Help with dnscrypt-proxy

[linuxuser1]

I installed dnscrypt-proxy in the fedora 42 template. Do I need to change dns in the template so that appvms retain the changes? Or do I need to run dnscrypt-proxy in the appvms? If latter, please help me how to do it. I understand that I need to edit sudo nano /rw/config/rc.local

If I need to change dns in template, do I just need to disable systemd-resolver and add the address 127.0.2.1 to resolv.conf?

[linuxuser1]

I thought I should add this to sudo nano /rw/config/rc.local

systemctl stop systemd-resolved
systemctl disable systemd-resolved
echo "nameserver 127.0.2.1"  | tee /etc/resolv.conf
systemctl restart dnscrypt-proxy

but it didn’t work

[Tezeria]

Look at this tutorial of @qubist :

[guide] how-to setup a sys-dns qube

The firewall documentation says: “Qubes does not support running any networking services (e.g. VPN, local DNS server, IPS, …) directly in a qube that is used to run the Qubes firewall service (usually sys-firewall) for good reasons. In particular, if you want to ensure proper functioning of the Qubes firewall, you should not tinker with iptables or nftables rules in such qubes.” which sounds confusing because: sys-firewall is not a service, it is a VM the “good reasons” have not been expli…

And this one to configure sys-dns and sys-wall to change nftable instead of iptable:

[guide] how-to setup a sys-dns qube

I converted @qubist’s iptables rules to support Qubes 4.2 nftables. I did some quick tests and it seems to work, tell me if something is not working properly. sys-dns sys-wall

It’s what i use

[linuxuser1]

Hi, Tezeria!
Will it work for fedora 42? What fedora version do you have now?

[Tezeria]

I’m still on fedora 41 so I can’t tell you.

[linuxuser1]

Okay. Thank you I will try it tomorrow on fedora 42 and write result.
@qubist are you using fedora 42 for dnscrypt-proxy right now or fedora 41 too?

[qubist]

@qubist are you using fedora 42 for dnscrypt-proxy right now or fedora 41 too?

I have stopped using Fedora templates a fairly long time ago. I use only Debian now. I am not using DNSCrypt currently. I have been preparing a guide for Debian (using a better approach) but unfortunately I am overwhelmed with all kinds of problems, so I am still not ready with it. I hope you have the patience.

@Tezeria - glad to see you around!

[Tezeria]

@qubist

I hope you have the patience.

For sure

@qubist

I am not using DNSCrypt currently

Do you use something else?

[linuxuser1]

Of course! Your guides and tools are really awesome! Thank you for your work for the Qubes community!

[Tezeria]

So it work with fedora-minimal-42 ?

[linuxuser1]

I haven’t done it yet. I was busy setting up the second sys-vpn, then I tested dom0-live in btrfs. Now I’m waiting for qubist post about dnscrypt-proxy. For now, I’ve only added dns-over-tls to some appVms

/rw/config/rc.local

systemd-resolve --set-dns=9.9.9.9 --set-dnsovertls=yes --interface=eth0
ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
systemctl restart systemd-resolved

[qubist]

Do you use something else?

https://dns.watch/ for the small amount of clearnet. However, I dare to say their “Optimized for maximum speed” boasting is far from true, at least for me

[Tezeria]

@qubist

https://dns.watch/ for the small amount of clearnet. However, I dare to say their “Optimized for maximum speed” boasting is far from true, at least for me

Ok, so i’ll stay with dsncrypt! lol