{"id":2933,"date":"2024-09-04T17:56:51","date_gmt":"2024-09-04T09:56:51","guid":{"rendered":"https:\/\/eligiblestore.com\/blog\/?p=2933"},"modified":"2024-09-04T18:19:41","modified_gmt":"2024-09-04T10:19:41","slug":"setup-dnscrypt-proxy-on-ubuntu-24-04-raspberry-pi-5","status":"publish","type":"post","link":"https:\/\/eligiblestore.com\/blog\/2024\/09\/04\/setup-dnscrypt-proxy-on-ubuntu-24-04-raspberry-pi-5\/","title":{"rendered":"Setup dnscrypt-proxy on Ubuntu 24.04 (Raspberry Pi 5)"},"content":{"rendered":"

This will setup dnscrypt-proxy as the only DNS on Ubuntu Server.<\/p>\n

    \n
  1. Change from DHCP to Static IP
    \ncreate a backup of \/etc\/netplan\/50-cloud-init.yaml<\/p>\n
    $ sudo cp \/etc\/netplan\/50-cloud-init.yaml \/etc\/netplan\/50-cloud-init.yaml.bak<\/pre>\n
    and then copy below structure for static IP<\/p>\n
    network:\r\n    ethernets:\r\n        eth0:\r\n            dhcp4: no\r\n            addresses:\r\n              - 192.168.X.X\/25\r\n            routes:\r\n              - to: default\r\n                via: 192.168.X.X\r\n            nameservers:\r\n              addresses: [127.0.0.1,X.X.X.X,Y.Y.Y.Y]\r\n            optional: true\r\n    version: 2<\/pre>\n
    and then apply the new netplan<\/p>\n
    $ sudo netplan apply<\/pre>\n<\/li>\n
  2. Install dnscrypt-proxy\n
    $ sudo apt install dnscrypt-proxy<\/pre>\n<\/li>\n
  3. create a backup of \/etc\/dnscrypt-proxy\/dnscrypt-proxy.toml\n
    $ sudo cp \/etc\/dnscrypt-proxy\/dnscrypt-proxy.toml \/etc\/dnscrypt-proxy\/dnscrypt-proxy.toml.bak<\/pre>\n
    and then use your config based on your preference what is important is below:<\/p>\n
    \r\nserver_names = ['doh.tiar.app', 'doh.tiar.app-doh', 'doh.tiar.app-ipv6', 'doh.tiar.app-doh-ipv6','id-gmail', 'id-gmail-doh', 'id-gmail-ipv6', 'id-gmail-doh-ipv6','cloudflare','cloudflare-ipv6','cloudflare-security','cloudflare-security-ipv6']\r\n\r\nlisten_addresses = []\r\n\r\nfallback_resolvers = ['9.9.9.9:53', '8.8.8.8:53']\r\n\r\n[sources.'public-resolvers']\r\nurls = ['https:\/\/raw.githubusercontent.com\/DNSCrypt\/dnscrypt-resolvers\/master\/v2\/public-resolvers.md', 'https:\/\/download.dnscrypt.info\/resolvers-list\/v2\/public-resolvers.md']\r\ncache_file = '\/var\/cache\/dnscrypt-proxy\/public-resolvers.md'\r\nminisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'\r\nprefix = ''\r\n<\/pre>\n
    for the complete example:<\/p>\n
    \r\n##############################################\r\n# #\r\n# dnscrypt-proxy configuration #\r\n# #\r\n##############################################\r\n\r\n## This is an example configuration file.\r\n## You should adjust it to your needs, and save it as "dnscrypt-proxy.toml"\r\n##\r\n## Online documentation is available here: https:\/\/dnscrypt.info\/doc\r\n\r\n##################################\r\n# Global settings #\r\n##################################\r\n\r\n## List of servers to use\r\n##\r\n## Servers from the "public-resolvers" source (see down below) can\r\n## be viewed here: https:\/\/dnscrypt.info\/public-servers\r\n##\r\n## The proxy will automatically pick working servers from this list.\r\n## Note that the require_* filters do NOT apply when using this setting.\r\n##\r\n## By default, this list is empty and all registered servers matching the\r\n## require_* filters will be used instead.\r\n##\r\n## Remove the leading # first to enable this; lines starting with # are ignored.\r\n\r\nserver_names = ['doh.tiar.app', 'doh.tiar.app-doh', 'doh.tiar.app-ipv6', 'doh.tiar.app-doh-ipv6','id-gmail', 'id-gmail-doh', 'id-gmail-ipv6', 'id-gmail-doh-ipv6','cloudflare','cloudflare-ipv6','cloudflare-security','cloudflare-security-ipv6']\r\n\r\n## List of local addresses and ports to listen to. Can be IPv4 and\/or IPv6.\r\n## Example with both IPv4 and IPv6:\r\nlisten_addresses = []\r\n\r\n# listen_addresses = ['127.0.0.1:53']\r\n\r\n## Maximum number of simultaneous client connections to accept\r\n\r\nmax_clients = 250\r\n\r\n## Switch to a different system user after listening sockets have been created.\r\n## Note (1): this feature is currently unsupported on Windows.\r\n## Note (2): this feature is not compatible with systemd socket activation.\r\n## Note (3): when using -pidfile, the PID file directory must be writable by the new user\r\n\r\n# user_name = 'nobody'\r\n\r\n## Require servers (from static + remote sources) to satisfy specific properties\r\n\r\n# Use servers reachable over IPv4\r\nipv4_servers = true\r\n\r\n# Use servers reachable over IPv6 -- Do not enable if you don't have IPv6 connectivity\r\nipv6_servers = false\r\n\r\n# Use servers implementing the DNSCrypt protocol\r\ndnscrypt_servers = true\r\n\r\n# Use servers implementing the DNS-over-HTTPS protocol\r\ndoh_servers = true\r\n\r\n## Require servers defined by remote sources to satisfy specific properties\r\n\r\n# Server must support DNS security extensions (DNSSEC)\r\nrequire_dnssec = false\r\n\r\n# Server must not log user queries (declarative)\r\nrequire_nolog = true\r\n\r\n# Server must not enforce its own blacklist (for parental control, ads blocking...)\r\nrequire_nofilter = true\r\n\r\n# Server names to avoid even if they match all criteria\r\ndisabled_server_names = []\r\n\r\n## Always use TCP to connect to upstream servers.\r\n## This can be useful if you need to route everything through Tor.\r\n## Otherwise, leave this to `false`, as it doesn't improve security\r\n## (dnscrypt-proxy will always encrypt everything even using UDP), and can\r\n## only increase latency.\r\n\r\nforce_tcp = false\r\n\r\n## SOCKS proxy\r\n## Uncomment the following line to route all TCP connections to a local Tor node\r\n## Tor doesn't support UDP, so set `force_tcp` to `true` as well.\r\n\r\n# proxy = 'socks5:\/\/127.0.0.1:9050'\r\n\r\n## HTTP\/HTTPS proxy\r\n## Only for DoH servers\r\n\r\n# http_proxy = 'http:\/\/127.0.0.1:8888'\r\n\r\n## How long a DNS query will wait for a response, in milliseconds.\r\n## If you have a network with *a lot* of latency, you may need to\r\n## increase this. Startup may be slower if you do so.\r\n## Don't increase it too much. 10000 is the highest reasonable value.\r\n\r\ntimeout = 5000\r\n\r\n## Keepalive for HTTP (HTTPS, HTTP\/2) queries, in seconds\r\n\r\nkeepalive = 30\r\n\r\n## Response for blocked queries. Options are `refused`, `hinfo` (default) or\r\n## an IP response. To give an IP response, use the format `a:,aaaa:`.\r\n## Using the `hinfo` option means that some responses will be lies.\r\n## Unfortunately, the `hinfo` option appears to be required for Android 8+\r\n\r\n# blocked_query_response = 'refused'\r\n\r\n## Load-balancing strategy: 'p2' (default), 'ph', 'first' or 'random'\r\n\r\n# lb_strategy = 'p2'\r\n\r\n## Set to `true` to constantly try to estimate the latency of all the resolvers\r\n## and adjust the load-balancing parameters accordingly, or to `false` to disable.\r\n\r\n# lb_estimator = true\r\n\r\n## Log level (0-6, default: 2 - 0 is very verbose, 6 only contains fatal errors)\r\n\r\n# log_level = 2\r\n\r\n## Log file for the application, as an alternative to sending logs to\r\n## the standard system logging service (syslog\/Windows event log).\r\n##\r\n## This file is different from other log files, and will not be\r\n## automatically rotated by the application.\r\n\r\n# log_file = 'dnscrypt-proxy.log'\r\n\r\n## When using a log file, only keep logs from the most recent launch.\r\n\r\n# log_file_latest = true\r\n\r\n## Use the system logger (syslog on Unix, Event Log on Windows)\r\n\r\n# use_syslog = true\r\n\r\n## Delay, in minutes, after which certificates are reloaded\r\n\r\ncert_refresh_delay = 240\r\n\r\n## DNSCrypt: Create a new, unique key for every single DNS query\r\n## This may improve privacy but can also have a significant impact on CPU usage\r\n## Only enable if you don't have a lot of network load\r\n\r\n# dnscrypt_ephemeral_keys = false\r\n\r\n## DoH: Disable TLS session tickets - increases privacy but also latency\r\n\r\n# tls_disable_session_tickets = false\r\n\r\n## DoH: Use a specific cipher suite instead of the server preference\r\n## 49199 = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\r\n## 49195 = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\r\n## 52392 = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\r\n## 52393 = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305\r\n## 4865 = TLS_AES_128_GCM_SHA256\r\n## 4867 = TLS_CHACHA20_POLY1305_SHA256\r\n##\r\n## On non-Intel CPUs such as MIPS routers and ARM systems (Android, Raspberry Pi...),\r\n## the following suite improves performance.\r\n## This may also help on Intel CPUs running 32-bit operating systems.\r\n##\r\n## Keep tls_cipher_suite empty if you have issues fetching sources or\r\n## connecting to some DoH servers. Google and Cloudflare are fine with it.\r\n\r\n# tls_cipher_suite = [52392, 49199]\r\n\r\n## Fallback resolvers\r\n## These are normal, non-encrypted DNS resolvers, that will be only used\r\n## for one-shot queries when retrieving the initial resolvers list, and\r\n## only if the system DNS configuration doesn't work.\r\n## No user application queries will ever be leaked through these resolvers,\r\n## and they will not be used after IP addresses of resolvers URLs have been found.\r\n## They will never be used if lists have already been cached, and if stamps\r\n## don't include host names without IP addresses.\r\n## They will not be used if the configured system DNS works.\r\n## Resolvers supporting DNSSEC are recommended.\r\n##\r\n## People in China may need to use 114.114.114.114:53 here.\r\n## Other popular options include 8.8.8.8 and 1.1.1.1.\r\n##\r\n## If more than one resolver is specified, they will be tried in sequence.\r\n\r\nfallback_resolvers = ['9.9.9.9:53', '8.8.8.8:53']\r\n\r\n## Always use the fallback resolver before the system DNS settings.\r\n\r\nignore_system_dns = true\r\n\r\n## Maximum time (in seconds) to wait for network connectivity before\r\n## initializing the proxy.\r\n## Useful if the proxy is automatically started at boot, and network\r\n## connectivity is not guaranteed to be immediately available.\r\n## Use 0 to not test for connectivity at all (not recommended),\r\n## and -1 to wait as much as possible.\r\n\r\nnetprobe_timeout = 60\r\n\r\n## Address and port to try initializing a connection to, just to check\r\n## if the network is up. It can be any address and any port, even if\r\n## there is nothing answering these on the other side. Just don't use\r\n## a local address, as the goal is to check for Internet connectivity.\r\n## On Windows, a datagram with a single, nul byte will be sent, only\r\n## when the system starts.\r\n## On other operating systems, the connection will be initialized\r\n## but nothing will be sent at all.\r\n\r\nnetprobe_address = '9.9.9.9:53'\r\n\r\n## Offline mode - Do not use any remote encrypted servers.\r\n## The proxy will remain fully functional to respond to queries that\r\n## plugins can handle directly (forwarding, cloaking, ...)\r\n\r\n# offline_mode = false\r\n\r\n## Additional data to attach to outgoing queries.\r\n## These strings will be added as TXT records to queries.\r\n## Do not use, except on servers explicitly asking for extra data\r\n## to be present.\r\n## encrypted-dns-server can be configured to use this for access control\r\n## in the [access_control] section\r\n\r\n# query_meta = ["key1:value1", "key2:value2", "token:MySecretToken"]\r\n\r\n## Automatic log files rotation\r\n\r\n# Maximum log files size in MB - Set to 0 for unlimited.\r\nlog_files_max_size = 10\r\n\r\n# How long to keep backup files, in days\r\nlog_files_max_age = 7\r\n\r\n# Maximum log files backups to keep (or 0 to keep all backups)\r\nlog_files_max_backups = 1\r\n\r\n#########################\r\n# Filters #\r\n#########################\r\n\r\n## Note: if you are using dnsmasq, disable the `dnssec` option in dnsmasq if you\r\n## configure dnscrypt-proxy to do any kind of filtering (including the filters\r\n## below and blacklists).\r\n## You can still choose resolvers that do DNSSEC validation.\r\n\r\n## Immediately respond to IPv6-related queries with an empty response\r\n## This makes things faster when there is no IPv6 connectivity, but can\r\n## also cause reliability issues with some stub resolvers.\r\n\r\nblock_ipv6 = false\r\n\r\n## Immediately respond to A and AAAA queries for host names without a domain name\r\n\r\nblock_unqualified = true\r\n\r\n## Immediately respond to queries for local zones instead of leaking them to\r\n## upstream resolvers (always causing errors or timeouts).\r\n\r\nblock_undelegated = true\r\n\r\n## TTL for synthetic responses sent when a request has been blocked (due to\r\n## IPv6 or blacklists).\r\n\r\nreject_ttl = 600\r\n\r\n##################################################################################\r\n# Route queries for specific domains to a dedicated set of servers #\r\n##################################################################################\r\n\r\n## See the `example-forwarding-rules.txt` file for an example\r\n\r\n# forwarding_rules = 'forwarding-rules.txt'\r\n\r\n###############################\r\n# Cloaking rules #\r\n###############################\r\n\r\n## Cloaking returns a predefined address for a specific name.\r\n## In addition to acting as a HOSTS file, it can also return the IP address\r\n## of a different name. It will also do CNAME flattening.\r\n##\r\n## See the `example-cloaking-rules.txt` file for an example\r\n\r\n# cloaking_rules = 'cloaking-rules.txt'\r\n\r\n## TTL used when serving entries in cloaking-rules.txt\r\n\r\n# cloak_ttl = 600\r\n\r\n###########################\r\n# DNS cache #\r\n###########################\r\n\r\n## Enable a DNS cache to reduce latency and outgoing traffic\r\n\r\ncache = true\r\n\r\n## Cache size\r\n\r\ncache_size = 4096\r\n\r\n## Minimum TTL for cached entries\r\n\r\ncache_min_ttl = 2400\r\n\r\n## Maximum TTL for cached entries\r\n\r\ncache_max_ttl = 86400\r\n\r\n## Minimum TTL for negatively cached entries\r\n\r\ncache_neg_min_ttl = 60\r\n\r\n## Maximum TTL for negatively cached entries\r\n\r\ncache_neg_max_ttl = 600\r\n\r\n##################################\r\n# Local DoH server #\r\n##################################\r\n\r\n[local_doh]\r\n\r\n## dnscrypt-proxy can act as a local DoH server. By doing so, web browsers\r\n## requiring a direct connection to a DoH server in order to enable some\r\n## features will enable these, without bypassing your DNS proxy.\r\n\r\n## Addresses that the local DoH server should listen to\r\n\r\n# listen_addresses = ['127.0.0.1:3000']\r\n\r\n## Path of the DoH URL. This is not a file, but the part after the hostname\r\n## in the URL. By convention, `\/dns-query` is frequently chosen.\r\n## For each `listen_address` the complete URL to access the server will be:\r\n## `https:\/\/` (ex: `https:\/\/127.0.0.1\/dns-query`)\r\n\r\n# path = "\/dns-query"\r\n\r\n## Certificate file and key - Note that the certificate has to be trusted.\r\n## See the documentation (wiki) for more information.\r\n\r\n# cert_file = "localhost.pem"\r\n# cert_key_file = "localhost.pem"\r\n\r\n###############################\r\n# Query logging #\r\n###############################\r\n\r\n## Log client queries to a file\r\n\r\n[query_log]\r\n\r\n## Path to the query log file (absolute, or relative to the same directory as the config file)\r\n## On non-Windows systems, can be \/dev\/stdout to log to the standard output (also set log_files_max_size to 0)\r\n\r\n# file = 'query.log'\r\n\r\n## Query log format (currently supported: tsv and ltsv)\r\n\r\nformat = 'tsv'\r\n\r\n## Do not log these query types, to reduce verbosity. Keep empty to log everything.\r\n\r\n# ignored_qtypes = ['DNSKEY', 'NS']\r\n\r\n############################################\r\n# Suspicious queries logging #\r\n############################################\r\n\r\n## Log queries for nonexistent zones\r\n## These queries can reveal the presence of malware, broken\/obsolete applications,\r\n## and devices signaling their presence to 3rd parties.\r\n\r\n[nx_log]\r\n\r\n## Path to the query log file (absolute, or relative to the same directory as the config file)\r\n\r\n# file = 'nx.log'\r\n\r\n## Query log format (currently supported: tsv and ltsv)\r\n\r\nformat = 'tsv'\r\n\r\n######################################################\r\n# Pattern-based blocking (blacklists) #\r\n######################################################\r\n\r\n## Blacklists are made of one pattern per line. Example of valid patterns:\r\n##\r\n## example.com\r\n## =example.com\r\n## *sex*\r\n## ads.*\r\n## ads*.example.*\r\n## ads*.example[0-9]*.com\r\n##\r\n## Example blacklist files can be found at https:\/\/download.dnscrypt.info\/blacklists\/\r\n## A script to build blacklists from public feeds can be found in the\r\n## `utils\/generate-domains-blacklists` directory of the dnscrypt-proxy source code.\r\n\r\n[blacklist]\r\n\r\n## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)\r\n\r\n# blacklist_file = 'blacklist.txt'\r\n\r\n## Optional path to a file logging blocked queries\r\n\r\n# log_file = 'blocked.log'\r\n\r\n## Optional log format: tsv or ltsv (default: tsv)\r\n\r\n# log_format = 'tsv'\r\n\r\n###########################################################\r\n# Pattern-based IP blocking (IP blacklists) #\r\n###########################################################\r\n\r\n## IP blacklists are made of one pattern per line. Example of valid patterns:\r\n##\r\n## 127.*\r\n## fe80:abcd:*\r\n## 192.168.1.4\r\n\r\n[ip_blacklist]\r\n\r\n## Path to the file of blocking rules (absolute, or relative to the same directory as the config file)\r\n\r\n# blacklist_file = 'ip-blacklist.txt'\r\n\r\n## Optional path to a file logging blocked queries\r\n\r\n# log_file = 'ip-blocked.log'\r\n\r\n## Optional log format: tsv or ltsv (default: tsv)\r\n\r\n# log_format = 'tsv'\r\n\r\n######################################################\r\n# Pattern-based whitelisting (blacklists bypass) #\r\n######################################################\r\n\r\n## Whitelists support the same patterns as blacklists\r\n## If a name matches a whitelist entry, the corresponding session\r\n## will bypass names and IP filters.\r\n##\r\n## Time-based rules are also supported to make some websites only accessible at specific times of the day.\r\n\r\n[whitelist]\r\n\r\n## Path to the file of whitelisting rules (absolute, or relative to the same directory as the config file)\r\n\r\n# whitelist_file = 'whitelist.txt'\r\n\r\n## Optional path to a file logging whitelisted queries\r\n\r\n# log_file = 'whitelisted.log'\r\n\r\n## Optional log format: tsv or ltsv (default: tsv)\r\n\r\n# log_format = 'tsv'\r\n\r\n##########################################\r\n# Time access restrictions #\r\n##########################################\r\n\r\n## One or more weekly schedules can be defined here.\r\n## Patterns in the name-based blocklist can optionally be followed with @schedule_name\r\n## to apply the pattern 'schedule_name' only when it matches a time range of that schedule.\r\n##\r\n## For example, the following rule in a blacklist file:\r\n## *.youtube.* @time-to-sleep\r\n## would block access to YouTube during the times defined by the 'time-to-sleep' schedule.\r\n##\r\n## {after='21:00', before= '7:00'} matches 0:00-7:00 and 21:00-0:00\r\n## {after= '9:00', before='18:00'} matches 9:00-18:00\r\n\r\n[schedules]\r\n\r\n# [schedules.'time-to-sleep']\r\n# mon = [{after='21:00', before='7:00'}]\r\n# tue = [{after='21:00', before='7:00'}]\r\n# wed = [{after='21:00', before='7:00'}]\r\n# thu = [{after='21:00', before='7:00'}]\r\n# fri = [{after='23:00', before='7:00'}]\r\n# sat = [{after='23:00', before='7:00'}]\r\n# sun = [{after='21:00', before='7:00'}]\r\n\r\n# [schedules.'work']\r\n# mon = [{after='9:00', before='18:00'}]\r\n# tue = [{after='9:00', before='18:00'}]\r\n# wed = [{after='9:00', before='18:00'}]\r\n# thu = [{after='9:00', before='18:00'}]\r\n# fri = [{after='9:00', before='17:00'}]\r\n\r\n#########################\r\n# Servers #\r\n#########################\r\n\r\n## Remote lists of available servers\r\n## Multiple sources can be used simultaneously, but every source\r\n## requires a dedicated cache file.\r\n##\r\n## Refer to the documentation for URLs of public sources.\r\n##\r\n## A prefix can be prepended to server names in order to\r\n## avoid collisions if different sources share the same for\r\n## different servers. In that case, names listed in `server_names`\r\n## must include the prefixes.\r\n##\r\n## If the `urls` property is missing, cache files and valid signatures\r\n## must already be present. This doesn't prevent these cache files from\r\n## expiring after `refresh_delay` hours.\r\n\r\n[sources]\r\n\r\n## An example of a remote source from https:\/\/github.com\/DNSCrypt\/dnscrypt-resolvers\r\n\r\n[sources.'public-resolvers']\r\nurls = ['https:\/\/raw.githubusercontent.com\/DNSCrypt\/dnscrypt-resolvers\/master\/v2\/public-resolvers.md', 'https:\/\/download.dnscrypt.info\/resolvers-list\/v2\/public-resolvers.md']\r\ncache_file = '\/var\/cache\/dnscrypt-proxy\/public-resolvers.md'\r\nminisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'\r\nprefix = ''\r\n\r\n## Anonymized DNS relays\r\n\r\n[sources.'relays']\r\nurls = ['https:\/\/raw.githubusercontent.com\/DNSCrypt\/dnscrypt-resolvers\/master\/v2\/relays.md', 'https:\/\/download.dnscrypt.info\/resolvers-list\/v2\/relays.md']\r\ncache_file = '\/var\/cache\/dnscrypt-proxy\/relays.md'\r\nminisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'\r\nrefresh_delay = 72\r\nprefix = ''\r\n\r\n## Quad9 over DNSCrypt - https:\/\/quad9.net\/\r\n\r\n# [sources.quad9-resolvers]\r\n# urls = ['https:\/\/www.quad9.net\/quad9-resolvers.md']\r\n# minisign_key = 'RWQBphd2+f6eiAqBsvDZEBXBGHQBJfeG6G+wJPPKxCZMoEQYpmoysKUN'\r\n# cache_file = 'quad9-resolvers.md'\r\n# prefix = 'quad9-'\r\n\r\n## Another example source, with resolvers censoring some websites not appropriate for children\r\n## This is a subset of the `public-resolvers` list, so enabling both is useless\r\n\r\n# [sources.'parental-control']\r\n# urls = ['https:\/\/raw.githubusercontent.com\/DNSCrypt\/dnscrypt-resolvers\/master\/v2\/parental-control.md', 'https:\/\/download.dnscrypt.info\/resolvers-list\/v2\/parental-control.md']\r\n# cache_file = 'parental-control.md'\r\n# minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'\r\n\r\n#########################################\r\n# Servers with known bugs #\r\n#########################################\r\n\r\n[broken_implementations]\r\n\r\n# Cisco servers currently cannot handle queries larger than 1472 bytes, and don't\r\n# truncate reponses larger than questions as expected by the DNSCrypt protocol.\r\n# This prevents large responses from being received over UDP and over relays.\r\n#\r\n# The `dnsdist` server software drops client queries larger than 1500 bytes.\r\n# They are aware of it and are working on a fix.\r\n#\r\n# The list below enables workarounds to make non-relayed usage more reliable\r\n# until the servers are fixed.\r\n\r\nfragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri', 'cleanbrowsing-adult', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security']\r\n\r\n#################################################################\r\n# Certificate-based client authentication for DoH #\r\n#################################################################\r\n\r\n# Use a X509 certificate to authenticate yourself when connecting to DoH servers.\r\n# This is only useful if you are operating your own, private DoH server(s).\r\n# 'creds' maps servers to certificates, and supports multiple entries.\r\n# If you are not using the standard root CA, an optional "root_ca"\r\n# property set to the path to a root CRT file can be added to a server entry.\r\n\r\n[doh_client_x509_auth]\r\n\r\n#\r\n# creds = [\r\n# { server_name='myserver', client_cert='client.crt', client_key='client.key' }\r\n# ]\r\n\r\n################################\r\n# Anonymized DNS #\r\n################################\r\n\r\n[anonymized_dns]\r\n\r\n## Routes are indirect ways to reach DNSCrypt servers.\r\n##\r\n## A route maps a server name ("server_name") to one or more relays that will be\r\n## used to connect to that server.\r\n##\r\n## A relay can be specified as a DNS Stamp (either a relay stamp, or a\r\n## DNSCrypt stamp), an IP:port, a hostname:port, or a server name.\r\n##\r\n## The following example routes "example-server-1" via `anon-example-1` or `anon-example-2`,\r\n## and "example-server-2" via the relay whose relay DNS stamp\r\n## is "sdns:\/\/gRIxMzcuNzQuMjIzLjIzNDo0NDM".\r\n##\r\n## !!! THESE ARE JUST EXAMPLES !!!\r\n##\r\n## Review the list of available relays from the "relays.md" file, and, for each\r\n## server you want to use, define the relays you want connections to go through.\r\n##\r\n## Carefully choose relays and servers so that they are run by different entities.\r\n##\r\n## "server_name" can also be set to "*" to define a default route, but this is not\r\n## recommended. If you do so, keep "server_names" short and distinct from relays.\r\n\r\n# routes = [\r\n# { server_name='example-server-1', via=['anon-example-1', 'anon-example-2'] },\r\n# { server_name='example-server-2', via=['sdns:\/\/gRIxMzcuNzQuMjIzLjIzNDo0NDM'] }\r\n# ]\r\n\r\n# skip resolvers incompatible with anonymization instead of using them directly\r\n\r\nskip_incompatible = false\r\n\r\n###############################\r\n# DNS64 #\r\n###############################\r\n\r\n## DNS64 is a mechanism for synthesizing AAAA records from A records.\r\n## It is used with an IPv6\/IPv4 translator to enable client-server\r\n## communication between an IPv6-only client and an IPv4-only server,\r\n## without requiring any changes to either the IPv6 or the IPv4 node,\r\n## for the class of applications that work through NATs.\r\n##\r\n## There are two options to synthesize such records:\r\n## Option 1: Using a set of static IPv6 prefixes;\r\n## Option 2: By discovering the IPv6 prefix from DNS64-enabled resolver.\r\n##\r\n## If both options are configured - only static prefixes are used.\r\n## (Ref. RFC6147, RFC6052, RFC7050)\r\n##\r\n## Do not enable unless you know what DNS64 is and why you need it, or else\r\n## you won't be able to connect to anything at all.\r\n\r\n[dns64]\r\n\r\n## (Option 1) Static prefix(es) as Pref64::\/n CIDRs.\r\n# prefix = ["64:ff9b::\/96"]\r\n\r\n## (Option 2) DNS64-enabled resolver(s) to discover Pref64::\/n CIDRs.\r\n## These resolvers are used to query for Well-Known IPv4-only Name (WKN) "ipv4only.arpa." to discover only.\r\n## Set with your ISP's resolvers in case of custom prefixes (other than Well-Known Prefix 64:ff9b::\/96).\r\n## IMPORTANT: Default resolvers listed below support Well-Known Prefix 64:ff9b::\/96 only.\r\n# resolver = ["[2606:4700:4700::64]:53", "[2001:4860:4860::64]:53"]\r\n\r\n########################################\r\n# Static entries #\r\n########################################\r\n\r\n## Optional, local, static list of additional servers\r\n## Mostly useful for testing your own servers.\r\n\r\n[static]\r\n\r\n# [static.'myserver']\r\n# stamp = 'sdns:AQcAAAAAAAAAAAAQMi5kbnNjcnlwdC1jZXJ0Lg'\r\n<\/pre>\n<\/li>\n
  4. Stop and disable the systemd-resolved service<\/del>\n
    \r\n\r\n
    $ sudo systemctl stop systemd-resolved.service\r\n$ sudo systemctl disable systemd-resolved.service<\/pre>\n
    <\/del>\n<\/li>\n
  5. Create these files and ensure the permission are correct\n
    $ sudo touch \/var\/cache\/dnscrypt-proxy\/public-resolvers.md\r\n$ sudo touch \/var\/cache\/dnscrypt-proxy\/public-resolvers.md.minisig\r\n$ sudo touch \/var\/cache\/dnscrypt-proxy\/relays.md\r\n$ sudo touch \/var\/cache\/dnscrypt-proxy\/relays.md.minisig\r\n$ sudo chown _dnscrypt-proxy:nogroup \/var\/cache\/dnscrypt-proxy\/public-resolvers.md\r\n$ sudo chown _dnscrypt-proxy:nogroup \/var\/cache\/dnscrypt-proxy\/public-resolvers.md.minisig\r\n$ sudo chown _dnscrypt-proxy:nogroup \/var\/cache\/dnscrypt-proxy\/relays.md\r\n$ sudo chown _dnscrypt-proxy:nogroup \/var\/cache\/dnscrypt-proxy\/relays.md.minisig\r\n$ sudo chmod 644 \/var\/cache\/dnscrypt-proxy\/public-resolvers.md\r\n$ sudo chmod 644 \/var\/cache\/dnscrypt-proxy\/public-resolvers.md.minisig\r\n$ sudo chmod 644 \/var\/cache\/dnscrypt-proxy\/relays.md\r\n$ sudo chmod 644 \/var\/cache\/dnscrypt-proxy\/relays.md.minisig<\/pre>\n<\/li>\n
  6. Disable the DNSStub\n
    $ sudo nano \/etc\/systemd\/resolved.conf<\/pre>\n
    remove the comment and change below to no<\/strong><\/p>\n
    DNSStubListener=no<\/pre>\n<\/li>\n
  7. stop the dnscrypt-proxy socket service and change the IP\n
    $ sudo systemctl stop dnscrypt-proxy.socket\r\n$ sudo nano \/usr\/lib\/systemd\/system\/dnscrypt-proxy.socket<\/pre>\n
    Modify below option<\/p>\n
    ListenStream=127.0.0.1:53\r\nListenDatagram=127.0.0.1:53<\/pre>\n<\/li>\n
  8. Reboot the server\n
    $ sudo reboot<\/pre>\n<\/li>\n<\/ol>\n
    Check if everything works as intention<\/p>\n
      \n
    1. Check your configuration:\n
      $ dnscrypt-proxy -check -config \/etc\/dnscrypt-proxy\/dnscrypt-proxy.toml<\/pre>\n
      \"\"<\/li>\n
    2. Test resolve DNS with dnscrypt-proxy\n
      $ sudo dnscrypt-proxy -resolve reddit.com -config \/etc\/dnscrypt-proxy\/dnscrypt-proxy.toml<\/pre>\n
      \"\"<\/li>\n
    3. Dig from previous DNS
      \n\"\"
      \nto dnscrypt-proxy
      \n\"\"<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
      This will setup dnscrypt-proxy as the only DNS on Ubuntu Server. Change from DHCP to Static IP create a backup of \/etc\/netplan\/50-cloud-init.yaml $ sudo cp \/etc\/netplan\/50-cloud-init.yaml \/etc\/netplan\/50-cloud-init.yaml.bak and then copy below structure for static IP network: ethernets: eth0: dhcp4: no addresses: – 192.168.X.X\/25 routes: – to: default via: 192.168.X.X nameservers: addresses: [127.0.0.1,X.X.X.X,Y.Y.Y.Y] optional: true version: […]<\/p>\n","protected":false},"author":3,"featured_media":1371,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1,9,32],"tags":[45,49,48,84],"class_list":["post-2933","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-info","category-programming-database","category-tutorial","tag-dnscrypt-proxy","tag-pi","tag-raspberry-pi","tag-ubuntu-24-01"],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8pg5H-Lj","jetpack-related-posts":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/eligiblestore.com\/blog\/wp-content\/uploads\/2020\/08\/Screen-Shot-2020-08-25-at-16.51.32.png?fit=2848%2C1216&ssl=1","_links":{"self":[{"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/posts\/2933","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/comments?post=2933"}],"version-history":[{"count":15,"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/posts\/2933\/revisions"}],"predecessor-version":[{"id":2953,"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/posts\/2933\/revisions\/2953"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/media\/1371"}],"wp:attachment":[{"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/media?parent=2933"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/categories?post=2933"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eligiblestore.com\/blog\/wp-json\/wp\/v2\/tags?post=2933"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}