/etc/init.d/dnscrypt-proxy example

[dimberr]

Hi,
I'm running dnscrypt-proxy 2.1.5 on openwrt (not from the package).
To enable dnscrypt-proxy as a service, I have this in /etc/init.d/dnscrypt-proxy file https://github.com/openwrt/packages/blob/openwrt-22.03/net/dnscrypt-proxy2/files/dnscrypt-proxy.init

The problem is that when something (service/configuration) is restarted/reloaded (not sure what exactly happens), dnscrypt-proxy should be restarted also. I'm checking resolving dns with https://dnscheck.tools

There are no additional packages, and the config is pretty standard. I can share it if needed. How can I debug it further?

[lifenjoiner]

The problem is that when something (service/configuration) is restarted/reloaded (not sure what exactly happens), dnscrypt-proxy should be restarted also.

Don't get it. Explain more.

[dimberr]

i'm using nextdns as my dns resolver. Configured it in dnscrypt-proxy.toml as static entry.
Once in one or two days I see (in https://dnscheck.tools/) that my resolver is not ptr: dns.nextdns.io for both ipv4 and ipv6, but something like ns: pri.authdns.ripe.net. Until I do dnscrypt service reload as service, it remains the same.

my /etc/config/dhcp
dhcp.txt

I suppose it happens after some network, interface or some default service restart, but dnscrypt proxy is not restarted. I ended up using this /etc/init.d/dnscrypt-proxy:
dnscrypt-proxy-service.txt
But also I would expect that if I block other dns resolvers (or not configured it) I wouldn't have internet access.

[lifenjoiner]

What does ./dnscrypt-proxy -resolve example.com say?

[dimberr]

great, now it is reproduced, so I can run any command and show any config :)
No idea, what is wrong in config, but if I do dnscrypt-proxy restart, it will take the correct one resolver (dns.nextdns.io)

root@OpenWrt:~# dnscrypt-proxy -resolve example.com --config /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
Resolving [example.com] using 127.0.0.53 port 53

Resolver : 185.229.226.28
Lying : no
DNSSEC : yes, the resolver supports DNSSEC
ECS : ignored or selective

Canonical name: example.com.

IPv4 addresses: 93.184.216.34
IPv6 addresses: 2606:2800:220:1:248:1893:25c8:1946

Name servers : b.iana-servers.net., a.iana-servers.net.
DNSSEC signed : yes
Mail servers : 1 mail servers found

HTTPS alias : -
HTTPS info : -

Host info : -
TXT records : v=spf1 -all, wgyf8z8cgvm2qmxpnbnldrcltvk4xqfn

[lifenjoiner]

root@OpenWrt:~# dnscrypt-proxy -resolve example.com --config /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
Resolving [example.com] using 127.0.0.53 port 53

Resolver : 185.229.226.28
Lying : no

Showed dnscrypt-proxy is working, with 1 server specified.

The website showed the same DNS resolver. The query from the device you used visiting the website most likely goes through dnscrypt-proxy on the OpenWrt device.

The two go through the same route. It will be good.

Could 185.229.226.28 be one IP of the most top recursive DNS of NextDNS? Or, is it the IP of the DNS from your ISP by DHCP?

BTW:
Try other servers.

[lifenjoiner]

It is very likely that 185.229.226.28 is one IP of the most top recursive DNS of NextDNS.

[dimberr]

Seems like it is. Not sure why, buy that specific ip also doesn't support ipv6.
Thanks again, closing this 🙏