Centos7 under Dnscrypt-proxy Installation

DNS hijacking refers to "some firewalls" that intercept DNS resolution requests and return incorrect DNS information to the host; DNS pollution refers to "some firewalls" that send incorrect domain name information to a common DNS server (such as 114). In this way, the user will get the wrong IP information when the DNS query is made. For these two problems, it can be resolved by building a TCP-based and encrypted DNS proxy server.

1. Install the dependent package Libsodium

wgetHttps//download.libsodium.org/libsodium/releases/libsodium-1.0.10.tar.gzTar-xvzf libsodium-1.0.Ten.Tar. GZ CD Libsodium-1.0.Ten/CFLAGS="-o3-fpic"./Configure Make&& Make InstallEcho/usr/local/lib >/etc/LD. so.conf.d/usr_local_lib.confsudoLdconfig

2, Installation Dnscrypt-proxy

wgetHttps//download.dnscrypt.org/dnscrypt-proxy/dnscrypt-proxy-1.7.0.tar.gzTar-xvzf dnscrypt-proxy-1.7.0.Tar. GZ CD Dnscrypt-proxy-1.7.0/src/libevent-modified/CFLAGS="-o3-fpic"./Configure Make&& Make InstallCD../..Echo/usr/local/lib >/etc/LD. so.conf.d/usr_local_lib.confsudoLdconfig./Configure Make-j2&& Make Install

3. Run and join the boot boot

[Email protected] ~]#/usr/local/sbin/dnscrypt-proxy-r Yandex  --local-address=0.0.  0.0 -~]#  vi /etc/rc.d/rc.local# Add the following line /usr/local/sbin/dnscrypt-proxy-r Yandex  --local-address=0.0.  0.0 -~]#  chmod +x/etc/rc.d/rc.local

A public DNS that already supports Dnscrypt queries is stored in the/usr/local/share/dnscrypt-proxy/dnscrypt-resolvers.csv, "-R Yandex" in the top expression Represents the name of the first column in this document.

4. Verification

From the following results can be seen, in the resolution facebook.com this URL, the local dnscrypt-proxy can parse the correct, and 114 and 8.8 is resolved by the wall has been tampered with the IP.

[Email protected] ~]# dig facebook.com + Short@114.114.114.11493.46.8.89[[Email protected]~]# Dig facebook.com + Short@8.8.8.893.46.8.89[[Email protected]~]# Dig facebook.com + Short@8.8.8.878.16.49.15[[Email protected]~]# Dig facebook.com + Short@127.0.0.1157.240.3.35[[Email protected]~]# Dig facebook.com + Short@127.0.0.1157.240.3.35

If you want to use this DNS proxy, you only need to configure the DNS server of the system as the server (the server needs to open the udp:53 port). Of course, the above only resolves the problem of DNS resolution, "some firewalls" and other mechanisms such as IP blocking to filter the corresponding website.

Centos7 under Dnscrypt-proxy Installation