DNSCrypt Install on Ubuntu 12.04

For Windows, DNSCrypt is a simple install from an executable file. For Linux, not so much. This guide is for installing DNSCrypt in Ubuntu 12.04 (x86_64). 

I found several instructions on how to get this software working properly with no single bullet proof method. I pieced together several parts from different instructions and came up with the most simple solution possible.

First off download the dnscrypt tarball from http://download.dnscrypt.org/dnscrypt-proxy/  I found version 1.3.0 to work better as I had some issues installing 1.3.1.

You will probably need the libsodium package too which can be downloaded here https://download.libsodium.org/libsodium/releases/  The latest version should work fine and this will be installed first.

I also recommend installing the build-essential packages in case you’re missing compilers.

apt-get install build-essential

Untar the libsodium package and install

tar -xvzf libsodium-0.4.2.tar.gz

cd libsodium-libsodium-0.4.2

sudo ./configure

make && make install

Do the same for the dnscrypt package

tar -xvzf dnscrypt-proxy-1.3.0.tar.gz

cd dnscrypt-proxy-1.3.0

sudo ./configure

make

make install

You will need to make some changes to your DNS settings in the Connection Manager. Open it and Edit Connections. Find your connection Wired/Wireless and go to the IPv4 settings tab. Change method to ‘Automatic (DHCP) addresses only‘ and enter the IP 127.0.0.2 in the DNS Servers box. In Ubuntu 12.04, a local DNS cache is running on 127.0.0.1 so .2 is required.

In a terminal, issue the command :

sudo dnscrypt-proxy -a 127.0.0.2 –edns-payload-size=4096 –pidfile=/run/dnscrypt-proxy.pid –user=dnscrypt

If successful, you should see something similar to the following. I’m using OpenDNS through my router so the 208.67.220.220 DNS server shows up.

[INFO] Generating a new key pair
[INFO] Done
[INFO] Server certificate #1234567890 received
[INFO] This certificate looks valid
[INFO] Server key fingerprint is ……….
[INFO] Proxying from 127.0.0.2:53 to 208.67.220.220:443

A simple tcpdump will tell you if everything is working properly. If DNS requests are going over 443 with encrypted UDP packets, everything should be working, if its still using 53 and you can see the hosts being queried, somethings wrong.

‘tcpdump -i eth0 port 443’

Output should be similar to this….

20:22:02.070686 IP ubuntu.local.40117 > resolver2.opendns.com.https: UDP, length 324

E..`: ..@..G
….C…….L..q6fnvWjB…….OY…e..+.1.-P..v’.p.$2d..>Tx7[….hV…-..[/Q.~<.=…..@.Tp.d!!..>$j…’…1….?.
..U…b>.<…w…y…h…RC….=lt>n.BT…&..
.c..I.T”…m5._|.C..0.U.GA…..$V..2…T&.U…..o…0HO.{..K.L.%.G…K.’……    .}.!…..$.Ex….S.geN……….a.T….0..L..n..\..4..,..H4.~z…..!..6xu..-.i…U..+z…….;.”.n..

Advertisements