测试版本：18.06.1
| 软件包名称 | 版本 |
|---|---|
| dnscrypt-proxy | 1.9.5-8 |
| dnscrypt-proxy-resolvers | 1.9.5+git-20171001-2d..3-8 |
| luci-app-dnscrypt-proxy | git-18.247.71242-9541751-1 |
opkg update && opkg install luci-app-dnscrypt-proxy
仅需luci操作，详见视频
openwrt本机
dig @127.0.0.1 -p 5353 medium.com
; <<>> DiG 9.11.2-P1 <<>> @127.0.0.1 -p 5353 medium.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26072
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;medium.com. IN A
;; ANSWER SECTION:
medium.com. 150 IN A 104.16.124.127
medium.com. 150 IN A 104.16.122.127
medium.com. 150 IN A 104.16.120.127
medium.com. 150 IN A 104.16.123.127
medium.com. 150 IN A 104.16.121.127
;; Query time: 32 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Wed Oct 10 22:20:49 CST 2018
;; MSG SIZE rcvd: 119
详见视频
对仅被墙的域名的dns查询进行代理，用以下命令。
# 安装dnsmasq-full
opkg update
opkg remove dnsmasq
opkg install dnsmasq-full
# 安装curl
opkg install ca-bundle curl
curl https://cokebar.github.io/gfwlist2dnsmasq/dnsmasq_gfwlist.conf -o /tmp/dnsmasq.d/dnsmasq_gfwlist_ipset.conf
# 重启dnsmasq即可
/etc/init.d/dnsmasq restart
更新解析列表要安装libustream-openssl而不是libustream-ssl，luci上的提示不是十分准确！
opkg install libustream-openssl
0.0.0.0在路由器下的终端要dig，地址是路由器的lan的ip，dnscrypt-proxy的监听地址要改为0.0.0.0
在下级客户端dig测试
dig @192.168.1.1 -p 5353 medium.com
; <<>> DiG 9.10.3-P4-Debian <<>> @192.168.1.1 -p 5353 medium.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11346
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;medium.com. IN A
;; ANSWER SECTION:
medium.com. 185 IN A 104.16.124.127
medium.com. 185 IN A 104.16.123.127
medium.com. 185 IN A 104.16.120.127
medium.com. 185 IN A 104.16.122.127
medium.com. 185 IN A 104.16.121.127
;; Query time: 19 msec
;; SERVER: 192.168.1.1#5353(192.168.1.1)
;; WHEN: Wed Oct 10 22:48:51 CST 2018
;; MSG SIZE rcvd: 119
改成0.0.0.0后，如果用全局模式，DHCP/DNS的DNS 转发处依旧要写127.0.0.1#5353，不能是0.0.0.0，否则不能解析
添加多个实例，监听在5353，5354，5355...
配置dnsmasq的--all-servers选项，同时向多个服务器查询，采用最快的查询结果。避免单个服务器不稳定或失效带来的问题。
--all-servers
By default, when dnsmasq has more than one upstream server available, it will send queries to just one server. Setting this flag forces dnsmasq to send all queries to all available servers. The reply from the server which answers first will be returned to the original requester.
luci配置DHCP/DNS-高级-所有服务器-打勾