Wed, 22 May 2013 07:47:54 +0000 http://forums.opendns.com/ Lussumo Vanilla 1.1.4 http://forums.opendns.com/comments.php?DiscussionID=60891 http://forums.opendns.com/comments.php?DiscussionID=60891 Tue, 14 May 2013 18:32:20 +0000 pueblobonito thank´s in advance for your answers.]]> http://forums.opendns.com/comments.php?DiscussionID=29083 http://forums.opendns.com/comments.php?DiscussionID=29083 Mon, 22 Apr 2013 21:43:16 +0000 jedisct1
The crypto library has been replaced by the bleeding edge version Sodium, making DNSCrypt way faster (CPU-wise) than before.

There is also a new command-line switch to change the log verbosity, useful for people running it on routers.

http://dnscrypt.org

The server-side version of the proxy (https://github.com/Cofyc/dnscrypt-wrapper) will be updated as soon as time permits.]]> http://forums.opendns.com/comments.php?DiscussionID=18956 http://forums.opendns.com/comments.php?DiscussionID=18956 Tue, 09 Apr 2013 07:12:03 +0000 Thank you.]]> http://forums.opendns.com/comments.php?DiscussionID=18756 http://forums.opendns.com/comments.php?DiscussionID=18756 Sat, 06 Apr 2013 08:25:23 +0000
Thanks]]> http://forums.opendns.com/comments.php?DiscussionID=17507 http://forums.opendns.com/comments.php?DiscussionID=17507 Sun, 24 Feb 2013 18:25:38 +0000 http://forums.opendns.com/comments.php?DiscussionID=17483 http://forums.opendns.com/comments.php?DiscussionID=17483 Wed, 20 Feb 2013 13:35:10 +0000 I also have a Squid proxy server (on my local network) that I have set up and working.
The setup works fine when accessing non-blocked sites.

When I access a blocked site, the site is (apparently) blocked, but the browser displays a blank white page and not the OpenDNS blocked message.

Any ideas on if there is something specific I could look at in the logs, some specific settings that need to be tweaked in squid.conf ?

I would like to have user that encounter blocked pages to be able to see what category it is being blocked for and have the option to contact an administrator.


I am using Mac OS X 10.7.5 to run squid 3.2.5]]> http://forums.opendns.com/comments.php?DiscussionID=17357 http://forums.opendns.com/comments.php?DiscussionID=17357 Fri, 08 Feb 2013 17:28:08 +0000
its a encrypted VPN and any user can download it and get access to Blocked Sites and Surf Securely.

please tell me there is a wey to block it,?? otherwise my network is screwed up.

thanks]]> http://forums.opendns.com/comments.php?DiscussionID=17003 http://forums.opendns.com/comments.php?DiscussionID=17003 Sun, 06 Jan 2013 17:34:06 +0000
just came back from a vacation and noticed that DNScrypt or the OpenDNS system adds a ipv4 address to a ipv6 only sub domain of mine (and any other v6 only domains). This is going to result that I cant access my ipv6 only domains anymore and get redirected to the opendns search site.

$ host zpi.itbert.de
zpi.itbert.de has address 67.215.65.132
zpi.itbert.de has IPv6 address 2a01:138:a015:42::13


$ whois 67.215.65.132
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=67.215.65.132?showDetails=true&showARIN=false&ext=netref2
#

NetRange: 67.215.64.0 - 67.215.95.255
CIDR: 67.215.64.0/19
OriginAS: AS36692
NetName: OPENDNS-NET-3
NetHandle: NET-67-215-64-0-1
Parent: NET-67-0-0-0-0
NetType: Direct Assignment
RegDate: 2007-10-12
Updated: 2012-03-02
Ref: http://whois.arin.net/rest/net/NET-67-215-64-0-1

[...]

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

$ dnscrypt-proxy -V
dnscrypt-proxy 1.2.0


I am not sure when that change occurred, but I just noticed it today. Any changes made? ;)

Kind regards

bert2002

EDIT: and a weird *.opendns.com certificate that is not recognized by the firefox is prompted to be accepted. May be the chain is not fully available.]]> http://forums.opendns.com/comments.php?DiscussionID=17183 http://forums.opendns.com/comments.php?DiscussionID=17183 Wed, 23 Jan 2013 14:28:47 +0000 http://forums.opendns.com/comments.php?DiscussionID=16983 http://forums.opendns.com/comments.php?DiscussionID=16983 Thu, 03 Jan 2013 09:56:26 +0000 mraufk
Will openDNS work if I use proxy settings ? Is there any workarounds ?]]> http://forums.opendns.com/comments.php?DiscussionID=16653 http://forums.opendns.com/comments.php?DiscussionID=16653 Fri, 30 Nov 2012 09:08:48 +0000 acz
Several months ago, I installed DNSCrypt 0.0.6 from the OpenDNS website, and it seems to work just fine with my home network.

I am traveling today and using AT&T WiFi at the hotel.

I have noticed that the DNSCrypt icon in the system tray turns from green to red and back again every couple of minutes, but I don’t think it is a regular pattern.

What is going on when that happens, and what should I do about it?

Is there a newer version in the works?

Thank you!]]> http://forums.opendns.com/comments.php?DiscussionID=16543 http://forums.opendns.com/comments.php?DiscussionID=16543 Mon, 19 Nov 2012 15:01:22 +0000
I use Hamachi and OpenDNS and am the network admin, I been using these services for years and the service works great. However this morning Hamachi would no longer work. After trouble shooting different things, I removed the Proxy/Anonymizer category from my network and all of the sudden Hamachi worked. After more trouble shooting, I found that if you add the domain std.hamachi.logmein.com to your white list, you can re enable Proxy/Anonymizer and Hamachi will work.

Because as of this morning Hamachi is categorized as Proxy/Anonymizer, even though I read it would not be.

So if there are any network Admins out there who have run into this issue, hopefully this will help.

Again if this has already been posted, I apologize.]]> http://forums.opendns.com/comments.php?DiscussionID=16513 http://forums.opendns.com/comments.php?DiscussionID=16513 Fri, 16 Nov 2012 16:12:11 +0000
Option A: Add new HTTP header rule

Option B: Create URL parameter rewrite rule

If we have to go to all the trouble to add a device at our network to do this, we will likely discontinue using OpenDNS since maintaining two filters does not make sense. I really like OpenDNS so I hate to think about leaving. Any good ideas out there?]]> http://forums.opendns.com/comments.php?DiscussionID=16283 http://forums.opendns.com/comments.php?DiscussionID=16283 Wed, 31 Oct 2012 05:48:35 +0000 http://forums.opendns.com/comments.php?DiscussionID=16233 http://forums.opendns.com/comments.php?DiscussionID=16233 Fri, 26 Oct 2012 16:58:26 +0000
I am running PCLinuxOS 2012.x.

I have a very unusual setup and will have to explain it well before I will ask the questions.

1. I have a small home network.
2. In my network I have a laptop that runs as a so called "server".
3. This server is connected to the internet using USB 3G Dongle Huawei 160g.
4. It's dialed out to the internet using drakconnect (forked Mandriva tools) and it works great.
5. Now this internet connection is being shared via ethernet card to a wireless router.
6. I am using iptables to get the packet forwarding going from ppp0 (modem) to eth2 (wired ethernet) card
7. Shorewall (which is a iptables based firewall - its basically a gui for the iptables) allows me to configure the ppp0 interface to get a full perfect "stealth" on the grc.com shieldsup service
8. ICS Bind aka. Named is being used as a local DNS server and dns caching server http://www.pclinuxos.com/forum/index.php/topic,99575.0.html which makes my dns queries faster - improves the internet connection responsiveness
9. Squid proxy in transparent mode (no need for clients config) is running on the server too - it stores content of the websites and serves it when need to improve internet connection
10. Internet after all those modifications is being sent from eth2 card to my wireless linksys router and spread among other machines at home.

Server is being setup to DHCP on WAN side. IP addresses vary between reboots however DNS (/etc/resolv.conf) file is always the same. It contains 3 entries. 127.0.0.1 and both OpenDNS addresses.

Server is being setup to have static IP on LAN side. 192.168.0.1 is the internal IP.

Clients are using static IPs from the range 192.168.0.10* as IP and 192.168.0.1 as a gateway and only DNS server.

I have compiled the DNSCrypt tool and all went superb. Then I have tried to run the

/usr/sbin/dnscrypt-proxy --daemonize

but I ran into a little snag:

[ERROR] Unable to bind (UDP) [Address already in use]

When I have disabled bind by running

service named stop

dnscrypt started without issues however after using wireshark to sniff packets on the server I got normal / not malformed DNS queries

http://askubuntu.com/questions/105366/how-to-check-if-dns-is-encrypted

This got me thinking that I need to configure my dnscrypt to work with the named / bind server. I started googling and I got this:

http://blog.kantancode.com/post/dnscrypt-proxy-and-bind

However no matter what port do I chose after adding forwarders to the named.conf I am unable to start named service due to the rndc error:

[root@icsserver andrzejl]# service named restart
Stopping named: rndc: connect failed: 127.0.0.1#953: connection refused
[FAILED]
Starting named: [ OK ]
[root@icsserver andrzejl]#

Am I wrong to assume that named + dnscrypt should work well together?
Is it a mistake to try to use them both?
I was hoping for a encrypted (more private) OpenDNS dns that would be cached on a local server for improved performance.

Any Linux gurus around that could help me out with that?

Regards.

AndrzejL]]> http://forums.opendns.com/comments.php?DiscussionID=16035 http://forums.opendns.com/comments.php?DiscussionID=16035 Thu, 11 Oct 2012 09:44:21 +0000
I am New to this type of stuff and I was kind of wondering, hey why don't I ask you guys for some tips about boosting my Internet speed =)

Please understand that my Salary can only afford a 1mbps connection. Pleae don't be rude to me. I am really hoping that you guys are gonna give me some Tweaks or software that actually work. Please dont send me a virus or a malware =)

Thank you in advanced guys =)]]> http://forums.opendns.com/comments.php?DiscussionID=15829 http://forums.opendns.com/comments.php?DiscussionID=15829 Tue, 25 Sep 2012 23:36:45 +0000 jedisct1
This is a stable and major release, with important bug fixes and upgrading is highly recommended, especially on Windows and Android.

It also improves reliability under load on Windows, and works better on links with a small MTU.

In addition, it can now easily be extended with plugins. See https://github.com/opendns/dnscrypt-proxy/blob/master/README-PLUGINS.markdown for more info about the dnscrypt plugins and http://dnscrypt.org/plugin-api/plugin_8h.html for the API documentation.

Source code and packages for Linux (yes, they are back), Windows, iOS and Android are available as usual here: https://github.com/opendns/dnscrypt-proxy/downloads

---

In addition, version 0.17 of the user interface for OSX is almost done, and brings quite a lot of changes.
An early version can be downloaded here: http://opendns.github.com/dnscrypt-osx-client/

This version ships with the latest version of dnscrypt-proxy, and leverages plugins in order to add exciting new features:

- Support for static DNS resolvers. The DNSCrypt user interface used to work pretty well with DHCP-provided servers, not so well with a static configuration. Now, you can specify static DNS servers to fall back to use when dnscrypt is disabled.

- Advanced parental controls, with stronger filters than FamilyShield.

- Logging. You can watch DNS queries sent by your computer in real time. This is of course disabled by default.

- If you have an OpenDNS account, the custom network settings you are using at home can be used when roaming. Just check the "lock-in the current network settings" box and your network settings will be saved. Go to Starbucks, and enjoy the same filter set as if you were at home. Connect to the Wifi network of a friend who also happens to use OpenDNS, and your home settings will be applied to your laptop, while your friend's settings will remain unchanged, even if you are sharing the same IP address.

- Wildcard-based domain name blocking. You can block domain names containing "xxx" just by adding *xxx* to a list. Or what about blocking names starting with the word "ads"? Just add ads.* to the blacklist. Or what about adding 1,000 domains to the blacklist, just by copy/pasting them from a text file? Now, you can do that, too. Directly on your computer, no browser required.

- IP addresses blocking. In addition to domain blocking, you can also block IP addresses.

- Exceptions: this was a popular request. Using a third-party resolver made it impossible to resolve names within private domains. Now, you can add a list of domains that have to be sent to your default resolver instead of OpenDNS. The OSX client already had a list of common exceptions (*.fritz.box *.intranet *.lan *.localdomain *.nowtv.com *.private *.routerlogin.net), now you can easily extend it.

- Oh, and it has an auto-update mechanism that might work. Finally. And if anything goes wrong, it now has a built-in uninstaller. Just click the "Uninstall" button in the "About" pane, confirm and you're done.

0.17 is still a work in progress and some features haven't been plugged to the user interface yet, but if you feel adventurous, please give it a shot, your early feedback would be more than welcome.]]> http://forums.opendns.com/comments.php?DiscussionID=15873 http://forums.opendns.com/comments.php?DiscussionID=15873 Fri, 28 Sep 2012 23:49:27 +0000 jedisct1
http://opendns.github.com/dnscrypt-osx-client/

PS: the new extended settings tab (see the 2nd screenshot) has a "help" section.
Take the time to read it in order to understand how the new features work!]]> http://forums.opendns.com/comments.php?DiscussionID=15807 http://forums.opendns.com/comments.php?DiscussionID=15807 Sat, 22 Sep 2012 22:39:52 +0000 pjw-odns
I've located a .plist in /Library/LaunchDaemons - can I set the listening port in there? - whats the parameter?]]> http://forums.opendns.com/comments.php?DiscussionID=15705 http://forums.opendns.com/comments.php?DiscussionID=15705 Fri, 14 Sep 2012 23:56:19 +0000 I currently have a Tomato router and am considering paying for a VPN service as I am a little leery of my ISP having records of any and all internet activity. I have been using OpenDNS for content filtering to good results, but now I am looking to do that in conjunction with a VPN service.

I am on a trial period of Astrill and while the VPN properly anonymizes me, it also uses it's own DNS such that sites are no longer filtered by OpenDNS.

I understand that by connecting to the VPN, my request to go to a given website first goes to the VPN, which then forwards the address to whatever DNS it is using to resolve the IP.

Can you tell me if this would work:
Suppose there was a VPN service that used OpenDNS. Would it be possible to somehow maintain my filter settings if I set the VPN not to tunnel any traffic to OpenDNS? If this would work, is there such a service?

Any other thoughts on possible ways to maintain anonymity while still being able to use OpenDNS filters?

TIA!]]> http://forums.opendns.com/comments.php?DiscussionID=15699 http://forums.opendns.com/comments.php?DiscussionID=15699 Thu, 13 Sep 2012 23:17:57 +0000 jedisct1
NEWS:

- dnscrypt-proxy can now use plugins in order to alter/inspect queries and responses before and after they are relayed. See README-PLUGINS.markdown for more information.

- The default max payload size has been trimmed down to 1252 bytes for compatibility with some scary network setups.

- The --local-port and --resolver-port options are gone for good. They had been deprecated for a while and were undocumented since version 1.0.

- Multiple certificates are now properly handled.

- Memory leaks have been fixed, a big bad use-after-free condition has been fixed, uninitialized variables have been initialized. Upgrading is highly recommended, especially on Windows.]]> http://forums.opendns.com/comments.php?DiscussionID=15361 http://forums.opendns.com/comments.php?DiscussionID=15361 Wed, 15 Aug 2012 17:44:32 +0000 "Using DNSCrypt in combination with a DNS cache"
https://github.com/opendns/dnscrypt-proxy/blob/master/README.markdown

Trouble is, it doesn't work. (Debian Testing) There is no DNSCrypt for Debian Testing, so I downloaded and compiled. I'm starting the daemon in /etc/network/if-up.d like so:
/usr/local/sbin/dnscrypt-proxy --user=sleeper --local-address=127.0.0.1:40 --daemonize

DNSCrypt works fine when I set its port to 53.

I installed Unbound from the apt packaging system, and it works fine when DNSCrypt is off. BUT, when I chain them I no longer get name service. To chain them I add this to unbound.conf:
do-not-query-localhost: no
forward-zone:
name: "."
forward-addr: 127.0.0.1@40

# lsof -i -n -P
dnscrypt- 25752 sleeper 8u IPv4 183237 0t0 UDP 127.0.0.1:40
dnscrypt- 25752 sleeper 9u IPv4 183238 0t0 UDP *:34845
dnscrypt- 25752 sleeper 10u IPv4 183239 0t0 TCP 127.0.0.1:40 (LISTEN)
unbound 26557 unbound 3u IPv4 193469 0t0 UDP 127.0.0.1:53
unbound 26557 unbound 4u IPv4 193471 0t0 TCP 127.0.0.1:53 (LISTEN)
unbound 26557 unbound 5u IPv4 193475 0t0 TCP 127.0.0.1:8953 (LISTEN)
unbound 26557 unbound 12u IPv4 196728 0t0 UDP *:36260
unbound 26557 unbound 14u IPv4 196727 0t0 UDP *:14170
unbound 26557 unbound 15u IPv4 196729 0t0 UDP *:36391
unbound 26557 unbound 16u IPv4 196726 0t0 UDP *:30313

In syslog I see:
Aug 15 09:46:15 hydra unbound: [25454:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN
Aug 15 09:46:15 hydra unbound: [25454:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN
Aug 15 09:46:15 hydra unbound: [25454:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN
Aug 15 09:46:15 hydra unbound: [25454:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN
Aug 15 09:46:15 hydra unbound: [25454:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN
Aug 15 09:46:16 hydra unbound: [25454:0] info: failed to prime trust anchor -- DNSKEY rrset is not secure . DNSKEY IN

DNSCrypt and Unbound each work alone, but not together. What could be wrong?]]> http://forums.opendns.com/comments.php?DiscussionID=15343 http://forums.opendns.com/comments.php?DiscussionID=15343 Tue, 14 Aug 2012 16:13:30 +0000
what are these heavy traffic domains; these do not seem to be websites and the domain names are not registered.

any ideas? as our network is enduring some performance problems

thank you in advance for your insights and assistance.


1 hi-pc.routerd52808.com 3,400
2 dataserv.routerd52808.com 3,369
3 isatap.routerd52808.com 3,111
4 www.facebook.com 1,988
5 *.fbcdn.net 1,942
6 *.akamaiedge.net 1,868
7 www.google.com 1,065]]> http://forums.opendns.com/comments.php?DiscussionID=15335 http://forums.opendns.com/comments.php?DiscussionID=15335 Mon, 13 Aug 2012 18:53:57 +0000 http://forums.opendns.com/comments.php?DiscussionID=15269 http://forums.opendns.com/comments.php?DiscussionID=15269 Tue, 07 Aug 2012 00:02:48 +0000 jedisct1
Main changes:

- It properly copes with captive portals and firewalls

- The TCP/443 checkbox is gone. When the dnscrypt box is checked, it tries everything in parallel and keeps whatever works best

- IPv6 is fully supported (and automatic. If that works using IPv6, IPv6 is used)

- Familyshield is supported, with and without dnscrypt

- OpenDNS/DNSCrypt/Familyshield/Fallback settings can be set from the menu bar

- Internal domain names like routerlogin.net are directly sent to the router or to whatever DNS resolvers the DHCP server provides.

- Packages are signed for Mountain Lion.

- It passively watches for network changes according to the current network configuration and the current Wifi access point, by monitoring the SSID and BSSID.

- It's scriptable.

- The package ships with dnscrypt-proxy 1.0.1.

- The DNS cache is now flushed after a configuration change.

- Compatibility with OSX 10.6 has been improved.

- The release notes are now bundled with the preference pane. This reduces the startup time and ensures that these notes are consistent with the currently running version.]]> http://forums.opendns.com/comments.php?DiscussionID=15083 http://forums.opendns.com/comments.php?DiscussionID=15083 Fri, 20 Jul 2012 21:34:06 +0000 jedisct1
iOS and Windows binaries are available, source code is available and the BSD ports and Homebrew formula have been updated.

Linux and OSX (for the first time) packages will follow this weekend.

1.0.x will be maintenance-only. Exciting stuff is now happening in the 1.1 branch.]]> http://forums.opendns.com/comments.php?DiscussionID=15147 http://forums.opendns.com/comments.php?DiscussionID=15147 Thu, 26 Jul 2012 19:19:28 +0000 jedisct1
1) Download and extract the latest Windows package for dnscrypt

2) Copy the dnscrypt-proxy.exe file to any location.

3) Open a terminal (run cmd.exe) and type (you may need to specify the full path to the file):
dnscrypt-proxy.exe --install

4) Change your DNS settings to 127.0.0.1

Congratulations, you're now using DNSCrypt!]]> http://forums.opendns.com/comments.php?DiscussionID=15095 http://forums.opendns.com/comments.php?DiscussionID=15095 Sat, 21 Jul 2012 15:21:18 +0000
"Unable to retrieve server certifcates" followed by "refetching server certificates" and it just loops over and over.

This happens with versions 0.12 and 1.0.

I'm in the UK, and thought maybe it had something to do with this: http://system.opendns.com/2012/07/17/507/

Anyone else had this problem?]]> http://forums.opendns.com/comments.php?DiscussionID=15049 http://forums.opendns.com/comments.php?DiscussionID=15049 Wed, 18 Jul 2012 08:54:03 +0000
Thanks for any and all replies.]]> http://forums.opendns.com/comments.php?DiscussionID=15045 http://forums.opendns.com/comments.php?DiscussionID=15045 Tue, 17 Jul 2012 22:45:36 +0000 jedisct1
This version improves stability on Windows and Linux, and gracefully deals with full UDP send queues.
As always, source code, Windows binaries and iOS binaries are available on Github: https://github.com/opendns/dnscrypt-proxy/downloads

Documentation: https://github.com/opendns/dnscrypt-proxy/blob/master/README.markdown

Starting from 0.11, the package ships with a new tool, hostip, that can come in handy in order to resolve IP addresses before the proxy is running. Like the proxy, it fully supports IPv6.

This is probably the last release before 1.0.]]>