Quad9 TLS Support

Ahh... the joys of GL.iNet firmware not being in version sync across devices. I won't miss it if it were to ever leave.

It's probably for the best your conf wasn't. The GL.iNet stock conf leaves a bit to be desired to properly tighten up security, privacy:

cat <<- '__EOF' >> /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
	# edit your existing `.toml` to properly enable these security settings
	# in their respective sections or dnscrypt-proxy won't start
	user_name = 'nobody'
	dnscrypt_servers = false
	odoh_servers = true
	require_dnssec = true
	require_nolog = true
	require_nofilter = false
	disabled_server_names = [ 'quad9-doh-ip4-port443-nofilter-pri', 'quad9-doh-ip4-port443-nofilter-alt', 'quad9-doh-ip4-port443-nofilter-ecs-pri', 'quad9-doh-ip4-port443-nofilter-ecs-alt', 'quad9-doh-ip4-port443-filter-ecs-pri', 'quad9-doh-ip4-port443-filter-ecs-alt' ]
	dnscrypt_ephemeral_keys = true
	tls_disable_session_tickets = true
	bootstrap_resolvers = ['1.1.1.1:53', '1.0.0.1:53']

__EOF

Then

chown -R nobody:nogroup /etc/dnscrypt-proxy2/
/etc/init.d/dnscrypt-proxy restart

As all things in life, YMMV.

2 Likes