我正在尝试使用 Unbound 和 DNSCrypt 在 Raspberry 上设置 DNS 缓存服务器。
Raspberry 运行最新的 Jessie Lite(无头 Debian 8)。
我使用这个流行的脚本设置 DNSCrypt:https://github.com/simonclausen/dnscrypt-autoinstall
Unbound 和 DNSCrypt 都运行良好:我的主计算机 (192.168.1.64) 成功使用 Raspberry (192.168.1.65) 上的 DNS 服务器,并且我可以通过日志文件看到 Unbound 使用 DNSCrypt。
dig
我的问题是,当我访问网站并通过Wireshark
返回标准查询进行捕获时,我没有看到任何加密。
我缺少什么?
这是dig
回应:
$ dig debug.opendns.com txt
; <<>> DiG 9.9.5-9+deb8u8-Raspbian <<>> debug.opendns.com txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 17686
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; ENDS: version: 0, flags:; upd: 4096
;; QUESTION SECTION:
;debug.opendns.com. IN TXT
;; AUTHORITY SECTION:
opendns.com. 2560 IN SOA auth1.opendns.com. noc.opendns.com. 1483610050 16384 2048 1048576 2560
;; Query time: 143 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jan 05 11:02:24 CET 2017
;; MSG SIZE rcvd: 92
这是 Unbound 的日志:
[1483616499] unbound[5098:0] debug: module config: "iterator"
[1483616499] unbound[5098:0] notice: init module 0: iterator
[1483616499] unbound[5098:0] debug: target fetch policy for level 0 is 3
[1483616499] unbound[5098:0] debug: target fetch policy for level 1 is 2
[1483616499] unbound[5098:0] debug: target fetch policy for level 2 is 1
[1483616499] unbound[5098:0] debug: target fetch policy for level 3 is 0
[1483616499] unbound[5098:0] debug: target fetch policy for level 4 is 0
[1483616499] unbound[5098:0] debug: Forward zone server list:
[1483616499] unbound[5098:0] info: DelegationPoint<.>: 0 names (0 missing), 1 addrs (0 result, 1 avail) parentNS
[1483616499] unbound[5098:0] debug: cache memory msg=33040 rrset=33040 infra=1304 val=0
[1483616499] unbound[5098:0] info: start of service (unbound 1.4.22).
[1483616505] unbound[5098:0] debug: iterator[module 0] operate: extstate:module_state_initial event:module_event_new
[1483616505] unbound[5098:0] info: resolving www.google.com. A IN
[1483616505] unbound[5098:0] info: processQueryTargets: www.google.com. A IN
[1483616505] unbound[5098:0] info: sending query: www.google.com. A IN
[1483616505] unbound[5098:0] debug: sending to target: <.> 127.0.0.1#40
[1483616505] unbound[5098:0] debug: cache memory msg=33040 rrset=33040 infra=1533 val=0
[1483616505] unbound[5098:0] debug: iterator[module 0] operate: extstate:module_wait_reply event:module_event_reply
[1483616505] unbound[5098:0] info: iterator operate: query www.google.com. A IN
[1483616505] unbound[5098:0] info: response for www.google.com. A IN
[1483616505] unbound[5098:0] info: reply from <.> 127.0.0.1#40
[1483616505] unbound[5098:0] info: query response was ANSWER
[1483616505] unbound[5098:0] info: finishing processing for www.google.com. A IN
这是Unbound的配置文件:
server:
auto-trust-anchor-file: "/var/lib/unbound/root.key"
server:
username: unbound
port: 53
logfile: "/var/log/unbound/unbound.log"
log-time-ascii: no
use-syslog: no
verbosity: 3
module-config: "iterator"
do-not-query-localhost: no
interface: 0.0.0.0
access-control: 127.0.0.1 allow
access-control: 192.168.1.0/24 allow
access-control: 10.8.0.0/24 allow
forward-zone:
name: "."
forward-addr: 127.0.0.1@40
forward-first: no
remote-control:
control-enable: no
这是脚本生成的 DNSCrypt 配置:
DNSCRYPT_LOCALIP=127.0.0.1
DNSCRYPT_LOCALPORT=40
DNSCRYPT_USER=dnscrypt
DNSCRYPT_RESOLVER=ns0.dnscrypt.is
答案1
Wireshark 捕获显示源和目标都是本地 IP 地址。
因此,这只是记录您的计算机和 Raspberry Pi 之间的流量。这是常规 DNS 流量。加密的流量位于 Raspberry Pi 和ns0.dnscrypt.is
解析器之间,即进入互联网的流量。
这是您应该进行数据包捕获的地方。
或者,如果您想要验证计算机和 Raspberry Pi 之间的流量,则客户端代理需要在您的计算机上运行,并且在 Raspberry Pi 上,您需要运行 DNSCrypt 服务器(dnscrypt-wrapper 或 dnsdist)。