DNSCrypt-Proxy - Revision history

Sertonix: replace /etc/init.d with rc-service

2023-11-17T09:55:52Z

replace /etc/init.d with rc-service

← Older revision		Revision as of 09:55, 17 November 2023
Line 35:		Line 35:

	Start the dnscrypt-proxy service immediately:		Start the dnscrypt-proxy service immediately:
	{{Cmd\|~~/etc/init.d/~~dnscrypt-proxy start}}		{{Cmd\|rc-service dnscrypt-proxy start}}

	{{Note\|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}}		{{Note\|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}}
Line 48:		Line 48:
	listen_addresses = [':53']		listen_addresses = [':53']
	Then restart the service with		Then restart the service with
	{{Cmd\|~~/etc/init.d/~~dnscrypt-proxy restart}}		{{Cmd\|rc-service dnscrypt-proxy restart}}

	== Enable local DOH Server ==		== Enable local DOH Server ==
Line 97:		Line 97:

	Then restart the service with		Then restart the service with
	{{Cmd\|~~/etc/init.d/~~dnscrypt-proxy restart}}		{{Cmd\|rc-service dnscrypt-proxy restart}}


Line 122:		Line 122:

	Then restart the service with		Then restart the service with
	{{Cmd\|~~/etc/init.d/~~dnscrypt-proxy restart}}		{{Cmd\|rc-service dnscrypt-proxy restart}}

	== More General Filtering ==		== More General Filtering ==

Sertonix: /* Enable local DOH Server */ nowikid hypothetical url

2023-09-16T21:48:04Z

Enable local DOH Server: nowikid hypothetical url

← Older revision		Revision as of 21:48, 16 September 2023
Line 72:		Line 72:
	Start by trying to open this full URL as a regular website with Firefox. The first time, Firefox will notice that the certificate is self-signed and complain about it. This is expected. Click "Advanced" and "I accept the risks". This is okay, you are only going to connect to your own machine.		Start by trying to open this full URL as a regular website with Firefox. The first time, Firefox will notice that the certificate is self-signed and complain about it. This is expected. Click "Advanced" and "I accept the risks". This is okay, you are only going to connect to your own machine.
	Next, type about:config in the URL bar, search for trr and make the following changes:		Next, type about:config in the URL bar, search for trr and make the following changes:
	Set network.trr.custom_uri and network.trr.uri to https://127.0.0.1:3000/dns-query		Set network.trr.custom_uri and network.trr.uri to <nowiki>https://127.0.0.1:3000/dns-query</nowiki>
	Set network.trr.mode to 2		Set network.trr.mode to 2

Sertonix: /* Enable local DOH Server */ use # instead of sudo

2023-09-16T21:47:16Z

Enable local DOH Server: use # instead of sudo

← Older revision		Revision as of 21:47, 16 September 2023
Line 57:		Line 57:
	localhost.pem -out localhost.pem}}		localhost.pem -out localhost.pem}}
	Then copy to the dnscrypt-proxy folder		Then copy to the dnscrypt-proxy folder
	{{Cmd\|~~sudo~~ cp localhost.pem /etc/dnscrypt-proxy}}		{{Cmd\|# cp localhost.pem /etc/dnscrypt-proxy}}

	Next, edit the main configuration file is '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml'''.		Next, edit the main configuration file is '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml'''.
Line 83:		Line 83:
	To disable, make the following changes:		To disable, make the following changes:
	Set network.trr.mode to 0		Set network.trr.mode to 0



	== Forwarding internal traffic to a local DNS server ==		== Forwarding internal traffic to a local DNS server ==

Ianu: Updated configuration options for some existing and new features

2021-08-02T19:37:13Z

Updated configuration options for some existing and new features

@@ Line 8: / Line 8: @@
 = Features =
-* DNS traffic encryption and authentication. Supports DNS-over-HTTPS (DoH) using TLS 1.3, and DNSCrypt.
+* DNS traffic encryption and authentication.
 * Local DOH Server
 * DNS query monitoring, with separate log files for regular and suspicious queries
@@ Line 16: / Line 17: @@
 * DNS caching, to reduce latency and improve privacy
 and more...
 == Installation ==
@@ Line 119: / Line 126: @@
 {{Cmd|/etc/init.d/dnscrypt-proxy restart}}
 [[Category:Networking]]

Ianu at 18:14, 3 December 2019

2019-12-03T18:14:23Z

@@ Line 9: / Line 9: @@
 = Features =
 * DNS traffic encryption and authentication. Supports DNS-over-HTTPS (DoH) using TLS 1.3, and DNSCrypt.
 * DNS query monitoring, with separate log files for regular and suspicious queries
 * Filtering: block ads, malware, and other unwanted content. Compatible with all DNS services
@@ Line 41: / Line 42: @@
 Then restart the service with
 {{Cmd|/etc/init.d/dnscrypt-proxy restart}}
 == Forwarding internal traffic to a local DNS server ==
@@ Line 56: / Line 93: @@
 Then restart the service with
 {{Cmd|/etc/init.d/dnscrypt-proxy restart}}
 == Creating a Family Friendly DNS Service ==
@@ Line 62: / Line 100: @@
   # server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
   server_names = ['cleanbrowsing-family']
 Then restart the service with

Innsill: + Category:Networking

2019-09-13T13:59:42Z

+ Category:Networking

← Older revision		Revision as of 13:59, 13 September 2019
Line 1:		Line 1:
			{{TOC right}}

	= Overview =		= Overview =

Line 63:		Line 65:
	Then restart the service with		Then restart the service with
	{{Cmd\|/etc/init.d/dnscrypt-proxy restart}}		{{Cmd\|/etc/init.d/dnscrypt-proxy restart}}


			[[Category:Networking]]

Ianu at 22:55, 28 March 2019

2019-03-28T22:55:56Z

← Older revision		Revision as of 22:55, 28 March 2019
Line 41:		Line 41:

	== Forwarding internal traffic to a local DNS server ==		== Forwarding internal traffic to a local DNS server ==
	The main configuration file is '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml'~~''. Any line starting with "#" will be ignored by ''dnscrypt-proxy~~''.		You'd want to do this if you use hostnames on your local network - normally this is managed by your home router.
			The main configuration file is '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml'''.
	Remove the "#" from the beginning of this line		Remove the "#" from the beginning of this line
	# forwarding_rules = '/etc/dnscrypt-proxy/forwarding-rules.txt'		# forwarding_rules = '/etc/dnscrypt-proxy/forwarding-rules.txt'

Ianu at 22:53, 28 March 2019

2019-03-28T22:53:02Z

← Older revision		Revision as of 22:53, 28 March 2019
Line 23:		Line 23:
	Enable the dnscrypt-proxy service so that it starts at boot:		Enable the dnscrypt-proxy service so that it starts at boot:
	{{Cmd\|rc-update add dnscrypt-proxy}}		{{Cmd\|rc-update add dnscrypt-proxy}}

	~~List services to verify sshd is enabled:~~
	~~{{Cmd\|rc-status}}~~

	Start the dnscrypt-proxy service immediately:		Start the dnscrypt-proxy service immediately:

Ianu: Created page with "= Overview = This article provides a short guide to setting up a DNSCrypt-Proxy server on Alpine Linux. Also see [https://dnscrypt.info dnscrypt.info]. Source code on [http..."

2019-03-28T22:52:10Z

Created page with "= Overview = This article provides a short guide to setting up a DNSCrypt-Proxy server on Alpine Linux. Also see [https://dnscrypt.info dnscrypt.info]. Source code on [http..."

New page

= Overview =

This article provides a short guide to setting up a DNSCrypt-Proxy server on Alpine Linux.

Also see [https://dnscrypt.info dnscrypt.info]. Source code on [https://github.com/jedisct1/dnscrypt-proxy github.com/jedisct1/dnscrypt-proxy]

= Features =
* DNS traffic encryption and authentication. Supports DNS-over-HTTPS (DoH) using TLS 1.3, and DNSCrypt.
* DNS query monitoring, with separate log files for regular and suspicious queries
* Filtering: block ads, malware, and other unwanted content. Compatible with all DNS services
* Time-based filtering, with a flexible weekly schedule
* Transparent redirection of specific domains to specific resolvers
* DNS caching, to reduce latency and improve privacy
and more...

== Installation ==
Install the {{Pkg|dnscrypt-proxy}} package:
{{Cmd|apk add dnscrypt-proxy dnscrypt-proxy-openrc}}

Also see [https://wiki.alpinelinux.org/wiki/Alpine_Linux_package_management Alpine Linux package management ].

== Service commands ==
Enable the dnscrypt-proxy service so that it starts at boot:
{{Cmd|rc-update add dnscrypt-proxy}}

List services to verify sshd is enabled:
{{Cmd|rc-status}}

Start the dnscrypt-proxy service immediately:
{{Cmd|/etc/init.d/dnscrypt-proxy start}}

{{Note|If you are running from RAM, ensure you save your settings using the 'lbu ci' command as necessary. See [https://wiki.alpinelinux.org/wiki/Alpine_local_backup Alpine local backup].}}
{{Note|Configuration options are shown in '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml'''. The file includes comments that explain many of the options.}}
Also see [https://wiki.alpinelinux.org/wiki/Alpine_Linux_Init_System Alpine Linux Init System].

== Exposing the service on the local network ==
The main configuration file is '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml'''. Any line starting with "#" will be ignored by ''dnscrypt-proxy''.
Replace
listen_addresses = ['127.0.0.1:53', '[::1]:53']
With
listen_addresses = [':53']
Then restart the service with
{{Cmd|/etc/init.d/dnscrypt-proxy restart}}

== Forwarding internal traffic to a local DNS server ==
The main configuration file is '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml'''. Any line starting with "#" will be ignored by ''dnscrypt-proxy''.
Remove the "#" from the beginning of this line
# forwarding_rules = '/etc/dnscrypt-proxy/forwarding-rules.txt'
forwarding_rules = '/etc/dnscrypt-proxy/forwarding-rules.txt'

The copy the example file
{{Cmd|cp /usr/share/dnscrypt-proxy/example-forwarding-rules.txt /etc/dnscrypt-proxy/forwarding-rules.txt}}
Then edit the file, and add a line for your local network. If your network is configured as ".home", and your home router is at 192.168.1.1 then add
home 192.168.1.1

Then restart the service with
{{Cmd|/etc/init.d/dnscrypt-proxy restart}}

== Creating a Family Friendly DNS Service ==
Some providers have their own adult content blocking filters. They don't all use the same system, so researching may be worthwhile. The list of providers can be found here [https://dnscrypt.info/public-servers public-servers].
It might be unwise to select only one service in case it becomes unavailable. Edit '''/etc/dnscrypt-proxy/dnscrypt-proxy.toml''' and make an adjustment like this in the Global Settings
# server_names = ['scaleway-fr', 'google', 'yandex', 'cloudflare']
server_names = ['cleanbrowsing-family']

Then restart the service with
{{Cmd|/etc/init.d/dnscrypt-proxy restart}}