01.openwrt路由器安装dnscrypt-proxy解决dns污染

测试版本：18.06.1

安装

opkg update && opkg install luci-app-dnscrypt-proxy

配置

仅需luci操作，详见视频

测试

openwrt本机

dig @127.0.0.1 -p 5353 medium.com

; <<>> DiG 9.11.2-P1 <<>> @127.0.0.1 -p 5353 medium.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26072
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;medium.com.            IN  A

;; ANSWER SECTION:
medium.com.     150 IN  A   104.16.124.127
medium.com.     150 IN  A   104.16.122.127
medium.com.     150 IN  A   104.16.120.127
medium.com.     150 IN  A   104.16.123.127
medium.com.     150 IN  A   104.16.121.127

;; Query time: 32 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Wed Oct 10 22:20:49 CST 2018
;; MSG SIZE  rcvd: 119

使用

全局

详见视频

dnsmasq_gfwlist

对仅被墙的域名的dns查询进行代理，用以下命令。

# 安装dnsmasq-full
opkg update
opkg remove dnsmasq
opkg install dnsmasq-full

# 安装curl
opkg install ca-bundle curl
curl https://cokebar.github.io/gfwlist2dnsmasq/dnsmasq_gfwlist.conf -o /tmp/dnsmasq.d/dnsmasq_gfwlist_ipset.conf

# 重启dnsmasq即可
/etc/init.d/dnsmasq restart

可选操作

安装libustream-openssl

更新解析列表要安装libustream-openssl而不是libustream-ssl，luci上的提示不是十分准确！

opkg install libustream-openssl

监听地址改为0.0.0.0

在路由器下的终端要dig，地址是路由器的lan的ip，dnscrypt-proxy的监听地址要改为0.0.0.0

在下级客户端dig测试

dig @192.168.1.1 -p 5353 medium.com

; <<>> DiG 9.10.3-P4-Debian <<>> @192.168.1.1 -p 5353 medium.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11346
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;medium.com.            IN  A

;; ANSWER SECTION:
medium.com.     185 IN  A   104.16.124.127
medium.com.     185 IN  A   104.16.123.127
medium.com.     185 IN  A   104.16.120.127
medium.com.     185 IN  A   104.16.122.127
medium.com.     185 IN  A   104.16.121.127

;; Query time: 19 msec
;; SERVER: 192.168.1.1#5353(192.168.1.1)
;; WHEN: Wed Oct 10 22:48:51 CST 2018
;; MSG SIZE  rcvd: 119

注意

改成0.0.0.0后，如果用全局模式，DHCP/DNS的DNS 转发处依旧要写127.0.0.1#5353，不能是0.0.0.0，否则不能解析

dnsmasq all-servers

添加多个实例，监听在5353，5354，5355...
配置dnsmasq的--all-servers选项，同时向多个服务器查询，采用最快的查询结果。避免单个服务器不稳定或失效带来的问题。

--all-servers
By default, when dnsmasq has more than one upstream server available, it will send queries to just one server. Setting this flag forces dnsmasq to send all queries to all available servers. The reply from the server which answers first will be returned to the original requester.

luci配置DHCP/DNS-高级-所有服务器-打勾