DNScrypt Using DNSrypt with Nordvpn on RT-ac68u or other DNS security tools

[Galaxysurfer]

Hi,

I am new to tinkering with DNS. What has started this quest is issues with my Linux os MX Linux. I am currently using an RT-AC68U configured with AMTM Diversion, Skynet, Yazfi & Entware along with a few of the logging scripts. I have been getting no internet available messages on Linux. I am sure there is something that needs tweaked from that end to address the symlink etc. This got me thinking about better ways to secure my dns data. I have blocked the google dns by routing it to gateway. This leaves only the gateway as nameserver in my resolv.config file. I have routed to Nordvpn servers which they suggest to mitigate DNS leaks. In light of the fact that Nordvpn was bought by Surfshark, I want to do things a bit different to protect my data & not rely on one or more tools alone. What are my best options here using my particular router model etc? How to I switch to other DNS servers & keep the dns from being leaked? What are the best dns server options - OpenDNS Cloudflare or Quad9 etc? I dont have resources to host own dns resolver or nameserver nor would I want to necessarily. Will DNSCrypt meet that challenge or do other tools need to be brought in as well? Thanx in advance for any feedback & suggestions.

PS What about Unbound in the mix? As someone else commented "Our routers can only do so much." I don't want to put it all on one device necessarily.

 

[Patrick Walden]

Hi Galaxy! I'm not on here much, but when I saw dnscrypt and needing help, I had to check it out. Long time user of it myself.

I'm running w/ exact same router and thought this might could be helpful to you. From the main page, right after you first login, Click on Tools, then Other Settings.

Tools->Other Settings

At the bottom, change

​

Wan: Use local caching DNS server as system resolver (default: No)	No

To YES.

Afterwards, I turn my VPN clients settings from

​

Accept DNS Configuration = Relaxed

to

​

Accept DNS Configuration = Disabled.

Followed by a reboot (sometimes I don't need to, but I would reboot anyways to make sure it sticks if your power goes out or you need to reboot it later)

I hope this helps. God bless.