Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




Human
2982 posts

Uber Geek

Subscriber

#195474 21-Apr-2016 10:54
Send private message

I'm currently using it on my router- it was installed by default, but I'm thinking about removing it and seeing if it speeds up DNS resolution. 

 

I'm on fiber (100/20), and even local sites appear to be less snappy than what I would expect.

 

 

 

Is anyone else using dnscrypt or similar? Would be interested to know what your performance is like?

 

Off the back of that, even whether its worth it- how many people actually use it?






View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
1705 posts

Uber Geek


  #1537318 21-Apr-2016 11:22
Send private message

I know @michaelmurfy does and recently posted about it here http://www.geekzone.co.nz/forums.asp?forumid=66&topicid=195079 

I have looked into it but don't understand it enough to get it working on my setup (Untangle acting as a router on UFB connection).

What are the reasons for it?


BDFL - Memuneh
67817 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  #1537323 21-Apr-2016 11:24
Send private message

I don't because there's no support in my current router, but it should. And if your ISP supports it then use the ISP DNS.





 

 

These links are referral codes

 

Geekzone broadband switch | Eletricity comparison and switch | Hatch investment (NZ$ 10 bonus if NZ$100 deposited within 30 days) | Sharesies | Mighty Ape | Backblaze | Amazon | My technology disclosure 


 
 
 
 


1705 posts

Uber Geek


  #1537326 21-Apr-2016 11:29
Send private message

Also, how does this relate to unblockers and using their DNS?


/dev/null
9452 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #1537337 21-Apr-2016 11:40
Send private message

I have 2 DNS Resolvers here (1x Raspberry Pi, 1x VM on my server) both running dnscrypt and configuration kept in sync too. I use CloudNS for my nameservers (https://cloudns.com.au/) and latency is around 24ms which is not enough to worry about, my ISP is BigPipe who have no transparent proxies etc. I have suffered no loss of speed or "snappiness" from my internet since both DNS servers are set to cache DNS queries and keep their cache in sync.

 

If you're on a particular "red" ISP you'll note that using a third party DNS really makes their transparent proxy angry causing your internet to not appear snappy.

 

But, I run it for security - my network is overkill and I am on a 200/200Mbit plan. If you don't understand how DNS servers work (and how to set up a caching resolver) then you're best to stick with your ISP's DNS. If you're on an ISP like BigPipe who do nothing funky with your traffic then play around. But, my recommendation is to ensure that your resolver is caching queries locally and you should be fine. Also, ensure your device is powerful enough since dnscrypt uses encryption it can bog down the CPU if you're running it on lets say your router.





mdf

2629 posts

Uber Geek

Trusted
Subscriber

  #1537339 21-Apr-2016 11:40
Send private message

timbosan:

 

I know @michaelmurfy does and recently posted about it here http://www.geekzone.co.nz/forums.asp?forumid=66&topicid=195079 

I have looked into it but don't understand it enough to get it working on my setup (Untangle acting as a router on UFB connection).

What are the reasons for it?

 

 

We've been promised a tutorial!

 

There's a few reasons for it (as I understand it - I'm sure Michael will correct anything I've got wrong):

 

- Running your own DNS server (e.g. dnsmasq) is a much faster was of resolving domain names, particularly if you run it on a companion device, like an RPi

 

- This also leads to some potential "smart" DNS stuff - like blocking ads (pi-hole) and/or geographic jiggery pokery

 

- DNScrypt endeavours to provide some additional protections against things like DNS spoofing


/dev/null
9452 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #1537340 21-Apr-2016 11:42
Send private message

Hmm yes you were promised a tutorial however I have been incredibly busy lately so have not got around to it :) I have a test-bed VM ready to write one at some point however I am thinking of doing it on my blog.





1705 posts

Uber Geek


  #1537341 21-Apr-2016 11:42
Send private message

mdf:

 

timbosan:

 

I know @michaelmurfy does and recently posted about it here http://www.geekzone.co.nz/forums.asp?forumid=66&topicid=195079 

I have looked into it but don't understand it enough to get it working on my setup (Untangle acting as a router on UFB connection).

What are the reasons for it?

 

 

We've been promised a tutorial!

 

There's a few reasons for it (as I understand it - I'm sure Michael will correct anything I've got wrong):

 

- Running your own DNS server (e.g. dnsmasq) is a much faster was of resolving domain names, particularly if you run it on a companion device, like an RPi

 

- This also leads to some potential "smart" DNS stuff - like blocking ads (pi-hole) and/or geographic jiggery pokery

 

- DNScrypt endeavours to provide some additional protections against things like DNS spoofing

 



Thanks @mdf - BTW your link is broken, gets a 404.

I run Untangle on a BigPipe UFB connection and that does local DNS so will look into this more.


 
 
 
 


/dev/null
9452 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #1537344 21-Apr-2016 11:44
Send private message

timbosan:

Thanks @mdf - BTW your link is broken, gets a 404.

I run Untangle on a BigPipe UFB connection and that does local DNS so will look into this more.

 

 

That link is in the unblocker forums which is a private forum - many people around here have access so if you want access then PM me.





mdf

2629 posts

Uber Geek

Trusted
Subscriber

  #1537345 21-Apr-2016 11:45
Send private message

Sorry Michael, wasn't having a go. I am looking forward to it when you have sufficient time though.

 

@timbosan Link is to the private forums. Michael will hook you up if you need access.




Human
2982 posts

Uber Geek

Subscriber

  #1537427 21-Apr-2016 13:18
Send private message

michaelmurfy:

 

I have 2 DNS Resolvers here (1x Raspberry Pi, 1x VM on my server) both running dnscrypt and configuration kept in sync too. I use CloudNS for my nameservers (https://cloudns.com.au/) and latency is around 24ms which is not enough to worry about, my ISP is BigPipe who have no transparent proxies etc. I have suffered no loss of speed or "snappiness" from my internet since both DNS servers are set to cache DNS queries and keep their cache in sync.

 

If you're on a particular "red" ISP you'll note that using a third party DNS really makes their transparent proxy angry causing your internet to not appear snappy.

 

But, I run it for security - my network is overkill and I am on a 200/200Mbit plan. If you don't understand how DNS servers work (and how to set up a caching resolver) then you're best to stick with your ISP's DNS. If you're on an ISP like BigPipe who do nothing funky with your traffic then play around. But, my recommendation is to ensure that your resolver is caching queries locally and you should be fine. Also, ensure your device is powerful enough since dnscrypt uses encryption it can bog down the CPU if you're running it on lets say your router.

 

 

 

 

Interesting - I am on bigpipe too. 
I just changed my DNS over to cloudns and its actually seems to be a bit quicker. Will monitor it over the next couple of days and see how it goes.

 

 

 

The provider I was using before was the dnscrypt.eu one (it was configured by default). I think the ping was around 100+ms to it, which is likely what caused the feeling of the slow down.

 

 

 

dnscrypt is running on my router- should be plenty of power for running a network of maybe 3 concurrent clients- (800mhz cpu)








Human
2982 posts

Uber Geek

Subscriber

  #1537485 21-Apr-2016 14:12
Send private message

freitasm:

 

I don't because there's no support in my current router, but it should. And if your ISP supports it then use the ISP DNS.

 

 

 

 

Do you mean DNSSEC?

 

I don't know any ISP's that support dnscrypt in NZ from the get go, AFAIK. 

 

 

 

I suppose I could just go down the route of using DNSSEC only. Does mean I'm trusting my ISP a bit more, but I think I could probably live with that.
I will check what the performance is with not having DNSCrypt running on the router, if the performance is negligible, then I'll just leave it as is, with the new DNS provider I'm using.  






What does this tag do
1026 posts

Uber Geek

Subscriber

  #1537515 21-Apr-2016 14:52
Send private message

The best setup, is to have your router send through the ISP's DNS servers on DHCP

 

So that when you run an ipconfig /all you see public IP addresses under DNS servers (rather than your router's IP address).

 

This will let clients determine the best DNS server, handle DNSsec themselves etc

 

Unfortunately some routers don't let you do this (looking at you Fritz!Box!)


1995 posts

Uber Geek

Trusted
Subscriber

  #1537522 21-Apr-2016 14:57
Send private message

But if no NZ ISPs offer DNSsec then how is that the "best setup"/\?





CPU: Intel 3770k| RAM: F3-2400C10D-16GTX G.Skill Trident X |MB:  Gigabyte Z77X-UD5H-WB | GFX: GV-N660OC-2GD gv-n660oc-2gd GeForce GTX 660 | Monitor: Qnix 27" 2560x1440

 

 


What does this tag do
1026 posts

Uber Geek

Subscriber

  #1537576 21-Apr-2016 15:57
Send private message

Sorry mentalinc yeah slightly off topic. I got distracted and meant to say I don't agree with the comment about running your own DNS resolver being faster than using 3rd party or ISP DNS.
I think some ISPs may have DNSsec now, but probably a lot of routers won't support it (or do so badly) - so trying to use ISP DNS directly in Windows may produce better results than going through router.

Worth testing out the GRC DNS benchmarking tool and see how it compares using ISP vs the Australia one mentioned earlier

/dev/null
9452 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  #1537579 21-Apr-2016 16:03
Send private message

mentalinc:

But if no NZ ISPs offer DNSsec then how is that the "best setup"/\?



The BigPipe default nameservers support dnssec. Not dnscrypt.




 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic




News »

Freeview On Demand app launches on Sony Android TVs
Posted 6-Aug-2020 13:35


UFB hits more than one million connections
Posted 6-Aug-2020 09:42


D-Link A/NZ extends COVR Wi-Fi EasyMesh System series with new three-pack
Posted 4-Aug-2020 15:01


New Zealand software Rfider tracks coffee from Colombia all the way to New Zealand businesses
Posted 3-Aug-2020 10:35


Logitech G launches Pro X Wireless gaming headset
Posted 3-Aug-2020 10:21


Sony Alpha 7S III provides supreme imaging performance
Posted 3-Aug-2020 10:11


Sony introduces first CFexpress Type A memory card
Posted 3-Aug-2020 10:05


Marsello acquires Goody consolidating online and in-store marketing position
Posted 30-Jul-2020 16:26


Fonterra first major customer for Microsoft's New Zealand datacentre
Posted 30-Jul-2020 08:07


Everything we learnt at the IBM Cloud Forum 2020
Posted 29-Jul-2020 14:45


Dropbox launches native HelloSign workflow and data residency in Australia
Posted 29-Jul-2020 12:48


Spark launches 5G in Palmerston North
Posted 29-Jul-2020 09:50


Lenovo brings speed and smarter features to new 5G mobile gaming phone
Posted 28-Jul-2020 22:00


Withings raises $60 million to enable bridge between patients and healthcare
Posted 28-Jul-2020 21:51


QNAP integrates Catalyst Cloud Object Storage into Hybrid Backup solution
Posted 28-Jul-2020 21:40



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.