How to dns over tls?

Installing and Using OpenWrt
21

Try with this minimal config:

config stubby 'global'
	option manual '0'
	option trigger 'wan'
	option tls_authentication '1'
	list dns_transport 'GETDNS_TRANSPORT_TLS'
	list listen_address '127.0.0.1@5453'
	list listen_address '0::1@5453'

config resolver
	option address '8.8.8.8'
	option tls_auth_name 'dns.google'

config resolver
	option address '8.8.4.4'
	option tls_auth_name 'dns.google'

config resolver
	option address '2001:4860:4860::8888'
	option tls_auth_name 'dns.google'

config resolver
	option address '2001:4860:4860::8844'
	option tls_auth_name 'dns.google'
22

yes from 20mb i was receivin 2mb , disabled stubby and went to normal

23

that is the default config

24

... and it does work.

25

DNS makes no impact on network throughput.

26

I've used it in conjunction with DNSMASQ. Yes it is stable, and performance is good.

27

"speed" claims should be backed by link to a result of
https://www.waveform.com/tools/bufferbloat
directly to internet, wired via openwrt and wifi of openwrt.
Many things feel slow but we have to start somewhere.

Please connect to your OpenWrt device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/wireless
cat /etc/config/firewall
1 Like
28

how do i know if stubby is working? thats the problem

29

is there a better and lightweight alternative for stubby? router is only 1 mb

untitled
untitled1298×671 25 KB

heeelp

30

installed:

https://openwrt.org/packages/pkgdata/luci-app-https-dns-proxy

how can i tell if it is working really?

31

You jumped from DoT to DoH hastily without understanding how both work. Stubby provides its service on port 5453 (hence the lines 127.0.0.1@5453 for IPv4 and 0::1@5453 for IPv6). In order to test it you have to use it by running from router's console (login via ssh root@192.168.1.1) line like this nslookup -debug -type=A openwrt.org 127.0.0.1:5453. If it works then point dnsmasq and system's DNS to these addresses. How to make it? Check the link from my first post in this thread: https://github.com/openwrt/packages/blob/master/net/stubby/files/README.md

If you make everything the way I explained you should see network status like this (maybe IPv6 will be missing if your ISP does provide it). DNS on local ports is highlighted with red (before there were addresses from ISP):

Screenshot 2024-08-13 at 06-07-22 router - LuCI
Screenshot 2024-08-13 at 06-07-22 router - LuCI958×251 39.9 KB

2 Likes
32

DoH works the same way, it provides its service on some port and you point your router to it instead of those addresses from your provider.

1 Like
33

Hi,
What do you think about dnsproxy package and which protocol to encrypt DNS is better?

Information:

34

Also dnscrypt is similar. You can have all 3 towards seame provider if protocols are supported.

2 Likes
35

I'm using Unbound, I replaced dnsmasq for odhcpd + Unbound and I have no problems.

1 Like
36

Never tried it. I'm pretty happy with DoT via stubby. I also tested dnscrypt (v2) and DoH-proxy with luci interface. Even more I'd be happy with regular DNS over port 53 but some websites use EDNS Client Subnet to sanction users from my country (for example www.themoviedb.org uses this mechanism).

I chose DoT because stubby is lean and has little functionality which I don't need (e.g. dnscypt v2 also comes with DoH server, DoH client). I don't like DoH for its reliance on HTML. HTML parser is a complex thing and provides some space for bugs and has certain processing cost. But I accept the fact that it's harder to block service on port 443 than port 853.

2 Likes
37

Thank you so much.

1 Like
38

@brada4 and @timur.davletshin I have tested dnsproxy package together with the DNS provider NextDNS, because NextDNS supports all encryption protocols (except DNSCrypt) and they all work without problems, this is the page to test which protocol I'm using:

NextDNS test
NextDNS test308×784 9.67 KB

2 Likes
39

i recommend you Dot or doh, or doh3(quic) preferably because is the best protocol and most advanced enhanced version of https-tls

40

DNSCrypt and DoT have most compact queries. Probably I would prefer using DNSCrypt but it has very limited support among providers and dnscrypt-proxy2 is far from being a compact implementation. Ideally I would recommend everyone to make primitive test before making decision. DNS should be fast, as fast as possible.

1 Like