DNSCrypt leak ISP DNS on Fedora Linux

[Nokia808]

Hello !

I'm long term user for DNSCrypt on My Fedora Linux since many years ago without any problem. But, today I discovered that my DNSCrypt leaking my ISP real DNS when I visited https://ipleak.net !!

I checked the condition by following commands & their outputs were as following:

$ systemctl status dnscrypt-proxy.service
● dnscrypt-proxy.service - Encrypted/authenticated DNS proxy
     Loaded: loaded (/etc/systemd/system/dnscrypt-proxy.service; enabled; prese>
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Sat 2024-02-24 07:13:51 GMT; 1h 15min ago
   Main PID: 865 (dnscrypt-proxy)
      Tasks: 9 (limit: 18787)
     Memory: 19.0M
        CPU: 1.172s
     CGroup: /system.slice/dnscrypt-proxy.service
             └─865 /usr/bin/dnscrypt-proxy -config dnscrypt-proxy.toml

Feb 24 07:14:25 localhost.localdomain dnscrypt-proxy[865]: [google] OK (DoH) - >
Feb 24 07:14:25 localhost.localdomain dnscrypt-proxy[865]: [scaleway-fr] OK (DN>
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: [yandex] OK (DoH) - >
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: Sorted latencies:
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -    96ms cloudflare
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -   139ms scaleway-fr
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -   143ms yandex
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -   145ms google
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: Server with the lowe>
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: dnscrypt-proxy is re>
lines 1-22/22 (END)...skipping...
● dnscrypt-proxy.service - Encrypted/authenticated DNS proxy
     Loaded: loaded (/etc/systemd/system/dnscrypt-proxy.service; enabled; preset: disabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Sat 2024-02-24 07:13:51 GMT; 1h 15min ago
   Main PID: 865 (dnscrypt-proxy)
      Tasks: 9 (limit: 18787)
     Memory: 19.0M
        CPU: 1.172s
     CGroup: /system.slice/dnscrypt-proxy.service
             └─865 /usr/bin/dnscrypt-proxy -config dnscrypt-proxy.toml

Feb 24 07:14:25 localhost.localdomain dnscrypt-proxy[865]: [google] OK (DoH) - rtt: 145ms
Feb 24 07:14:25 localhost.localdomain dnscrypt-proxy[865]: [scaleway-fr] OK (DNSCrypt) - rtt: 139ms
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: [yandex] OK (DoH) - rtt: 143ms
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: Sorted latencies:
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -    96ms cloudflare
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -   139ms scaleway-fr
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -   143ms yandex
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: -   145ms google
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: Server with the lowest initial latency: cloudflare (rtt: 96ms)
Feb 24 07:14:26 localhost.localdomain dnscrypt-proxy[865]: dnscrypt-proxy is ready - live servers: 4
~
~
~
~
~
~
~
~
~
~
~
~
~
lines 1-22/22 (END)

sudo vi /etc/resolv.conf
# This is /run/systemd/resolve/stub-resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad
search .
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
                                                                                                                                                       1,1           All

sudo vi /etc/NetworkManager/NetworkManager.conf
# Configuration file for NetworkManager.
#
# See "man 5 NetworkManager.conf" for details.
#
# The directories /usr/lib/NetworkManager/conf.d/ and /var/run/NetworkManager/conf.d/
# can contain additional configuration snippets installed by packages. These files are
# read before NetworkManager.conf and have thus lowest priority.
# The directory /etc/NetworkManager/conf.d/ can contain additional configuration
# snippets. Those snippets are merged last and overwrite the settings from this main
# file.
#
# The files within one conf.d/ directory are read in asciibetical order.
#
# If /etc/NetworkManager/conf.d/ contains a file with the same name as
# /usr/lib/NetworkManager/conf.d/, the latter file is shadowed and thus ignored.
# Hence, to disable loading a file from /usr/lib/NetworkManager/conf.d/ you can
# put an empty file to /etc with the same name. The same applies with respect
# to the directory /var/run/NetworkManager/conf.d where files in /var/run shadow
# /usr/lib and are themselves shadowed by files under /etc.
#
# If two files define the same key, the one that is read afterwards will overwrite
# the previous one.

[main]
#plugins=ifcfg-rh,ibft
dns=none

[logging]
# When debugging NetworkManager, enabling debug logging is of great help.
#
# Logfiles contain no passwords and little sensitive information. But please
# check before posting the file online. You can also personally hand over the
# logfile to a NM developer to treat it confidential. Meet us on #nm on freenode.
# Please post full logfiles except minimal modifications of private data.
#
                                                                                                                                                       1,1           Top

But, when I run the following command the output showed me that file NOT existing because vi prepare a new file by the same name:
sudo vi etc/dnscrypt-proxy/dnscrypt-proxy.toml

Please your kind help ! It seem that there was something changed when I received update (new package update) for my DNSCrypt-proxy during my system updating processes ....

My DNSCrypt version is:
Name : dnscrypt-proxy
Version : 2.1.1
Release : 8.fc38
Architecture : x86_64

Installation from my official Fedora repositories.

Best regards.

[Nokia808]

I forgot to mention that I checked my Cinnamon GUI setting from my network manager GUI & there was nothing changed from previous !

1) go to “Application Menu” > “Preferences” > “Advanced Network Configuration” > then,
2) click on the name of the connection > select the “IPv4 Settings tab” > In the Method list, select “Automatic (DHCP) addresses only” > In the DNS Servers field, enter:
127.0.0.1
3) select the IPv6 Settings tab > In the Method list, select Disabled, > Click on Save.

The above is my setting.

From previous discussion with you in this forum changing nameserver by Fedora from "127.0.0.1" into "127.0.0.53" should cause no problem & need me not to change "127.0.0.1" into "127.0.0.53" in network manager GUI for my WiFi connection .....

[Nokia808]

Hello again !

I changed 127.0.0.1 into 127.0.0.53 in the network manager GUI (NOT in resolv.conf) & result was block Internet & I could not connect to Internet .... I then revert to 127.0.0.1 in GUI of my network manager & I then restored ability to connect to Internet !

Please any help ? Do I have to change nameserver in resolv.conf into 127.0.0.1 ??

[Nokia808]

I run

sudo dnscrypt-proxy -service install --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml

& received following output:

sudo dnscrypt-proxy -service install --config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
[2024-02-26 13:14:24] [FATAL] Failed to install DNSCrypt client proxy: Init already exists: /etc/systemd/system/dnscrypt-proxy.service

Then I viewed the systemd file by running vi /etc/systemd/system/dnscrypt-proxy.service & output was the following:

[Unit]
Description=Encrypted/authenticated DNS proxy
ConditionFileIsExecutable=/usr/bin/dnscrypt-proxy


[Service]
StartLimitInterval=5
StartLimitBurst=10
ExecStart=/usr/bin/dnscrypt-proxy "-config" "dnscrypt-proxy.toml"

WorkingDirectory=/etc/dnscrypt-proxy





Restart=always

RestartSec=120
EnvironmentFile=-/etc/sysconfig/dnscrypt-proxy

[Install]
WantedBy=multi-user.target
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
~                                                                                                                                                                        
"/etc/systemd/system/dnscrypt-proxy.service" [readonly] 23L, 380B                                                                                      1,1           All

Please your kind help ! Why no replay till now ?! Is there need to post this issue as a bug in "issues" section ?

[Nokia808]

I posted about this issue in Fedora community forum at the following link:
https://forums.fedoraforum.org/showthread.php?332133-DNSCrypt-leak-ISP-DNS-on-MY-Fedora-38-!&p=1880833#post1880833

My user name on Fedora community forum is Nokia808.

Kindly, do you have a comment from your side about this ?

Thank you.