Securing DNS Traffic in China


DNS poisoning is one of the most common cause of nuisance when accessing websites
that are outside this 1.4 billion-people Oriental country. So far, the best way to protect yourself from this trouble is to route all your DNS traffic through an encrypted channel, and the method I am going to introduce is DNSCrypt. There is not yet a standard for encrypted DNS, DNSCrypt is a project done by OpenDNS. According my experience, DNSCrypt is very reliable and robust, the cryptography of the protocol is called DNSCurve, which is a public-key crypto that employes an extremely strong elliptic-curve cryptography called Curve25519.

If you have read my previous writing, you should know my setup is a Raspberry Pi, and so the rest of this article is based on that, running Raspbian. Dnsmasq will be used as the first DNS caching proxy to serve incoming DNS queries from machines on the network. If the queried domain name is a China one, the request will be served by a China DNS. This is necessary because for some domains, answers from DNS servers in China and global ones could be different. If the requested domain does not belong to any known China domains, the request will be forwarded to dnscrypt-proxy, which will ask a DNSCrypt server for an answer.

After DNSCrypt is used, your DNS traffic will look like this:

Setting up DNSCrypt

As illustrated in the above diagram, dnscrypt-proxy is the piece of software that handles DNSCrypt, but it is not available in Raspbian’s Wheezy and Jessie releases, only in testing (currently Stretch). You can either compile it yourself, or grab the debian package I built and install it. You can find the package here. It is based on the Raspbian package in testing repo, with some modification to debian packaging files, since the one in testing depends on systemd, which had not yet been adopted when Wheezy was released.

If you really want to build the package yourself, first install the libsodium packages. The package are also not available in Wheezy repo but the ones from testing, libsodium13_1.0.3-1_armhf.deb and libsodium-dev_1.0.3-1_armhf.deb, can be installed without any problem. Download and install them, then follow these steps to build your dnscrypt-proxy package:

After dnscrypt-proxy is installed, you have to update the port it uses. Change DNSCRYPT_PROXY_LOCAL_ADDRESS in /etc/default/dnscrypt-proxy to another port other than 53 (as it will be used by dnsmasq later), like this:

You can also change the remote DNSCrypt server, but since the default (cisco) works well for me, I left it unchanged.

Now test it to make sure it works as expected:

Setting up dnsmasq

Dnsmasq is very common and is available in Raspbian, installing it is easy:

Now we have to do some configuration in /etc/dnsmasq.conf. These are my recommended settings. Please note that the interface option is the network interface that dnsmasq will serve, and in my case that is wlan0. You have to change it to the one that applies to your case.

Now comes the interesting part. We are going to tell dnsmasq to use a China DNS server ( in my example) for China domains and DNSCrypt server for all others. This is done by using the server option in /etc/dnsmasq.conf. Here is an example:

This is pretty straightforward. The last line tells dnsmasq to use your dnscrypt proxy if the domain you query does not match any China domains. In my config file there are 12238 lines for China domains so I’m not going to post them all here, you can get the snippet of my dnsmasq.conf here, and put it into your own dnsmasq.conf. The problem is to maintain the list for all China hosts. I am now using the list from the fqrouter project, it has been serving me well, since most common domains are already there. What’s worrying is due to the abandon of the project by it’s author, the list is now unmaintained. If you know a more updated list, please let me know!

Debian 哀悼 Ian Murdock 離世 上發佈了 Ian Murdock 的死訊,由於對 Ian 十分敬佩,看到之後立馬把它翻譯過來,本來已經在上月31號翻好並發到 debian-publicity 郵件列表,可是不知什麼原因那邊一直沒收到(已經用了兩個不同的 email)。由於剛好那段時間在日本旅遊,也就沒太注意。今天打算再看看什麼問題的時候,發現 Anthony Fok 已經把另一篇由 Bootingman 翻譯的中文版放上網站,既然如此我也不好把它換掉。可是翻譯畢竟已經完成,而且還花了點心血,結果還算滿意,因此就在這公佈一下。


Ian Murdock 是一位自由/開源軟件的忠實擁護者、一名父親、兒子、以及 Debian 中的 ‘ian’,我們懷著沉重的心情,對 Ian 的離世致以深切哀悼。

Ian 於 1993 年 8 月啓動 Debian 計劃,並於同年不久推出首個版本。之後,Debian 逐漸成爲世界上的一個通用作業系統,無論從嵌入式設備,乃至國際太空站,皆能尋到它的蹤跡。

Ian 在創造 Debian 發行版與發展社羣文化時,無不專注於確保在道德層面,抑或技術層面,所做的事情都是正確的。譬如每個版本只會在最终完備時發佈,而 Debian 計劃對自由軟件的堅定立場,現已被視爲自由與開源領域的標準。

Ian 對於做正確事情的執著,使得他在 Debian 及往後的日子裏,一直朝向最美好的未來邁進。

Ian 的夢想猶在,Debian 社羣仍然非常活躍,上千的開發人員奉獻數不盡的日日夜夜,帶給世界一個穩定及安全的作業系統。

在這個傷痛的時刻,Debian 社羣眾人與 Ian 的家人心繫一起。他的家人亦請求各位,在這段艱難時期重視他們的私隱,我們對此表示尊重。各位來自 Debian 以及廣大 Linux 社羣的朋友,請將您們的慰問發送至,所有唁函將被永遠保存。

譯者:黃彥邦 (Anthony Wong)