return:DROp for local domain forwarder

[BallonLac]

Hi!

Happy user of Simple DnsCrypt for years now, I'm trying to migrate to an always-on Pi Zero (Raspberry Pi OS "bullseye").

I installed the package from regular Raspbian repo:

Details

Package: dnscrypt-proxy
Version: 2.0.45+ds1-1
Built-Using: golang-1.15 (= 1.15.6-1+rpi1), golang-github-aead-chacha20 (= 0.0~git20180709.8b13a72-3), golang-github-aead-poly1305 (= 0.0~git20180717.3fee0db-1), golang-github-coreos-go-systemd (= 22.1.0-3), golang-github-dchest-safefile (= 0.0~git20151022.0.855e8d9-1.1), golang-github-hashicorp-go-immutable-radix (= 1.3.0-1), golang-github-hashicorp-go-syslog (= 0.0~git20150218.0.42a2b57-1.1), golang-github-hashicorp-golang-lru (= 0.5.4-1), golang-github-jedisct1-dlog (= 0.7-1), golang-github-jedisct1-go-clocksmith (= 0.0~git20210101.da382b9-1), golang-github-jedisct1-go-dnsstamps (= 0.1.3-1), golang-github-jedisct1-go-minisign (= 0.1.0-2), golang-github-jedisct1-xsecretbox (= 1.0.1-1), golang-github-k-sone-critbitgo (= 1.4.0-1), golang-github-kardianos-service (= 1.2.0-2), golang-github-miekg-dns (= 1.1.35-1), golang-github-vividcortex-ewma (= 1.1.1-1), golang-go.crypto (= 1:0.0~git20201221.eec23a3-1), golang-golang-x-net (= 1:0.0+git20201031.ff519b6+dfsg-1), golang-golang-x-sys (= 0.0~git20201223.0d417f6-1), golang-golang-x-text (= 0.3.4-1), golang-gopkg-natefinch-lumberjack.v2 (= 2.1-1), golang-toml (= 0.3.1-1)
Priority: optional
Section: net
Maintainer: Eric Dorland <eric@debian.org>
Installed-Size: 7,928 kB
Depends: adduser, lsb-base (>= 3.0-6), libc6 (>= 2.4)
Suggests: resolvconf
Breaks: dnscrypt-proxy-plugins (<< 2)
Homepage: https://github.com/DNSCrypt/dnscrypt-proxy
Download-Size: 2,369 kB
APT-Manual-Installed: yes
APT-Sources: http://raspbian.raspberrypi.org/raspbian bullseye/main armhf Packages
Description: Flexible DNS proxy, with support for encrypted DNS protocols
 dnscrypt-proxy is a flexible DNS proxy, with support for modern encrypted DNS
 protocols such as DNSCrypt v2 and DNS-over-HTTPS.

I could make it work successfully, except for local domain forwarder (and I need it 🫤).

In my forwarding-rules.txt file I have only:

home 192.168.1.1:53

But when trying to resolve addresses in .home domain, I get no answer and some DROP entries in log file:

time:1698907417 host:127.0.0.1 message:pi.home type:A return:DROP cached:0 duration:5005 server:192.168.1.1:53

Tried host pi.home 192.168.1.1, it works just fine:

Using domain server:
Name: 192.168.1.1
Address: 192.168.1.1#53
Aliases:

pi.home has address 192.168.1.2

I tried to dig into the Go source code, couldn't find any clue 🥴.

For the reference, my /etc/dnscrypt-proxy/dnscrypt-proxy.toml file (may not be "state-of-the-art", just migrated from my Windows computer):

Details

server_names = ['quad9-doh-ip4-port443-nofilter-pri']
listen_addresses = []
max_clients = 250
ipv4_servers = true
ipv6_servers = false
disabled_server_names = []
dnscrypt_servers = true
doh_servers = true
require_dnssec = false
require_nolog = false
require_nofilter = false
daemonize = false
force_tcp = true
dnscrypt_ephemeral_keys = false
tls_disable_session_tickets = false
offline_mode = false
timeout = 5000
keepalive = 30
lb_estimator = false
netprobe_timeout = 60
netprobe_address = '9.9.9.10:53'
log_level = 0
use_syslog = false
cert_refresh_delay = 240
fallback_resolvers = ['9.9.9.10:53', '149.112.112.11:53']
ignore_system_dns = true
log_files_max_size = 10
log_files_max_age = 7
log_files_max_backups = 1
block_ipv6 = true
block_unqualified = true
block_undelegated = true
reject_ttl = 600
forwarding_rules = '/etc/dnscrypt-proxy/forwarding-rules.txt'
cache = true
cache_size = 1024
cache_min_ttl = 2400
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600

[query_log]
file = '/var/log/dnscrypt-proxy/query.log'
format = 'ltsv'

[nx_log]
file = '/var/log/dnscrypt-proxy/nx.log'
format = 'ltsv'

[blacklist]
blacklist_file = '/etc/dnscrypt-proxy/blacklist.txt'
log_format = 'ltsv'

[ip_blacklist]

[anonymized_dns]
skip_incompatible = false

[[anonymized_dns.routes]]
server_name = 'quad9-dnscrypt-ip4-nofilter-pri'
via = ['anon-opennic-R4SAS']
[[anonymized_dns.routes]]
server_name = 'quad9-dnscrypt-ip4-nofilter-pri'
via = ['anon-kama', 'anon-scaleway']

[broken_implementations]
fragments_blocked = ['cisco', 'cisco-ipv6', 'cisco-familyshield', 'cisco-familyshield-ipv6', 'quad9-dnscrypt-ip4-filter-alt', 'quad9-dnscrypt-ip4-filter-pri', 'quad9-dnscrypt-ip4-nofilter-alt', 'quad9-dnscrypt-ip4-nofilter-pri', 'quad9-dnscrypt-ip6-filter-alt', 'quad9-dnscrypt-ip6-filter-pri', 'quad9-dnscrypt-ip6-nofilter-alt', 'quad9-dnscrypt-ip6-nofilter-pri', 'cleanbrowsing-adult', 'cleanbrowsing-family-ipv6', 'cleanbrowsing-family', 'cleanbrowsing-security']

[sources]

[sources.public-resolvers]
urls = ['https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md', 'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md']
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
cache_file = 'public-resolvers.md'
refresh_delay = 0
prefix = ''

[sources.relays]
urls = ['https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v3/relays.md', 'https://download.dnscrypt.info/dnscrypt-resolvers/v3/relays.md']
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
cache_file = 'relays.md'
refresh_delay = 72
prefix = ''

Should I enable some kind of debug mode to get more info?
Did I make any configuration mistake?

Any clue welcome, thanks!

[BallonLac]

Gotcha!

My local DNS only answered on UDP (checked with host -U pi.home 192.168.1.1 then host -T pi.home 192.168.1.1).
Changed to force_tcp = false in /etc/dnscrypt-proxy/dnscrypt-proxy.toml, working fine now! 😊
Not exactly the perfect setup for security, but I could live with that.