Site Tools


advanced-dhcpdns

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
advanced-dhcpdns [2024/11/10 02:49] – [DHCP / DNS Server (LAN)] -Fixed explanation of Generate a Name for DHCP clients hogwildadvanced-dhcpdns [2025/08/13 03:53] (current) – [DHCP Client (WAN)] hogwild
Line 1: Line 1:
 ====== DHCP/DNS/TFTP ====== ====== DHCP/DNS/TFTP ======
  
-This menu let you configure advanced settings for the DHCP, DNS and TFTP services for both the LAN and WAN. Most of this functionality is provided by [[https://thekelleys.org.uk/|dnsmasq]].+Here, you can configure advanced settings for the DHCP, DNS and TFTP services for both LAN and WAN. Most of this functionality is provided by [[https://thekelleys.org.uk/|dnsmasq]].
  
  
Line 12: Line 12:
 {{:pasted:20220119-170756.png}}\\  \\ {{:pasted:20220119-170756.png}}\\  \\
  
-**Enable DNSSEC support: ** Enables support for DNS Security.+**Enable DNSSEC support: **enables support for DNS Security.
  
 DNSSEC secures DNS by authenticating its servers. It prevents DNS hacking and poisoning. If the authoritative DNS server has DNSSEC, enabling it ensures DNS queries are answered by //that//  DNS server, and not an imposter. DNSSEC secures DNS by authenticating its servers. It prevents DNS hacking and poisoning. If the authoritative DNS server has DNSSEC, enabling it ensures DNS queries are answered by //that//  DNS server, and not an imposter.
Line 20: Line 20:
  \\  \\
  
-**Use dnscrypt-proxy:  **enables DNSCrypt to encrypt DNS resolution.+**Use dnscrypt-proxy: **enables DNSCrypt to encrypt DNS resolution.
  
 When a DNSCrypt-enabled server is chosen, a unique key pair is generated every hour. Queries are then encrypted using this key pair before being sent to the server, usually on TCP port 443. The reply is also encrypted. Checking //Use dnscrypt-proxy// enables the built-in dnscrypt proxy client. Dnscrypt-proxy and Stubby cannot be used at the same time. When a DNSCrypt-enabled server is chosen, a unique key pair is generated every hour. Queries are then encrypted using this key pair before being sent to the server, usually on TCP port 443. The reply is also encrypted. Checking //Use dnscrypt-proxy// enables the built-in dnscrypt proxy client. Dnscrypt-proxy and Stubby cannot be used at the same time.
Line 30: Line 30:
   * Ephemeral Keys - if checked, a new key pair is generated for each  \\ DNS query. Use this with care, as it's very cpu-intensive, and may\\ slow DNS resolution.   * Ephemeral Keys - if checked, a new key pair is generated for each  \\ DNS query. Use this with care, as it's very cpu-intensive, and may\\ slow DNS resolution.
  
-  * Manual Entry - if enabled, 3 more fields are displayed:  +  * Manual Entry - if enabled, 3 more fields appear:  
-    * Resolver Address - the IP address of the dnscrypt-enabled DNS server. +    * Resolver Address - the IP of the dnscrypt-enabled DNS server. 
-    * Provider Name - the name of the DNS provider, for instance FreshTomato. +    * Provider Name - the DNS provider name(e.g. "FreshTomato")
-    * Provider Public Key - the public key given by the DNSCRYPT-enabled \\ DNS provider \\ (to generate a key pair)+    * Provider Public Key - the public key from the DNSCRYPT-enabled \\ DNS provider (to generate a key pair)
  
-  * Resolver - a dropdown list currently containung about 200 DNS servers.+  * Resolver - a dropdown list of about 200 DNS servers.
     * Some support DNSSEC.      * Some support DNSSEC. 
     * Some don't log queries.      * Some don't log queries. 
     * Some are filtered.     * Some are filtered.
  
-  * Priority - should be left at //no-resolv// to prevent DNS leaks. This should  \\ neve be selected if using DNSCRYPT. Also, to prevent leaks, enable \\ //Intercept DNS port//.+  * Priority - should be left at //no-resolv// to prevent DNS leaks. \\ This should never be selected if DNSCRYPT is enabled\\ To prevent leaks, enable //Intercept DNS port//.
  
-  * Local Port - the port on which dnscrypt-proxy communicates with \\ FreshTomato DNS. \\ Leave at 40 unless you're an advanced user. Don't set it to 53, it could create a loop.+  * Local Port - the port on which dnscrypt-proxy speaks with \\ FreshTomato DNS. Leave this at 40 unless you're advanced. \\ Don't set it to 53, it could create a loop.
  
  \\   \\ To help choose a DNSCrypt DNS provider, import the file /etc/dnscrypt-resolvers.csv in a spreadsheet. Once chosen, \\ the server's IP address, provider name, and public key can be taken from that file.  \\   \\ To help choose a DNSCrypt DNS provider, import the file /etc/dnscrypt-resolvers.csv in a spreadsheet. Once chosen, \\ the server's IP address, provider name, and public key can be taken from that file.
Line 48: Line 48:
  \\  \\
  
-**Use Stubby (DNS-over-TLS):** enables the Stubby DNS Stub resolver, to enhance DNS privacy.+**Use Stubby** (DNS-over-TLS)**:** enables the Stubby DNS Stub resolver, to enhance DNS privacy.
  
 DNS over TLS ("DoT") sends DNS queries via a secure (TLS-encrypted) connection. TLS is the same technology \\ that encrypts secure Web traffic. This prevents third parties from seeing your DNS queries. DNS over TLS ("DoT") sends DNS queries via a secure (TLS-encrypted) connection. TLS is the same technology \\ that encrypts secure Web traffic. This prevents third parties from seeing your DNS queries.
  
- \\+  * **Show/Hide Servers**: checking this displays a table of possible Stubby servers to be used. \\ Unchecking this hides the table.
  
-When Stubby is enabled, further options appear:+ \\  \\
  
 {{:pasted:20220420-181042.png}} {{:pasted:20220420-181042.png}}
Line 60: Line 60:
  \\  \\
  
-**Upstream resolvers:** here, choose the upstream servers responsible for performing name resolution.+**Upstream resolvers:** The actual list/table of possible upstream servers to use for performing name resolution. 
 + 
 +Mousing over the name of any upstream resolver displays the following about about that server: 
 + 
 + \\ 
 + 
 +{{::advanced-dhcp_dns_tftp-stubby_mouseover.png?317}}\\ 
 + 
 +  - The IP versions supported 
 +  - The server's status 
 +  - Authorized domain - (the domain name used for \\ authentication between your Stubby client and \\ an upstream DNS server that \\ supports encrypted queries. 
 +  - The port used 
 + 
 +\\
  
  \\  \\
Line 88: Line 101:
 **WINS (for DHCP):** the IP address of a WINS Server to give to DHCP clients. **WINS (for DHCP):** the IP address of a WINS Server to give to DHCP clients.
  
-This doesn't enable WINS. WINS is enabled in the [[:nas-samba|File Sharing]] menu. +This doesn't enable WINS. WINS is enabled in the [[:nas-samba|File Sharing]] menu. WINS is an old name resolution service to map NetBIOS names to IP addresses. It's mostly obsolete. DNS was supposed to replace WINS. However, WINS may still be necessary for some LAN browsing functions on old Windows versions.
- +
-WINS is an old name resolution service to map NetBIOS names to IP addresses. It's mostly obsolete. DNS was supposed to replace WINS. However, WINS may still be necessary for some LAN browsing functions on old Windows versions.+
  
  \\  \\
Line 102: Line 113:
 //udhcpc// (the DHCP client FreshTomato uses to obtain a WAN IP address) has a problem. It has a DHCP discovery packet size 590 bytes long. However, DHCP relay servers can handle only DHCP discovery packets up to 576 bytes. If there are DHCP relay servers between FreshTomato and your ISP's DHCP server, FreshTomato might fail to acquire a DHCP lease on the WAN interface. //udhcpc// (the DHCP client FreshTomato uses to obtain a WAN IP address) has a problem. It has a DHCP discovery packet size 590 bytes long. However, DHCP relay servers can handle only DHCP discovery packets up to 576 bytes. If there are DHCP relay servers between FreshTomato and your ISP's DHCP server, FreshTomato might fail to acquire a DHCP lease on the WAN interface.
  
-The extra bytes were all padding, and thus unnecessary.  Developers eliminated the padding, reducing udhcpc DHCP discovery packet size to 331 bytes. This size became the default setting. Now, udhcpc can successfully obtain a DHCP lease from an ISP with DHCP relays.+The extra bytes were padding, and thus unnecessary.  Developers deleted the padding, reducing udhcpc DHCP discovery packet size to 331 bytes. This size became the default setting. Now, udhcpc can successfully obtain a DHCP lease from an ISP with DHCP relays.
  
 Some users may not be able to obtain a WAN IP address unless they disable this setting. (Default: Enabled). Some users may not be able to obtain a WAN IP address unless they disable this setting. (Default: Enabled).
Line 113: Line 124:
 {{:pasted:20220119-171212.png}}\\  \\ {{:pasted:20220119-171212.png}}\\  \\
  
-**Use internal DNS:** Uses dnsmasq as the LAN DNS server.+**Use internal DNS:** causes dnsmasq to be used as the LAN DNS server.
  
 DHCP clients receive the router's LAN IP as the DNS server address. (Default: Enabled). DHCP clients receive the router's LAN IP as the DNS server address. (Default: Enabled).
Line 147: Line 158:
  \\  \\
  
-**Generate a name for DHCP clients which do not otherwise have one**: if FreshTomato can't find a hostname for a client's DHCP/MAC combination, it will generate one for display, based on its MAC address.+**Generate a name for DHCP clients which do not otherwise have one**: if FreshTomato can't find a hostname for a client's DHCP/MAC combination, it generates one for display, based on its MAC address.
  
  \\  \\
Line 223: Line 234:
  \\  \\
  
-**Enable DNS Rebind protection:**  Helps prevent DNS Rebind DNS resolution attcks.+**Enable DNS Rebind protection:**  helps prevent DNS Rebind DNS resolution attcks.
  
 Using this may have side effects. (Default: Enabled). Using this may have side effects. (Default: Enabled).
Line 241: Line 252:
  \\  \\
  
-**Enable reflector:** FIXME+**Enable reflector:** enables the Avahi mDNS repeater mode. 
 + 
 +This makes Avahi re-transmit / re-multicast queries and responses via multiple interfaces. This allows the router to bridge multicast DNS networks. 
 + 
 +For details, see this tutorial: [[https://www.linksysinfo.org/index.php?threads/avahi-tutorial-configuring-a-reflector-aka-mdns-repeater.75706/|Tomato Forum: avahi tutorial configuring a reflector aka mdns repeater]]
  
  \\  \\
Line 267: Line 282:
 ===== DHCP/DNS/TFTP Notes ===== ===== DHCP/DNS/TFTP Notes =====
  
-  * Do not use results from Cloudflare's site: [[https://1.1.1.1/help|https://1.1.1.1/help]]. That webpage is likely to provide invalid results. Instead, use: [[https://rootcanary.org/test.html|https://rootcanary.org/test.html]] \\  \\  +Do not use results from Cloudflare's site: [[https://1.1.1.1/help|https://1.1.1.1/help]]. That webpage is likely to provide invalid results.  \\ Instead, use: [[https://rootcanary.org/test.html|https://rootcanary.org/test.html]] \\  \\ DNSSEC and DNSCrypt / Stubby complement each other. 
-  * DNSSEC and DNSCrypt / Stubby complement each other.  + 
-    * DNSSEC provides authentication. +  * DNSSEC provides authentication. 
-    * DNSCrypt provides encryption.+  * DNSCrypt provides encryption.
  
  
advanced-dhcpdns.1731206970.txt.gz · Last modified: by hogwild