i'm using ubuntu 18.04 and i tried to install dnscrypt using this tutorial

but when i tried to connect to a website it always failed, i tried to check the status of the dnscrypt service, and it shows error [ERROR] Unable to retrieve server certificates like this:

i tried to edit /etc/resolv.conf and change the nameserver to 127.0.2.1 but when i restarted the NetworkManager, the nameserver goes back to 127.0.0.53

after that i tried to disable these two, but nothing changes

sudo systemctl disable dnscrypt-proxy.service && sudo systemctl disable dnscrypt-proxy-resolvconf.service

I have configured a split tunnel VPN to connect my home computer to my corporate network. I can simultaneously ping internet hosts (by name) and corporate servers (but only by address, not name). tracepath confirms the traffic is using the appropriate interface, too. But I cannot resolve any hosts on the corp net by DNS. However, I can ping the corp net DNS server (at 192.168.0.253, for example), and nslookup sample.corp.local 192.168.0.253 resolves:

Server:     192.168.0.253
Address:    192.168.0.253#53

Name:   sample.corp.local
Address: 192.168.0.228

Digging into this, I see that network name resolution doesn't change when I activate the VPN connection, although the PPP link does receive the names of the corp net DNS servers (and an IP address from the corp net) (below).

This is apparently already a known issue with network-manager package.

I have tried the workaround described in the thread of installing dnscrypt-proxy, but that is not working for me and I don't know how to even start debugging it. Suggestions on that would be appreciated.

The thread also mentioned the possibility of killing dnsmasq process and letting it restart, but I do not see any such process running on 19.04.

I have also tried hard-coding the DNS info in a .network file, but that broke DNS resolution on both links. Advice on what I did wrong there would be appreciated.

file: /etc/systemd/network/50-vpn-corp.network

[Match]
Name=ppp*
[Network]
Description=VPN to corp net
DNS=192.168.0.254
Domains=corp.local

Ideally, I'd have names in corp.local domain be resolved by corp net DNS servers while names in internet domains be set out the internet link and resolved directly by global DNS servers, but I'll settle for sending all requests to the corporate network DNS servers. This is not a censorship scenario.

I'm running Ubuntu 19.04, network-manager-l2tp-gnome from the Canonical repository and connecting to a Cisco Meraki client VPN using this recommended VPN config.

With VPN active on PPP0, $ resolvectl status shows:

Global
       LLMNR setting: no
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
          DNSSEC NTA: 10.in-addr.arpa
                      16.172.in-addr.arpa
                      168.192.in-addr.arpa
                      17.172.in-addr.arpa
                      18.172.in-addr.arpa
                      19.172.in-addr.arpa
                      20.172.in-addr.arpa
                      21.172.in-addr.arpa
                      22.172.in-addr.arpa
                      23.172.in-addr.arpa
                      24.172.in-addr.arpa
                      25.172.in-addr.arpa
                      26.172.in-addr.arpa
                      27.172.in-addr.arpa
                      28.172.in-addr.arpa
                      29.172.in-addr.arpa
                      30.172.in-addr.arpa
                      31.172.in-addr.arpa
                      corp
                      d.f.ip6.arpa
                      home
                      internal
                      intranet
                      lan
                      local
                      private
                      test

Link 6 (ppp0)
      Current Scopes: none
DefaultRoute setting: no
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no

Link 2 (enp30s0)
      Current Scopes: DNS
DefaultRoute setting: yes
       LLMNR setting: yes
MulticastDNS setting: no
  DNSOverTLS setting: no
      DNSSEC setting: no
    DNSSEC supported: no
  Current DNS Server: 2600:1700:2d61:ca0::1
         DNS Servers: 127.0.0.2
                      2600:1700:2d61:ca0::1
          DNS Domain: ~.
                      attlocal.net

And $ cat /etc/ppp/resolv.conf shows:

nameserver 192.168.0.253
nameserver 192.168.1.253

I've recenly installed dnscrypt-proxy. The configuration file for it at /etc/dnscrypt-proxy/dnscrypt-proxy.toml has a blacklist section I'm currently using:

[blacklist]

  ## Path to the file of blocking rules (absolute, or relative to the same directory as the executable file)

blacklist_file = '/etc/dnscrypt-proxy/CustomIgnores.txt'

I was wondering whether this option replaces the redirects at /etc/hosts? Or that both are used?
What does the /etc/hosts file even belong to? And how does the Blacklist option for dnscrypt even work(I assume it also just redirects to localhost)? Thanks.

I've installed DNScrypt proxy from https://github.com/opendns/dnscrypt-proxy/downloads and installed it under Ubuntu 11.10 x64. I started the proxy by

sudo /usr/sbin/dnscrypt-proxy --daemonize

syslog states

dnscrypt-proxy[2615]: dnscrypt-proxy is ready: proxying from [127.0.0.1] to [208.67.220.220]

I set the dns to localhost and restart the connection by gui. But the local dns can not be reached:

dnscrypt-proxy[2615]: dnscrypt-proxy is ready: proxying from [127.0.0.1] to [208.67.220.220]

netstat

PID/Program name
tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN          2231/dnscrypt-proxy

Someone has an idea? Thanks a lot!

I have installed DNSCrypt , its OpenDNS encrypted DNS patch for Ubuntu & other Linux users & it's working fine.

How do I know if my DNS is encrypted? I have googled but didn't find anything.

Status

one@onezero:~$ status dnscrypt 
dnscrypt start/running, process 1013
one@onezero:~$ sudo netstat -atnlp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.2:53            0.0.0.0:*               LISTEN      1013/dnscrypt-proxy

Updated

Wireshark

@Alvar

without DNSCrypt