DoT with dnsmasq and stubby: "Use custom DNS"?

Installing and Using OpenWrt
1

I have a qustion regarding the Wiki page DoT with Dnsmasq and Stubby:

The Luci web-interface instructions mention to set custom DNS servers for the LAN interface:

Navigate to Network → Interfaces. Tap 'Edit' next to LAN. 'Advanced Settings', 'Use custom DNS servers': '127.0.0.1', tap '+', and add '0::1' as a second one. 'DNS Weight': '20'. 'Save'.

The Command-line instructions don't. Neither does stubby's README.

So... is it necessary or not?

2

no real reason to use local DNS on LAN side, I'd say it's not required.

3

The LuCi instructions are primarily if you want queries from the router itself to go through Stubby. E.g. in the LuCI case updating the package lists won't go through Stubby if you don't do this, because /etc/resolv.conf on the router will not be pointing to Stubby, in a typical OpenWrt install with Stubby.

EDIT: actually it's a little more complicated than that - I have review my configuration to see what's what and remember why this is needed.

4

For this the relevant parts are:
In /etc/config/stubby

config resolver
       option address '123.123.123.123'
       option tls_auth_name a.b.c.example.net

In /etc/config/dnsmasq

config dnsmasq
	option localservice '0'
	list server '127.0.0.1#5453' # Stubby
	list server '::1#5453' # Stubby

In /etc/config/network

config interface 'lan'
	list dns '127.0.0.1'
	list dns '0::1'

This will result in a resolv.conf something like:

nameserver 127.0.0.1
nameserver ::1

and (e.g.) In /etc/config/system

config timeserver 'ntp'
	list server '234.234.234.234'
	list server '12.12.12.12''

So Stubby communicates with the internet via the resolver entries, dnsmasq goes through Stubby, and the router itself communicates using dnsmasq.

sysntp success here because it is configure with IP addresses instead of hostnames.

If you do not configure the router to use dnsmasq for its communications then you can use hostnames for the ntp servers.

5

Thanks!

I guess you mean /etc/config/dhcp?

By the way: Is there a reason that this is 0::1 instead of ::1?

And this is only necessary for the router itself?

I think it's just a little confusing that the LuCI configuration steps differ from the console configuration steps.

6

Er, yeah. I always type that wrong because its usually dnsmasq and is dhcp + dns.

I think the 0::1 was needed for it to work with dnsmasq, but I honestly do not remember.

And the last section is indeed only needed for the router.

I think the LuCI instruction are meant to be what you do first, and the CLI instructions assume you are building on the LuCI instructions.

7

0::1 can be shortened to ::1.

8

I recall running into some difficulty with ::1 for this use case but I do not remember what it was. I know they are supposed to be equivalent, but something didn't like the shorter form.