If one is supposed to get a URL, where does one get it from? I do not see the Cloudflare URL that is present in the guide as one appearing on the DoH Provider list.
If I am supposed to use IP addresses, how exactly do I format primary, secondary, IPv4, and IPv6. For example, for Quad9, I would be specifying the following 4 IPs: 9.9.9.9, 149.112.112.112, 2620:fe::fe, 2620:fe::9
Yep, you basically need to change the URL.
The method in the how-to is a bit more complex to clean up all the previously configured providers, so you get exactly the one you want.
There's also the package luci-app-https_dns_proxy which should be available for OpenWrt 19.07 and Snapshot.
Major DoH providers support domain names, so you typically do not need to use IP addresses.
Although running multiple instances should be still possible:
while uci -q delete https_dns_proxy.@https_dns_proxy[0]; do :; done
uci set https_dns_proxy.dns1="https_dns_proxy"
uci set https_dns_proxy.dns1.listen_addr="127.0.0.1"
uci set https_dns_proxy.dns1.listen_port="5053"
uci set https_dns_proxy.dns1.user="nobody"
uci set https_dns_proxy.dns1.group="nogroup"
uci set https_dns_proxy.dns1.url_prefix="https://doh1.example.org/?"
uci set https_dns_proxy.dns2="https_dns_proxy"
uci set https_dns_proxy.dns2.listen_addr="127.0.0.1"
uci set https_dns_proxy.dns2.listen_port="5054"
uci set https_dns_proxy.dns2.user="nobody"
uci set https_dns_proxy.dns2.group="nogroup"
uci set https_dns_proxy.dns2.url_prefix="https://doh2.example.org/?"
uci commit https_dns_proxy
/etc/init.d/https_dns_proxy restart
uci -q delete dhcp.@dnsmasq[0].server
while
DOHPROXY_ADDR="$(uci -q get https_dns_proxy.@https_dns_proxy[0].listen_addr)"
DOHPROXY_PORT="$(uci -q get https_dns_proxy.@https_dns_proxy[0].listen_port)"
DOHPROXY_SERV="${DOHPROXY_ADDR//[][]/}#${DOHPROXY_PORT}"
uci -q delete https_dns_proxy.@https_dns_proxy[0]
do
uci add_list dhcp.@dnsmasq[0].server="${DOHPROXY_SERV}"
done
uci revert https_dns_proxy
uci commit dhcp
/etc/init.d/dnsmasq restart
Luci app has simple choices between providers, no need to specify the URL.
Also, the updated init script for https_dns_proxy (version 2018-04-23-1 and later) doesn't require user/group/listen_addr if they are default values. I believe it has been updated for current release as well.
@vgaetera thank you for information on Quad9 DoH, I'll update the Luci app.
Speaking of, I just tried a variety of Quad9 DoH servers, with and without explicitly specifying port 5053 in the URL, both with and without type=A in the request and it doesn't seem to work with https_dns_proxy. I get the instance started, but no resolution. If anyone has had positive experience with Quad9 DoH, please let me know.
@okji -- no, the URLs used in the config are NOT examples, they are working configs. Sorry about missing that earlier.
It seems that the default implementation is now based on RFC 8484.
And it is quite different from the one that uses JSON API and hosted on the port 5053.
I'm not sure whether https_dns_proxy supports RFC 8484 or not.
The reply given by the old implementation includes DNSSEC record when available which seems to break the parser:
For https-dns-proxy using Cloudflare I had to add a line in /etc/config/https_dns_proxy : option use_http_1_1 '1'
@stangri, just installed luci-app-https_dns_proxy from your repo, all looks good, but I have some suggestions if you don't mind.
Will be good to have enabled/disabled button to be able to temporarily disable DNS proxy without deleting everything.
When enabled we need to adjust /etc/config/dhcp - add "option noresolv '1'" and remove "resolvfile" if any. When disabled or completely uninstalled we need to revert all the changes there - set "option noresolv '0'" and restore the previous "resolvfile" value in addition to removal of "list server '127.0.0.1#5053'".
Where? If you've added it to /etc/config/https_dns_proxy, unless there were other changes since I've submitted a new init script, that setting is ignored, so it doesn't do anything.
You mean to temporarily restore the previous dhcp.dnsmasq[0].server setting?
I don't have "option noresolv '1'" and I do have a resolvfile referenced from dnsmasq config and https_dns_proxy is working fine here, so I don't understand what do you mean.
Good call, will implement asap. Now that I've had time to reflect on it, not sure about this, what if the luci app is uninstalled, but the actual DoH proxy is still installed? Also, not sure if I can have a pre-rm in the luci app Makefile, I'll investigate.
No. With noresolv=1 only the single file named /etc/resolv.conf is ignored.
If any other file was referenced by resolvfile directive it will be still used. All was tested yesterday.
Thank you for the information, however during my test yesterday I've noticed that the DNS server from the file referenced in resolvfile was still in use after I added noresolv=1 and reloaded dnsmasq.
I will re-test.
yes, this is the file
It should be added there if 'Cloudflare' is selected as a provider in Luci. Not required for Google.
I was probably wrong about resolvfile and save/restore requirements, however option noresolv '1/0' is required. '1' when entry is added and enabled, '0' - when entry is removed or disabled.
Please test yourself if you can. This is not about https-dns-proxy, its about cloudflare server which works differently comparing to google. During my tests it was like a timeout with cloudflare without this option. It was just a guess that helped.
The option itself is definitely supported by the app, the keyword is here. This is a cli equivalent:
-x Use HTTP/1.1 instead of HTTP/2. Useful with broken
or limited builds of libcurl (false).
That's not how it works. The init script translates your /etc/config/https_dns_proxy options to the command line parameters and as I've explained before, the init file does not support that option. Moreover, I believe that the actual binary doesn't support that option either.
The luci-app-https_dns_proxy (git-19.290.74883-9c3e931-6) now backs up the previously used servers, restores them on stop button click and also displays the information about running https_dns_proxy instances.
Available from my repo, I don't think it will be accepted to 18.06, but I'll try to send PR to master/19.07 when I solve the prerm issue.
