How to install DNSCrypt and Unbound in Arch Linux

How to install DNSCrypt and Unbound in Arch Linux

DNSCrypt is a protocol used to encrypt and verify the communication between the DNS client and the DNS parser. It can prevent DNS Spoofing or man-in-the-middle attacks. DNSCrypt can be used in most operating systems, including Linux, Windows, MacOSX, Android, and iOS. In this tutorial, archlinux with 4.1 kernel is used.

Unbound is a DNS cache server used to resolve any DNS queries received. If a user requests a new query, unbound will store it in the cache, and when the user requests the same request again, unbound will use the saved cache. This will be faster than the first request query.

Now I will try to install "DNSCrypt" to ensure the security of DNS communication and use "Unbound" to accelerate.

 

Step 1-install yaourt

Yaourt is one of the auxiliary tools for AUR (ARCH user repository). It allows users to easily install programs from AUR. Yaourt and pacman use the same syntax. You can use yaourt to install the program. The following is a simple method to install yaourt:

1. Use nano or vi to edit the arch repository configuration file and store it in "/etc/pacman. conf.

1. $ nano/etc/pacman.conf

2. Add the following script at the bottom of the yaourt Repository:

1. [archlinuxfr]
2. SigLevel=Never
3. Server= http://repo.archlinux.fr/$arch

3. Use "Ctrl + x" and save it with "Y.

4. Upgrade the repository database and install yaourt with pacman:

1. $ sudo pacman -Sy yaourt

 

Step 2-install DNSCrypt and Unbound

DNSCrypt and unbound are in the archlinux repository. you can install them using the following pacman command:

1. $ sudo pacman -S dnscrypt-proxy unbound

Then, press "Y" during the installation process ".

 

Step 3-install dnscrypt-autoinstall

Dnscrypt-autoinstall is a script that automatically installs and configures DNSCrypt on a Linux-based system. DNSCrypt is in AUR, so you must use the "yaourt" command to install it.

1. $ yaourt -S dnscrypt-autoinstall

Note:

-S = This is the same as the pacman-S installer.

 

Step 4-run dnscrypt-autoinstall

Run "dnscrypt-autoinstall" with the root permission to automatically configure DNSCrypt.

1. $ sudo dnscrypt-autoinstall

In the next step, press "enter" and enter "Y" to select the DNS provider you want to use. Here I use DNSCrypt. eu without logs and DNSSEC.

DNSCrypt autoinstall

 

Step 5-configure DNSCrypt and Unbound

1. Open "/etc/conf. d/dnscrypt-config" in dnscrypt, and confirm "DNSCRYPT" in the configuration file.LOCALIP points to the local ip address, DNSCRYPTLOCALPORT "is configured according to your own wishes. I use port 40.

1. $ nano/etc/conf.d/dnscrypt-config
2. DNSCRYPT_LOCALIP=127.0.0.1
3. DNSCRYPT_LOCALIP2=127.0.0.2
4. DNSCRYPT_LOCALPORT=40

DNSCrypt Configuration

Save and exit.

2. Now you can use the nano editor to edit the unbound configuration file under "/etc/unbound:

1. $ nano/etc/unbound/unbound.conf

3. Add the following lines at the end of the script:

1. do-not-query-localhost:no
2. forward-zone:
3. name:"."
4. forward-addr:127.0.0.1@40

Make sure that "DNSCRYPT_LOCALPORT" in forward-addr and DNSCrypt are consistent. As you can see, port 40 is used.

Unbound Configuration

Save and exit.

 

Step 6: Run DNSCrypt and Unbound, and then add it to startup

Run DNSCrypt and unbound with the root permission. You can run the following systemctl command:

1. $ sudosystemctl start dnscrypt-proxy unbound

Add the service to startup. You can run "systemctl enable ":

$ sudo systemctl enable dnscrypt-proxy unbound

The command will create a service soft link to the "/usr/lib/systemd/system/" directory.

 

Step 7-configure resolv. conf and restart all services

Resolv. conf is a file used to configure the DNS parser in linux. It is a plain text created by the Administrator. Therefore, you must use the root permission to edit it and prevent it from being modified by others.

Edit in nano Editor:

1. $ nano/etc/resolv.conf

Add the local IP Address "127.0.0.1 ". Now use the "chattr" command to make him read-only:

1. $ chattr+i /etc/resolv.conf

Note:

If you want to edit it again, use "chattr-I/etc/resolv. conf" to add the write permission.

Now you need to restart DNSCrypt, unbound, and network;

1. $ sudosystemctl restart dnscrypt-proxy unbound netctl

If you see an error, check the configuration file.

 

Test

1. Test DNSCrypt

You can confirm DNSCrypt through https://dnsleaktest.com/, click "Standard Test" or "extended test", and wait until the program ends.

Now you can see that DNSCrypt. eu has been working with DNSCrypt, a DNS provider.

Testing DNSCrypt

2. Test Unbound

Now you should make sure that unbound works properly with the "dig" and "drill" commands.

This is the result of the dig command:

1. $ dig linoxide.com

Now let's take a look at the result. "Query time" is "533 msec ":

1. ;;Querytime:533 msec
2. ;; SERVER:127.0.0.1#53(127.0.0.1)
3. ;; WHEN:SunAug3014:48:19 WIB 2015
4. ;; MSG SIZE rcvd:188

Enter the command again and we can see that "Query time" is "0 msec ".

1. ;;Querytime:0 msec
2. ;; SERVER:127.0.0.1#53(127.0.0.1)
3. ;; WHEN:SunAug3014:51:05 WIB 2015
4. ;; MSG SIZE rcvd:188

Unbound Test

DNSCrypt encrypts the communication between the DNS client and the DNS client, and Unbound caches the same request to make it faster in another request.

 

Summary

DNSCrypt is a protocol that encrypts data streams between the DNS client and the DNS parser. DNSCrypt can run on different operating systems, either mobile or desktop. Selecting a DNS provider also includes some important things. You should select those that provide DNSSEC without logs at the same time. Unbound can be used as a DNS cache to speed up the resolution process, because Unbound caches the request. When the client requests the same query, unbound retrieves the saved value from the cache. DNSCrypt and Unbound are powerful combinations of security and speed.

Via: http://linoxide.com/tools/install-dnscrypt-unbound-archlinux/

Author: Arul Translator: geekpi Proofreader: wxy

This article was originally compiled by LCTT and launched with the honor of Linux in China

This article permanently updates the link address: