Bootstrap can't launch DoH. #3108
Replies: 7 comments 46 replies
-
I don't get it. DNS requires internet connectivity to work. So, internet connectivity can't depend on DNS "already working". If you are behind some kind of captive portal, you can add the names and IP addresses they should resolve to to the |
Beta Was this translation helpful? Give feedback.
-
|
I'm on normal home internet. I enter the DNS address of my Pi hole and dnscrypt device into the modem as dns. If I delete all dns servers from everywhere and only get used to dnscrypt and it forces doh, I won't have internet, the software needs to download the doh list at first or Doh itself needs to download its own servers. I have to write normal dns at first, can I do something about it? What does Bootstrap Resolvers do? |
Beta Was this translation helpful? Give feedback.
-
|
For what purpose do you use it and how? |
Beta Was this translation helpful? Give feedback.
-
|
Cloudflare resolvers already use static IP addresses, so your actual problem is probably unrelated to bootstrap resolvers. You probably also already tried using DNSCrypt servers instead.
What is "it" and what is blocked? Does the router need to phone home when it starts in order to check for internet connectivity? In that case you can try to enable logging in |
Beta Was this translation helpful? Give feedback.
-
|
I tried it with the default settings, and now I tried it with this one. https://github.com/mapi68/dnscrypt-proxy-pihole |
Beta Was this translation helpful? Give feedback.
-
|
I'm sorry, I'm not familiar with that router. |
Beta Was this translation helpful? Give feedback.
-
|
@jedisct1 Can you install it with Anydesk, let's talk about it on discord? |
Beta Was this translation helpful? Give feedback.
-
|
I can't, sorry. |
Beta Was this translation helpful? Give feedback.
-
|
I also tested this behavior on my modem. Initially, DoH did not work, but after some time it started working. When I checked the logs, I saw that the DNS resolver was discovered recursively. (I don't know how accessed it, maybe queried it with the isp dns, maybe asked the root servers.) The main issue with DNSCrypt Proxy not working is that it fails to resolve the DoH endpoint https://cloudflare-dns.com/dns-query. This raises a fundamental problem: a URL-based DoH request cannot be made without first resolving the domain via DNS. If DoH is not available or fails, the system is expected to fall back to plain DNS. However, this fallback does not occur, which causes DNS resolution to fail entirely. |
Beta Was this translation helpful? Give feedback.
-
|
This is not expected, since Cloudflare's stamps include the IP addresses to connect to. And you said you initially tried in the default configuration, which includes DNSCrypt. And that protocol doesn't use host names at all. So your issue is likely something else. You should still have a valid resolver configured as the bootstrap resolver, regardless. |
Beta Was this translation helpful? Give feedback.
-
|
Could it be because the package manager installed the old version? |
Beta Was this translation helpful? Give feedback.
-
|
@jedisct1 i also suggest that the proxy can use cloack rules before anything else to try and connect to stamp servers. |
Beta Was this translation helpful? Give feedback.
-
|
How do I set it up in the simplest way? |
Beta Was this translation helpful? Give feedback.
-
|
orangepizero3: ; <<>> DiG 9.18.39-0ubuntu0.24.04.2-Ubuntu <<>> dnssec-failed.org @127.0.0.1 -p 53533 Feb 10 16:00:14 orangepizero3 systemd[1]: dnscrypt-prox> |
Beta Was this translation helpful? Give feedback.
-
|
what is the config file? |
Beta Was this translation helpful? Give feedback.
-
|
################################# Global settings################################# ########################### DNS cache########################### ##################### Log##################### [query_log] [nx_log] ############################################# Public Resolvers and Relays############################################# [sources.public-resolvers] [sources.relays] |
Beta Was this translation helpful? Give feedback.
-
|
try server_names = ['dnscry.pt-istanbul-ipv4'] |
Beta Was this translation helpful? Give feedback.
-
|
Same. |
Beta Was this translation helpful? Give feedback.
-
|
Try this and show me the log file if it fails. |
Beta Was this translation helpful? Give feedback.
-
|
Ok. But come to discord. |
Beta Was this translation helpful? Give feedback.
-
|
I send. |
Beta Was this translation helpful? Give feedback.
-
|
I think it will work now. |
Beta Was this translation helpful? Give feedback.
-
|
Didn't work again. Modem log. |
Beta Was this translation helpful? Give feedback.
-
|
Configure DNS 192.169.1.2 on DHCP addresses, router has Network Loop Detection enabled and it won't connect to 192.168.x on start up, you can only change the setting when running. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I am configuring DNSCrypt Proxy with Pi-hole to use Doh.
I understand that a bootstrap resolver is required to initially resolve the DoH endpoint.
However, in my setup the modem/router cannot access the internet unless DNS is already working, which creates a chicken-and-egg problem:
DNSCrypt Proxy needs a bootstrap resolver to reach the DoH server
But without DNSCrypt Proxy working, the modem/system cannot resolve anything or access the internet
As a result, DoH does not work at all in my environment.
Pi-hole is running behind DNSCrypt Proxy
DoH server is manually configured
I know bootstrap resolvers are required, but I cannot make it work due to the lack of initial internet/DNS access
My question:
How should bootstrap resolvers be configured in this situation?
What is the correct way to handle DoH + DNSCrypt Proxy when the modem/router cannot reach the internet before DNS is available?
Beta Was this translation helpful? Give feedback.
All reactions