How to resolve local domains like .lan with dnscrypt-proxy?

Installing and Using OpenWrt
1

Hi all,

I’m trying to use cloaking in dnscrypt-proxy for my .lan local domain and block GUA IPv6 addresses from being resolved.

My cloaking-rules.txt:

cachyos.lan     192.168.0.142
cachyos.lan     fddc:3f1a:d1db::142

nslookup shows:

# Using default server (127.0.0.1)
Name: cachyos.lan
Address: 192.168.0.142
Address: 2001:8f8:1825:3866::142
Address: fddc:3f1a:d1db::142

# Using dnscrypt-proxy (127.0.0.53)
Name: cachyos.lan
Address: 192.168.0.142
Address: fddc:3f1a:d1db::142

dnscrypt-proxy2 is already listening on 127.0.0.53, but currently clients query OpenWRT first, and dnsmasq sometimes returns the IPv6 GUA address before dnscrypt-proxy responds.

I want clients to automatically resolve via 127.0.0.53 and avoid leaking GUA addresses.

Has anyone successfully set up .lan cloaking like this? Any tips on configuring dnsmasq or routing queries would help.

2

/etc/config/dhcp

config dnsmasq
....
list server '/cachyos.lan/127.53'
3 
config dnsmasq
        option domainneeded '1'
        option localise_queries '1'
        option rebind_protection '1'
        option rebind_localhost '1'
        option local '/lan/'
        option domain 'lan'
        option expandhosts '1'
        option cachesize '0'
        option authoritative '1'
        option readethers '1'
        option leasefile '/tmp/dhcp.leases'
        option localservice '1'
        option ednspacket_max '1232'
        list addnmount '/usr/libexec/gzip-gnu'
        list addnmount '/bin/busybox'
        list addnmount '/var/run/adblock-lean/abl-blocklist.gz'
        list notinterface 'wan'
        list notinterface 'wan6'
        option noresolv '1'
        list server '127.0.0.53'
        list server '/cachyos.lan/127.0.0.53'

I tried restarting my cachyos device and dnsmasq along with odhcpd, it seems to still show the GUA address unless I specifically use 127.0.0.53 during nslookup

root@OpenWrt:/etc/dnscrypt-proxy2# nslookup cachyos.lan
Server:         127.0.0.1
Address:        127.0.0.1:53

Name:   cachyos.lan
Address: 192.168.0.142

Name:   cachyos.lan
Address: fddc:3f1a:d1db::142
Name:   cachyos.lan
Address: 2001:8f8:1825:3866::142


root@OpenWrt:/etc/dnscrypt-proxy2# nslookup cachyos.lan 127.0.0.53
Server:         127.0.0.53
Address:        127.0.0.53:53

Non-authoritative answer:
Name:   cachyos.lan
Address: fddc:3f1a:d1db::142

Non-authoritative answer:
Name:   cachyos.lan
Address: 192.168.0.142

root@OpenWrt:/etc/dnscrypt-proxy2#

I'm assuming I need to make dnscrypt-proxy authoritative?

EDIT: Had issues with DNS-rebind attack. After whitelisting cachyos.lan the answer suggested by brada4 works.

EDIT 2: I spoke too soon... still stuck.

4

I’m assuming this isn’t possible, but I wanted to check.

My use case might be a bit niche. I’m trying to use ULA addresses in my DNS entries instead of GUA addresses, mainly to simplify firewall configuration on my Linux system. I use ufw, which doesn’t support negative netmask notation like OpenWRT does, so working with GUAs is more cumbersome.

Another issue is VPN routing. When I whitelist IPs to use the tunnel, relying on GUA has been unreliable because my ISP frequently changes the IPv6 prefix. With ULA, the prefix remains stable, which makes management much easier.

If I’m forced to use GUA, I would need to route the entire IPv6 block assigned by my ISP. I’m concerned this could potentially cause routing issues somewhere down the line. That’s why sticking with ULA feels like the better long-term approach.

Is there any way to make this work, or am I out of luck here?

5

You could stop odhcpd from sending lease names to dnsmasq by removing the leasefile and leasetrigger options in the odhcpd config. Then there would be no DNS for GUAs, except anything you manually entered perhaps as static IPv6 ULA reservations.

6

This seems like a much better solution. Someone has already discussed something very similar to what I needed on this mailing list:

However, it would require a lot more effort than just removing the two options and setting static ULA reservations.

7

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.