Skip to main content

OpenWRT DNS with TLS

在不使用 AdGuardHome 的情况下，想要轻量化的使用 DoT，可以使用自带的 Dnsmasq + Stubby 方案。

Stubby​

Stubby 是专门做 DNS over TLS 的转发器, 非常轻量好用。

apk update
apk add stubby ca-certificates
# 编辑 Stubby 配置
vi /etc/config/stubby

config stubby 'global'
       option manual '0'
       option trigger 'wan'
       # option triggerdelay '2'
       list dns_transport 'GETDNS_TRANSPORT_TLS'
       option tls_authentication '1'
       option tls_query_padding_blocksize '128'
       # option tls_connection_retries '2'
       # option tls_backoff_time '3600'
       # option timeout '5000'
       # option dnssec_return_status '0'
       option appdata_dir '/var/lib/stubby'
       # option trust_anchors_backoff_time 2500
       # option dnssec_trust_anchors '/var/lib/stubby/getdns-root.key'
       option edns_client_subnet_private '1'
       option idle_timeout '9000'
       option round_robin_upstreams '1'
       list listen_address '127.0.0.1@5453'
       list listen_address '0::1@5453'
       # option log_level '7'
       # option command_line_arguments ''
       # option tls_cipher_list 'EECDH+AESGCM:EECDH+CHACHA20'
       # option tls_ciphersuites 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256'
       # option tls_min_version '1.2'
       # option tls_max_version '1.3'

# Upstream resolvers are specified using 'resolver' sections.
# Extensive list of public DoT servers can be found in upstream stubby sources
#  https://github.com/getdnsapi/stubby/blob/develop/stubby.yml.example
config resolver
       # Dnspod（tencent）
       option address '1.12.12.12 '
       option tls_auth_name 'dot.pub'
       # option tls_port 853

config resolver
       # Cloudflare（这个要慢的多，仅供 fallback）
       option address '1.1.1.1'
       option tls_auth_name 'cloudflare-dns.com'
       # option tls_port 853
       # list spki 'sha256/yioEpqeR4WtDwE9YxNVnCEkTxIjx6EEIwFSQW+lJsbc='
       # option tls_cipher_list 'EECDH+AESGCM:EECDH+CHACHA20'
       # option tls_ciphersuites 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256'
       # option tls_min_version '1.2'
       # option tls_max_version '1.3'

Dnsmasq​

修改上游 Dns 到本地的 Stubby

vi /etc/config/dhcp

config dnsmasq
    list server '127.0.0.1#5453'

也可以直接从界面上做调整：

  • 转发 -> DNS 转发：127.0.0.1#5453
  • 限制 -> 最大并发查询数: 100
  • 限制 -> DNS 查询缓存的大小: 8000
  • 限制 -> 最小缓存 TTL: 43200 (12h)
  • 限制 -> 最大缓存 TTL: 86400 (24h)

查询缓存大小​

kill -s SIGUSR1 `pidof dnsmasq` && logread | grep -i "cache size"