server https://github.com/jedisct1/encrypted-dns-server - In `upstream_addr`, instead of `9.9.9.9:53`, just put the IP and port of your pdnsd server.

snvzz 7y ago

I'm a (former) user. It's bloated. Extremely bloated. Fortunately, openbsd added DoH support to their recursive resolver, allowing me to get rid of dnscrypt-proxy.

iforgotpassword 7y ago
Can you elaborate a bit? I'm not really a fan of go, but not all go projects are automatically bad. Is it slow, a memory hog, ...?
- deleted 7y ago
  [deleted]
- xfer 7y ago
  Not slow but it is cuurently using 23MB with default caching serving a single computer, i can see why the parent would consider it bloated.
- alisonatwork 7y ago
  I can't speak for the parent since I am not a BSD user at home, but I tried a few different options for DNS on my Windows laptop and dnscrypt-proxy was the simplest to get up and running. Right now it's consuming 25 meg of RAM, which is perhaps a lot compared to built-in networking services, but not much compared to application software. It also saves installing ad block browser plugins, which feel far more heavyweight. My only complaint is that it doesn't stay running in the background waiting for connection if you boot up without wifi. There is a 1 hour timeout, but it doesn't seem to reliably keep the service hanging around till you connect to a wifi. Not a big deal - it starts up pretty much immediately from the Task Manager Services tab. I imagine if you have a dedicated router with limited RAM or are running a UNIX desktop there may be better options, but for a Windows laptop connecting direct to untrusted connections (e.g. 4G phone tether) it does the job just fine.
- snvzz 7y ago
  >slow or memory hog. Both. It'll easily use several hundred mb of ram and, if you use its cache feature (enabled by default) and hit the cache while measuring the latency, you'll see it takes about 10x the time to respond compared to pdnsd's cache. Therefore, when I used it, I put pdnsd in front.

qwertox 7y ago

This post came at a right time for me. I already run a custom DNS server on premises and setting up dnscrypt-proxy took less than 5 minutes. It's good to see how encrypted DNS has evolved in the last year or so. It was actually the post "Big ISPs aren’t happy about Google’s plans for encrypted DNS" [1] which made me think that I will tackle this issue now, even though I was already thinking about this for months. [1] https://news.ycombinator.com/item?id=21124900 https://news.ycombinator.com/item?id=21124900

mosselman 7y ago

I use this as a local dns resolver in combination with a blacklist and a whitelist to do DNS-level ad/tracker blocking. Works pretty well. I see people here are using some DNS switchers in macos, but you can also configure an extra 'location' in your networking configuration. My default location uses the dnscrypt-proxy server I run locally and another uses CloudFlare, for the rare occasions where things break. I haven't had anything break really, but sometimes you want to test certain things and it is useful to be able to switch quickly.

dngray 7y ago
I have mine configured on my router: https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi#Unbound_DNS_forwarder_with_dnscrypt https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... My DHCP server hands out the router's IP as a DNS server, then that DNS server forwards through the VPN to my VPN provider's DNS server, or to my DNSCrypt servers. The good thing about it is it works on every host no matter what platform, configuration, application without any installed software. When I am out and about I just use a VPN on my phone and use the accepted DNS server pushed to me (which is an internal one to my VPN provider).
- mosselman 7y ago
  Cool. I am still looking into setting up a Pi-hole in order to block things on all devices. I haven't had the time though.

nominated1 7y ago

I looked into this but Go on a little OpenWrt router seemed… silly. If you’re interested in something lightweight for OpenWrt give this a try: https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq_https-dns-proxy https://openwrt.org/docs/guide-user/services/dns/doh_dnsmasq...

rmilejczz 7y ago
>I looked into this but Go on a little OpenWrt router seemed… silly. Why? Go compiles to distributable binaries, Go binaries do not depend on Go to run. You wouldn’t need to actually install Go on the router
- nominated1 7y ago
  From their own documentation [1] > The dnscrypt-proxy file is quite large, but can be compressed for a massive reduction of its size, from ~12 Mb down to ~2 Mb. Routers typically have 8-16 Mb of storage. Even 2 Mb is a bit much but even if the size doesn’t bother you the memory usage is still relatively extreme when compared to the link I shared. [1] https://github.com/dnscrypt/dnscrypt-proxy/wiki/Installation-on-OpenWRT https://github.com/dnscrypt/dnscrypt-proxy/wiki/Installation...
  - rmilejczz 7y ago
    Sure that’s fair, not really specific to Go though
    - detaro 7y ago
      Go specifically makes a bunch of choices that lead to (somewhat, it's by no means extreme) larger executables. Which is fine, but means it's not the best choice for the specific usecase of targeting tiny devices.
armitron 7y ago
Get a better router, there's no excuse for openwrt these days, with plenty of ultra small, cheap, abundant devices that can run a full distribution without issues.

deleted 7y ago

[deleted]

js2 7y ago

I run https://github.com/m13253/dns-over-https https://github.com/m13253/dns-over-https on my EdgeOS based router. It was trivial to cross-compile the doh-client binary. I have doh-client listen on localhost:5353, then I point dnsmasq at doh-client. Works great, and gives me the full flexibility and caching of dnsmasq. e.g. There's a few domains that I don't send over doh.