Use the install link then
curl -L -s -k -O https://raw.githubusercontent.com/thuantran/dnscrypt-asuswrt-installer/master/installer && sh installerI wonder what could cause this maybe @thelonelycoder might be able to point me to the cause. I had no luck.
My first thought is you use anonymization, and you have countries blocked with skynet. It is hard to say what ramifications this might impose. I would recommend trying different servers with no anonymization for a few days. see if the symptoms change. it might simply be a bad combination of coincident finally catching up with one another at the three day mark. Yes, I don't mind taking a look at logs if you can narrow it down to an hour before, and after the incident, that would be great too. Particularly interested in syslog.
Alright.. it just occurred again.. and I attempted to connect to a site (zoom) via app and then browser and capture the dnsmasq log entries..
Yea you shouldn't have to run a service restart though because once the manager realizes there is no functioning dns (which should be almost instant.) It should be restarting itself.
Notice after it fails to resolve zoom.us, it still shows dnscrypt-proxy is working , it has no problem resolving www.google.com one second after the dnssec failure. this tells me dnscrypt proxy was running fine. Notice during the same instance zoom.us fails to load, skynet blocks traffic from an IP coming from the same client source. This means that either skynet blocked it, or the dnssec failure in the log caused the issue. Either way your internet traffic to that client is either hindered by skynet block and dnsmasq dnssec failures, and not dnscrypt proxy (at least not from what the logs suggest).
I will try running the command if it occurs again. It said it resolved google from the cache in the log.. not sure if that matters though.
The problem I am having right here is
May 13 09:01:27 dnsmasq[15713]: query[A] zoom.us from 192.168.1.2
May 13 09:01:27 dnsmasq[15713]: dnssec retry to 127.0.1.1
May 13 09:01:29 dnsmasq[15713]: query[A] zoom.us from 192.168.1.2
May 13 09:01:29 dnsmasq[15713]: dnssec retry to 127.0.1.1dnscrypt proxy already does the dnssec part from servers that support it, if you still want dnsmasq to pick up the message you can
proxy-dnssec to dnsmasq.conf.add in /jffs/configs. However it is completely a cosmetic option. (or you could enable dnssec option inside the GUI, but leave check unsigned replies unchecked.)
It is only specifically when using dnscrypt proxy. The routers stubby is different since the built in stubby dnssec is not enabled by default, it only passes unverified replies to dnsmasq.
I prefer not to use DNSSEC and disable in DNSCrypt-proxy the option to require DNSSEC servers, there will be more availability of upstream servers
I agree if you don't need the extra dnssec latency. It is just one more layer of latency to worry about. I also like the rust-doh-proxy. I am already running it from two rpi with nginx serving as front end.
Nice! You do a good job with DNSCrypt-proxy for AMTM and Asus routers. I noticed that the ephemeral key and TTL´s options are fine-tuned for Odoh relays.
I don't really understand DNSSEC being necessary in applications such as Stubby and DNSCrypt-proxy.
The only time I see it necessary is if we are talking about the traffic reaching a point of unencrytion (i.e. not within someone's local network.) and there is a point where we want to establish some sort of chain of trust. But in all honesty for a home network, this is just unecessary latency.
izzt@RT-AX88U:/tmp/home/root# cd ..
izzt@RT-AX88U:/tmp/home# cd ..
izzt@RT-AX88U:/tmp# cd ..
izzt@RT-AX88U:/# cd jffs
izzt@RT-AX88U:/jffs# cd dnscrypt
izzt@RT-AX88U:/jffs/dnscrypt# mv dnscrypt-proxy.toml.err dnscrypt-proxy.toml
izzt@RT-AX88U:/jffs/dnscrypt# service restart_dnscrypt-proxyservice restart_dnscrypt-proxy
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
