I have used dnsmasq as a dns cache for opendns queries or for Google's DNS.
The previous articles that talk about dnsmasq are:
- Using dnsmasq as a cache and local DNS server
- Improving DNS query speed with dnsmasq and running diagnostic tests
And now DNSCrypt will be used, as shown in the following articles:
- Encrypting DNS traffic on Linux with DNSCrypt and OpenDNS
- Encrypting DNS traffic on Debian 9 Stretch (2017 update)
To start, dnsmasq will be installed:
#apt-get install dnsmasq DNSCrypt listens on the IP 127.0.2.1 on port 53; in the case of dnsmasq, it will listen on the IP 127.0.0.1 and port 53 to avoid conflicts between both applications.
Edit the /etc/dnsmasq.conf file :
#vim /etc/dnsmasq.conf
#Realizar consultas de dominios completos solamente.
domain-needed
#Evitar busquedas internas de dominios locales
bogus-priv
#Habilita dnssec en dnsmasq
proxy-dnssec
#No tomar en cuenta el contenido del archivo /etc/resolv.conf
no-resolv
#Se escucha el servidor de nombres de dnscrypt
server=127.0.2.1
#Evitar ataques de dns rebinding
stop-dns-rebind
#evitar que servidores resuelvan consultas localhost
rebind-localhost-ok
#Se reciben consultas a dnsmasq en 127.0.0.1
listen-address=127.0.0.1
#No se habilita las interfaces para dhcp
no-dhcp-interface=wlp1s0,enp2s0,lo
#Sólo se realizan busquedas de direcciones que está resolviendo.
bind-interfaces
#No tomar en cuenta los hosts del archivo /etc/hosts
no-hosts
#Se define un cache de 500k
cache-size=500Save the file and restart dnsmasq:
#systemctl status dnsmasq.service
● dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server
Loaded: loaded (/lib/systemd/system/dnsmasq.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2017-06-04 18:10:08 -04; 2 days ago
Process: 851 ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf (code=exited, status=0/SUCCESS)
Process: 814 ExecStart=/etc/init.d/dnsmasq systemd-exec (code=exited, status=0/SUCCESS)
Process: 793 ExecStartPre=/usr/sbin/dnsmasq --test (code=exited, status=0/SUCCESS)
Main PID: 842 (dnsmasq)
Tasks: 1 (limit: 4915)
Memory: 844.0K
CPU: 7.042s
CGroup: /system.slice/dnsmasq.service
└─842 /usr/sbin/dnsmasq -x /run/dnsmasq/dnsmasq.pid -u dnsmasq -r /run/dnsmasq/resolv.conf -7 /etc/dnsmasq.d,.d
jun 04 18:10:08 grievous systemd[1]: Starting dnsmasq - A lightweight DHCP and caching DNS server...
jun 04 18:10:08 grievous dnsmasq[793]: dnsmasq: revisión de sintaxis OK.
jun 04 18:10:08 grievous dnsmasq[842]: iniciado, versión 2.76 tamaño de caché 500
jun 04 18:10:08 grievous dnsmasq[842]: opciones de compilación: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conn
jun 04 18:10:08 grievous dnsmasq[842]: advertencia: ignorando opción resolv-file porque no-resolv está fijado
jun 04 18:10:08 grievous dnsmasq[842]: usando nombre de servidor 127.0.2.1#53
jun 04 18:10:08 grievous dnsmasq[842]: el caché fue liberado
jun 04 18:10:08 grievous dnsmasq[851]: Too few arguments.
jun 04 18:10:08 grievous systemd[1]: Started dnsmasq - A lightweight DHCP and caching DNS server.As can be seen, dnsmasq is working without problems.
Checking the /etc/resolv.conf file gives the following:
cat /etc/resolv.conf
# Generated by resolvconf
#nameserver 127.0.2.1
nameserver 127.0.0.1Both dnscrypt and dnsmasq are being used to resolve DNS queries.
Querying a domain with dig gives the following:
# dig www.google.com
; <<>> DiG 9.10.3-P4-Debian <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41085
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.google.com. IN A
;; ANSWER SECTION:
www.google.com. 190 IN A 172.217.22.164
;; Query time: 300 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jun 06 20:08:50 -04 2017
;; MSG SIZE rcvd: 59
# dig www.google.com
; <<>> DiG 9.10.3-P4-Debian <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49000
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.google.com. IN A
;; ANSWER SECTION:
www.google.com. 189 IN A 172.217.22.164
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jun 06 20:08:51 -04 2017
;; MSG SIZE rcvd: 59
On the second query the response time drops from 300 msec to 0 msec.
Make a donation! If you liked the article you can make a donation with Bitcoin (BTC) using the digital wallet of your choice to the following address: 17MtNybhdkA9GV3UNS6BTwPcuhjXoPrSzV
Or by scanning the QR code from your wallet:
