[SOLVED] DNSCrypt - question re optional commands on wiki

[Jack Yaz]

Following the guide here: https://github.com/RMerl/asuswrt-merlin/wiki/Secure-DNS-queries-using-DNSCrypt

(optional) You can redirect using other DNS-servers on clients: add to firewall-start or nat-start

iptables -t nat -A PREROUTING -i br0 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)

Which of the 2 starts is preferable? And do I need these? Will it affect the VPN server I run etc?

 

[joegreat]

(optional) You can redirect using other DNS-servers on clients: add to firewall-start or nat-start

iptables -t nat -A PREROUTING -i br0 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)

Both - one is for TCP the other for UDP protocol!

And do I need these?

No! DNScrypt uses different ports. This is just to block the standard DNS ports.

Will it affect the VPN server I run etc?

No! VPN will also use the DNScrypt - unless you want to use the DNS from the VPN provider.

 

[Jack Yaz]

Both - one is for TCP the other for UDP protocol!

No! DNScrypt uses different ports. This is just to block the standard DNS ports.

No! VPN will also use the DNScrypt - unless you want to use the DNS from the VPN provider.

Thanks, makes sense. Sorry, i meant is firewall start or services start better?

 

[joegreat]

Thanks, makes sense. Sorry, i meant is firewall start or services start better?

Firewall start script is the place to go - runs much earlier the service-start!

 

[Jack Yaz]

Ok cool, I was going to put it there as I've had mixed results with iptables rules in service-start!

 

[eclp]

Hello ...

I have another question in this context.
Would be nice if someone can help me. I use the dnscrypt installer for asuswrt from here: https://www.snbforums.com/threads/release-dnscrypt-installer-for-asuswrt.36071/

Dnscrypt uses port 443 by default but the DNS standard port is of course 53, dnscrypt.eu supports these ports - and this I would like to use. I found this guide, I do not know I can implement it:
https://mydarkerego.blogspot.nl/2015/11/bypassing-udp443-blocks-for-dnscrypt.html