Can’t catch IPs for IPSET in router because of DNSCrypt on my PC

[jeff]

Test build, based on the package list at the beginning of the link you gave, without LuCI

CONFIG_TARGET_ath79=y
CONFIG_TARGET_ath79_tiny=y
CONFIG_TARGET_ath79_tiny_DEVICE_tplink_tl-wr841-v8=y
CONFIG_DEVEL=y
CONFIG_BUILD_LOG=y
CONFIG_CCACHE=y
CONFIG_DOWNLOAD_FOLDER="/home/jeff/devel/openwrt_dl"
CONFIG_LIBSODIUM_MINIMAL=y
CONFIG_PACKAGE_dnscrypt-proxy=y
CONFIG_PACKAGE_dnscrypt-proxy-resolvers=y
CONFIG_PACKAGE_ip-full=y
CONFIG_PACKAGE_ipset=y
CONFIG_PACKAGE_iptables-mod-conntrack-extra=y
CONFIG_PACKAGE_iptables-mod-ipopt=y
CONFIG_PACKAGE_iptables-mod-nat-extra=y
CONFIG_PACKAGE_kmod-asn1-decoder=y
CONFIG_PACKAGE_kmod-crypto-crc32c=y
CONFIG_PACKAGE_kmod-crypto-hash=y
CONFIG_PACKAGE_kmod-ipt-conntrack-extra=y
CONFIG_PACKAGE_kmod-ipt-ipopt=y
CONFIG_PACKAGE_kmod-ipt-ipset=y
CONFIG_PACKAGE_kmod-ipt-nat-extra=y
CONFIG_PACKAGE_kmod-ipt-raw=y
CONFIG_PACKAGE_kmod-lib-crc32c=y
CONFIG_PACKAGE_kmod-lib-textsearch=y
CONFIG_PACKAGE_kmod-netem=y
CONFIG_PACKAGE_kmod-nf-nathelper-extra=y
CONFIG_PACKAGE_kmod-nfnetlink=y
CONFIG_PACKAGE_kmod-sched=y
CONFIG_PACKAGE_kmod-sched-cake=y
CONFIG_PACKAGE_kmod-sched-core=y
CONFIG_PACKAGE_kmod-veth=y
CONFIG_PACKAGE_libcap=y
CONFIG_PACKAGE_libelf=y
CONFIG_PACKAGE_libipset=y
CONFIG_PACKAGE_libmnl=y
CONFIG_PACKAGE_libsodium=y
CONFIG_PACKAGE_zlib=y

You need at least five, free erase blocks for a valid JFFS2 image, 640 kB, if my memory is correct.

TP-Link 4 MB flash allows for a 3904 kB total image, so what you flash can't be larger than 3264 kB (at least as I understand it).

And, in fact, the image fails to build.

[mktplinkfw] *** error: images are too big by 300476 bytes

[AlanDias17]

Honestly Jeff that is really helpful for me rn I got few modifications to make let's see if i can build one with all these modules combined.
I'll update you guys later thanks for being so patient & helpful

[jeff]

@AlanDias17

I got few modifications to make let's see if i can build one with all these modules combined.

With ~300 kB or more to save (I don't know if that includes reservation for the erase blocks or not), I think that's going to be quite an uphill battle.

[AlanDias17]

Installed Luci-dnscrypt module & got it running on the router for testing. It doesn't show cloudflare DNS though, and for most servers it gives me dnscrypt-proxy Unable to retrieve server certificates error.

1. How can I add cloudflare DNS in config?
2. How can I solve Unable to retrieve server certificates error? (If you guys know I'll google it in mean time)

This is my build config file. I manged to install previous modules + Luci-dnscrypt

CONFIG_TARGET_ar71xx=y
CONFIG_TARGET_ar71xx_tiny=y
CONFIG_TARGET_ar71xx_tiny_DEVICE_tl-wr841-v8=y
# CONFIG_BUSYBOX_DEFAULT_FEATURE_IPV6 is not set
CONFIG_CLEAN_IPKG=y
# CONFIG_DRIVER_11N_SUPPORT is not set
# CONFIG_DRIVER_11W_SUPPORT is not set
# CONFIG_IPV6 is not set
# CONFIG_KERNEL_CRASHLOG is not set
# CONFIG_KERNEL_DEBUG_FS is not set
# CONFIG_KERNEL_IPV6 is not set
# CONFIG_KERNEL_MAGIC_SYSRQ is not set
# CONFIG_KERNEL_PRINTK is not set
# CONFIG_KERNEL_PRINTK_TIME is not set
CONFIG_KERNEL_SQUASHFS_FRAGMENT_CACHE_SIZE=3
CONFIG_LIBSODIUM_MINIMAL=y
CONFIG_LUCI_SRCDIET=y
CONFIG_PACKAGE_adblock=y
CONFIG_PACKAGE_cgi-io=y
CONFIG_PACKAGE_dnscrypt-proxy=y
CONFIG_PACKAGE_dnscrypt-proxy-resolvers=y
# CONFIG_PACKAGE_dnsmasq is not set
CONFIG_PACKAGE_dnsmasq-full=y
CONFIG_PACKAGE_dnsmasq_full_broken_rtc=y
CONFIG_PACKAGE_dnsmasq_full_conntrack=y
CONFIG_PACKAGE_dnsmasq_full_dhcp=y
CONFIG_PACKAGE_dnsmasq_full_ipset=y
CONFIG_PACKAGE_dnsmasq_full_noid=y
CONFIG_PACKAGE_dnsmasq_full_tftp=y
# CONFIG_PACKAGE_hostapd-common is not set
CONFIG_PACKAGE_ip-full=y
CONFIG_PACKAGE_ipset=y
CONFIG_PACKAGE_iptables-mod-conntrack-extra=y
CONFIG_PACKAGE_iptables-mod-extra=y
CONFIG_PACKAGE_iptables-mod-hashlimit=y
CONFIG_PACKAGE_iptables-mod-ipopt=y
CONFIG_PACKAGE_iptables-mod-nat-extra=y
# CONFIG_PACKAGE_iw is not set
# CONFIG_PACKAGE_iwinfo is not set
# CONFIG_PACKAGE_kmod-ath is not set
# CONFIG_PACKAGE_kmod-ath9k is not set
# CONFIG_PACKAGE_kmod-cfg80211 is not set
CONFIG_PACKAGE_kmod-crypto-acompress=y
CONFIG_PACKAGE_kmod-ifb=y
CONFIG_PACKAGE_kmod-ipt-conntrack-extra=y
CONFIG_PACKAGE_kmod-ipt-extra=y
CONFIG_PACKAGE_kmod-ipt-hashlimit=y
CONFIG_PACKAGE_kmod-ipt-ipopt=y
CONFIG_PACKAGE_kmod-ipt-ipset=y
CONFIG_PACKAGE_kmod-ipt-nat-extra=y
# CONFIG_PACKAGE_kmod-ipt-offload is not set
CONFIG_PACKAGE_kmod-ipt-raw=y
CONFIG_PACKAGE_kmod-lib-lz4=y
CONFIG_PACKAGE_kmod-lib-lzo=y
CONFIG_PACKAGE_kmod-lib-textsearch=y
# CONFIG_PACKAGE_kmod-mac80211 is not set
CONFIG_PACKAGE_kmod-nf-conntrack-netlink=y
# CONFIG_PACKAGE_kmod-nf-flow is not set
# CONFIG_PACKAGE_kmod-nf-ipt6 is not set
CONFIG_PACKAGE_kmod-nf-nathelper-extra=y
CONFIG_PACKAGE_kmod-nfnetlink=y
CONFIG_PACKAGE_kmod-sched-cake=y
CONFIG_PACKAGE_kmod-sched-connmark=y
CONFIG_PACKAGE_kmod-sched-core=y
CONFIG_PACKAGE_kmod-zram=y
CONFIG_PACKAGE_libcap=y
CONFIG_PACKAGE_libelf=y
# CONFIG_PACKAGE_libip6tc is not set
CONFIG_PACKAGE_libipset=y
CONFIG_PACKAGE_libiwinfo-lua=y
CONFIG_PACKAGE_liblua=y
CONFIG_PACKAGE_liblucihttp=y
CONFIG_PACKAGE_liblucihttp-lua=y
CONFIG_PACKAGE_libmbedtls=y
CONFIG_PACKAGE_libmnl=y
CONFIG_PACKAGE_libnatpmp=y
CONFIG_PACKAGE_libnetfilter-conntrack=y
CONFIG_PACKAGE_libnfnetlink=y
CONFIG_PACKAGE_librt=y
CONFIG_PACKAGE_libsodium=y
CONFIG_PACKAGE_libubus-lua=y
CONFIG_PACKAGE_libustream-mbedtls=y
CONFIG_PACKAGE_libuuid=y
CONFIG_PACKAGE_lua=y
CONFIG_PACKAGE_luci=y
CONFIG_PACKAGE_luci-app-adblock=y
CONFIG_PACKAGE_luci-app-dnscrypt-proxy=y
CONFIG_PACKAGE_luci-app-firewall=y
CONFIG_PACKAGE_luci-app-opkg=y
CONFIG_PACKAGE_luci-app-sqm=y
CONFIG_PACKAGE_luci-app-upnp=y
CONFIG_PACKAGE_luci-base=y
CONFIG_PACKAGE_luci-compat=y
CONFIG_PACKAGE_luci-lib-httpprotoutils=y
CONFIG_PACKAGE_luci-lib-ip=y
CONFIG_PACKAGE_luci-lib-jsonc=y
CONFIG_PACKAGE_luci-lib-nixio=y
CONFIG_PACKAGE_luci-mod-admin-full=y
CONFIG_PACKAGE_luci-mod-network=y
CONFIG_PACKAGE_luci-mod-status=y
CONFIG_PACKAGE_luci-mod-system=y
CONFIG_PACKAGE_luci-proto-ppp=y
CONFIG_PACKAGE_luci-theme-bootstrap=y
CONFIG_PACKAGE_miniupnpd=y
# CONFIG_PACKAGE_openwrt-keyring is not set
CONFIG_PACKAGE_rpcd=y
CONFIG_PACKAGE_rpcd-mod-file=y
CONFIG_PACKAGE_rpcd-mod-iwinfo=y
CONFIG_PACKAGE_rpcd-mod-luci=y
CONFIG_PACKAGE_rpcd-mod-rrdns=y
CONFIG_PACKAGE_sqm-scripts=y
CONFIG_PACKAGE_tc=y
CONFIG_PACKAGE_uhttpd=y
# CONFIG_PACKAGE_usign is not set
# CONFIG_PACKAGE_wireless-regdb is not set
# CONFIG_PACKAGE_wpad-mini is not set
CONFIG_PACKAGE_zlib=y
# CONFIG_PKG_CHECK_FORMAT_SECURITY is not set
# CONFIG_SIGNATURE_CHECK is not set
# CONFIG_SIGNED_PACKAGES is not set
CONFIG_STRIP_KERNEL_EXPORTS=y
CONFIG_TARGET_SQUASHFS_BLOCK_SIZE=256
CONFIG_USE_MKLIBS=y
CONFIG_ZLIB_OPTIMIZE_SPEED=y
# CONFIG_PACKAGE_dnsmasq_full_auth is not set
# CONFIG_PACKAGE_dnsmasq_full_dnssec is not set
# CONFIG_PACKAGE_libgmp is not set
# CONFIG_PACKAGE_libnettle is not set

[jeff]

CA certs, perhaps?

[AlanDias17]

Okay I'll confirm it. ca-cert is enough right? & not ca-bundle?
Edit: Also how can I add cloudflare DNS in it?

[jeff]

define Package/ca-certificates
  SECTION:=base
  CATEGORY:=Base system
  TITLE:=System CA certificates
  PKGARCH:=all
endef

define Package/ca-bundle
  SECTION:=base
  CATEGORY:=Base system
  TITLE:=System CA certificates as a bundle
  PKGARCH:=all
endef

Basically the same content, installed differently. Bundle should be fine.

[lleachii]

@AlanDias17

How can I add cloudflare DNS in config?

See Dnscrypt-Proxy section at:

Connect to 1.1.1.1 using DoH clients · Cloudflare 1.1.1.1 docs

Also see: https://openwrt.org/docs/guide-user/services/dns/dnscrypt_dnsmasq_dnscrypt-proxy

@AlanDias17

How can I solve Unable to retrieve server certificates error?

Maybe because there's no DNS server to download/check the certs?

[AlanDias17]

@lleachii

See Dnscrypt-Proxy section at:

developers.cloudflare.com

Running a DNS over HTTPS Client - Cloudflare Resolver

Use Cloudflare’s APIs and edge network to build secure, ultra-fast applications.

It says

Verify that the dnscrypt-proxy is installed, and at least version 2.0

So guess I can't add cloudflare DNS in this 1.9.5-8 version. Otherwise developer could have added it already, couldn't he?

[AlanDias17]

Okay guys I'll stop here. I can't add ca-bundle says need 94KB extra which I can't afford by removing other modules, also can't add Cloudflare DNS in config too. So ig that's all then. Anyways thank you so much guys for your help!

[stangri]

I would second recommendation to try https_dns_proxy.

[AlanDias17]

@stangri

https_dns_proxy

Haha I've tried that already but due to lots of dependencies it requires around 94 KB (almost same as before) but thanks for the suggestion

[AlanDias17]

Build Script to Compile Custom Firmware for Devices with Small Memory

Script Features Download and install necessary dependencies for compiling OpenWrt. Download OpenWrt 18.06.4 tar.gz from the OpenWrt Releases page. This can be changed by editing the script. Download and install OpenWrt Feeds. Minify CSS, JS, and Lua files from the OpenWrt Feeds. View the script here. Instructions to Compile Firmware 1. Download and execute script Note:This script follows the Quick Image Building Guide. Refer to this guide to understand how this script works. Download scrip…

Followed this post. Used the author's script, did slight modification & installed https_dns_proxy along with all the other modules (Yet have 200 KB > free flash space). Everything works now smooth af.