DNSCrypt for Mageia

DNSCrypt is a network protocol that authenticates and encrypts Domain Name System (DNS) traffic between the user's computer and recursive name servers, with support for modern encrypted DNS protocols such as DNSCrypt v2, DNS-over-HTTPS, Anonymized DNSCrypt and ODoH (Oblivious DoH). (SOURCE: https://github.com/DNSCrypt/dnscrypt-proxy)

Prebuilt and up-to-date binaries are available for Linux, Mac, Windows and other operating systems.

Download the Linux x86_64 version here. Follow installation instructions here.

Alternatively -- and the best choice for Mageiam, IMHO -- you can download the x86_64 version of dnscrypt-proxy from OpenMandriva here .

The OpenMandriva-sourced package will install, but show an error that can be safely ignored. This package is superior to that provided with Mageia and is the most current version of the application, but you will need to block the update of the package to the Mageia version by adding its name to /etc/urpmi/skip.list. Follow the example there. If you are using DNF, it's a little more work. You must install a plugin name versionlock.

# dnf install dnf-plugin-versionlock

then you can add the package to not be replaced or updated.

# dnf versionlock dnscrypt-proxy

FILE LOCATIONS

Configuration files are found in /etc/dnscrypt-proxy and are well commented. The default port is 53. We will change it to 553.

The binary is found at /usr/bin/dnscrypt-proxy.

Documentation and example files are found at /usr/share/dnscrypt-proxy.

Configuration for using systemd and blocklists is found at the excellent ArchLinux Wiki here. You'll need to use these instructions after installing the Open Mandriva RPM file.

Create a service to download & combine filter lists, kept in /etc/systemd/system/dnscrypt-filterlist-update.service:

[Unit]

Description=DNSCrypt Filterlist Update

[Service]

Type=oneshot

User=root

WorkingDirectory=/usr/share/dnscrypt-proxy/utils/generate-domains-blocklist/

ExecStart=generate-domains-blocklist -a domains-allowlist.txt -o blocklist.txt ; sleep 2 ; systemctl restart dnscrypt-proxy.service

[Install]

WantedBy=multi-user.target

Create a time to run on boot but also every 24 hours. /etc/systemd/system/dnscrypt-filterlist-update.timer:

[Unit]

Description=Run 15min after boot and every 5 hours (DNSCrypt Filterlist Update)

[Timer]

OnBootSec=15min

OnUnitActiveSec=24h

[Install]

WantedBy=timers.target

Enable the timer:

# systemctl daemon-reload

# systemctl enable dnscrypt-filterlist-update.timer

Configure DNSCrypt to apply the created filter rules. /etc/dnscrypt-proxy/dnscrypt-proxy.toml:

blocked_names_file = '/usr/share/dnscrypt-proxy/utils/generate-domains-blocklist/blocklist.txt'

log_file = '/var/log/dnscrypt-proxy/blocked-names.log'

Edit /etc/resolv.conf on the server to read to read:

nameserver ::1

nameserver 127.0.0.1

options edns0

If the content of /etc/resolv.conf doesn't stick, edit it then type the following command (in a root console) to make it im mutable:

chattr +i /etc/resolv.conf

To unlock it:

chattr -i /etc/resolv.conf

Is It Working?

To check if dnscrypt-proxy is working, open a web browser and head to DnsLeakTest.com and select "extended test". If the results show servers that you have set in the configuration files it means that dnscrypt-proxy is working, otherwise something is wrong.