Recent content by JJohnson1988

Quad9 blocks ads and trackers? Since when?

Oh okay then. The only interesting thing VPN-wise that really changed since 386.10 was an update in OpenVPN from 2.6.0 to 2.6.3. Maybe the changelog offers a clue: https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst

Already been talked about multiple times. It's due to an OpenSSL regression

Already known about by multiple people, including Merlin himself. Has to do with a more recent OpenSSL version. https://www.snbforums.com/threads/386-11alpha-build-s-testing-available-build-s.84629/page-4#post-839782

As I've said above, it's for their custom block page. It removes the HTTPS warning if using their block page, which is off by default. You can find the option in your NextDNS profile settings. You don't need to mess with any CAs if you don't use the custom block page.

Yeah, I understand. Anyway, the CLI configuration has some information about some of the things you can configure, at least. The part I didn't quite understand at first was how to add multiple NextDNS configuration IDs to the configuration, and how to direct network clients to the various IDs...

Correct. Unless you leave your home network, then you need either the Windows program, a VPN connection back to your home, YogaDNS, or something similar.

The difference between the CLI and the Windows program? The CLI effectively replaces a big part of Dnsmasq on the router, and it has its own domain cache and everything. Allows you to assign specific NextDNS profiles to specific clients, among other things, as I already mentioned. While the CLI...

That's the exception. If you leave your local network then the NextDNS for Windows thingy becomes useful again. Though I'd personally either: just connect back to my home using a VPN, and get the benefits of the CLI for Merlin but on my remote device. OR use something like YogaDNS on the device...

Also, note that their installer for Windows is not the same as the CLI for Merlin. You don't need the installer for Windows if you run the CLI on the router. That's the point. And as a bonus you can force all devices on your network to use the router DNS instead of potentially being overridden...

The NextDNS CLI solution's DoH will override the built-in's DoT solution. So you wouldn't be using both at the same time. But yes, you can technically set up one NextDNS profile for DoH and then when the CLI is disabled, you can fall back to another NextDNS profile using DoT. You technically...

It's mainly useful if you have multiple NextDNS profiles, as each device on your network can easily be assigned a different profile (if so desired). It's also configured out of the box to send responses with low TTL values to clients, so the clients will constantly ask the router about DNS...

There may be a good reason as to why it doesn't work, I'm just not completely sure what it is. Someone with more experience can fill in. There used to be an issue reporter on this project's GitHub but it was discontinued a while back.

Actually I just tried it with the PSK type. Unsuccessful connection. Android 12 running LineageOS. Edit: I also realized that the PSK type never asks for a user and password to be entered, just the PSK. That may have something to do with it.

MSCHAPv2 requires a CA certificate (that you can generate from the router administration) instead of a PSK. That's the main difference, but no idea about secure/insecure. I seem to recall not being able to get the PSK type to work either, which is why I switched. I'll try again tonight to...