ACT Fibernet and OPENDNS

[warpspeed]

@Jay Which DNSCrypt client are you using? I'm also using OpenDNS but with DNSCrypt. My windows client uses the 443 TLS port so ISP can't block it without breaking the internet. You can use wireshark to capture your NIC and see whats happening when you resolve a domain.

 

[Jay]

I'm using the OSX Dnscrypt standalone client. Not sure what's happening. Wireshark shows a lot of stuff and I can't make much sense of it. When dnscrypt is running, wireshark shows dns queries being sent via port 53 (if I'm reading that correctly) but not getting any response.

I switched to Windows and used the simplednscrypt client with opendns and it worked for a little while, but then stopped resolving altogether.

 

[warpspeed]

Once you start capturing the NIC in wireshark, you can filter the DNS queries by using the QUIC keyword:

The destination port should be 443. If It is 53 and the packets aren't using QUIC protocol then DNSCrypt is not being used to resolve any queries. Please make sure to enable the DNSCrypt service in the client and the DNS field for your adapter should contain 127.0.0.1 as primary.

 

[Jay]

The client in both Mac and Windows automatically populates the DNS field in the network settings. For the mac it shows 127.0.0.54 and for windows its 127.0.0.1. The Mac client proved useless. There is no QUIC anywhere and like before the destination port is 53 and not resolving.


Windows first gave me this, with the dns not resolving

I tinkered around in the settings and switched 443 to tcp from udp and now it works. Shouldn't it work over udp?

I have to figure out how to get the mac client working. the Windows clients have a lot more options.

 

[warpspeed]

It should work but looking your capture, ACT might be blocking UDP packets over port 443. That could be the reason it failed to work previously.

 

[George nathan]

Since you're already using OpenDNS, why don't you give Cisco's DNSCrypt a try? It basically encrypts your DNS lookup so ACT can't block your queries in future.

Link - DNS Security with DNSCrypt | OpenDNS

DNScrypt tool - Simple DNSCrypt - Official Project Home Page

Hi Manoj,

I tried using Simple DNS crypt, but always loose my connection.
I have a public IP with all open ports located in Hyderabad.
Can you please provide a guidance on how i can successfully use OpenDNS instead of ACT's DNS.
Is there an option to change the port to something else other than 443?

Regards,
George.

 

---

[warpspeed]

Hi George, I don't use Simple DNSCrypt anymore. I have moved on to DNSCrypt 2 and Cloudflare DNS over TLS because I get 1ms ping to cloudflare servers. It is command line only, very stable than Simple DNSCrypt and working perfectly fine for the last few months. I don't think Cisco or any other provider offering DNSCrypt over alternate ports.

Link - jedisct1/dnscrypt-proxy

Download the latest binaries for Windows. Rename the example-dnscrypt-proxy to dnscrypt-proxy and edit the file to your needs.

Mine looks like this:

Save it and run service-install bat file. Configure your DNS to 127.0.0.1 and that's it. Use DNS leak test to check if its working or not.

If you run your PC 24x7 then you can also use DNSCrypt 2 to resolve queries for others in local network. Just change the DNS settings in your router to DNSCrypt PC's IP

 

[George nathan]

Awesome manoj.. i got it working fine.. Thank you for the support!
Looking forward for setting up a Pfsense router now..
Great job man

 

[haridsv]

I recently signed up for ACT and realized that they assign a private IP address and so having trouble getting OpenDNS to setup. Initially, I tried to add the public IP manually on OpenDNS and got an error that the network is already existing, which means that the public IP was added by another user to their account. After a few days I attempted to setup again and this time the public IP was different IP and it got added to my account. I could configure the filter level and after a few minutes I could test that it is working. However, I am concerned that the public IP would change silently again and then I may lose the ability to control the filtering.

I guess one solution is to pay Rs.250 per month extra to get a static IP assigned (which seems to be in the 124.xxx range) but before I go that route, I would like to make sure there isn't something I missed here. Will using PPPoE instead of DHCP help somehow?

 

[powerwatts]

That 250 per month for a static IP is such a rip-off from ACT I think