Static Server
Test suite that connects DUT1 over DUT0 using DoH. Meanwhile, DUT0 establishes a connection with the upstream server and forwards DNS queries to it.
Server With Upstream DoH
Description
Configures DUT0 to connect, using DNS-over-HTTPS (DoH) over an upstream server.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD protocol dns-over-https hash 7a276ec6f016f07a2d927114530d93b01a6cd79114899028c0cea34c7e3237d1 set service dns proxy static RD protocol dns-over-https host name remote.dns set service dns proxy static RD protocol dns-over-https ip 10.215.168.1 set service dns resolver local set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
^(?m)^.*\[RD\] OK \(DoH\) - rtt: \d+ms$Show output
Jul 28 08:38:39.610349 osdx systemd-journald[1773]: Runtime Journal (/run/log/journal/a46937b51a3a4c469575696f63c9d620) is 2.0M, max 15.3M, 13.2M free. Jul 28 08:38:39.613911 osdx systemd-journald[1773]: Received client request to rotate journal, rotating. Jul 28 08:38:39.613997 osdx systemd-journald[1773]: Vacuuming done, freed 0B of archived journals from /run/log/journal/a46937b51a3a4c469575696f63c9d620. Jul 28 08:38:39.636452 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:38:40.283990 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:38:40.904456 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:38:41.187733 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 28 08:38:41.321504 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:38:41.568486 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:38:41.720775 osdx ubnt-cfgd[118688]: inactive Jul 28 08:38:41.851587 osdx INFO[118696]: FRR daemons did not change Jul 28 08:38:41.958312 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:38:42.427884 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:38:42.491060 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:38:42.542877 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:38:42.941075 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 28 08:38:45.113315 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:38:45.303282 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'. Jul 28 08:38:45.487076 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'. Jul 28 08:38:45.769772 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'. Jul 28 08:38:45.953077 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'. Jul 28 08:38:46.066696 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash 7a276ec6f016f07a2d927114530d93b01a6cd79114899028c0cea34c7e3237d1'. Jul 28 08:38:46.205099 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'. Jul 28 08:38:46.339475 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'. Jul 28 08:38:46.490474 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns resolver local'. Jul 28 08:38:46.628440 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'. Jul 28 08:38:46.825340 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:38:47.034703 osdx ubnt-cfgd[118851]: inactive Jul 28 08:38:47.094439 osdx INFO[118859]: FRR daemons did not change Jul 28 08:38:47.129461 osdx ca-certificates[118875]: Updating certificates in /etc/ssl/certs... Jul 28 08:38:48.651480 osdx ubnt-cfgd[119873]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:38:48.675149 osdx ca-certificates[119880]: 1 added, 0 removed; done. Jul 28 08:38:48.681785 osdx ca-certificates[119885]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:38:48.696650 osdx ca-certificates[119887]: done. Jul 28 08:38:49.051285 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:38:49.076697 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:38:49.085565 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:38:49.114508 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:38:49.114508 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Network connectivity detected Jul 28 08:38:49.115189 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Dropping privileges Jul 28 08:38:49.119029 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Network connectivity detected Jul 28 08:38:49.119127 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:38:49.119127 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:38:49.119127 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH] Jul 28 08:38:49.119127 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Firefox workaround initialized Jul 28 08:38:49.119127 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpaqxjueit] Jul 28 08:38:49.184278 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:38:49.495172 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] [RD] OK (DoH) - rtt: 114ms Jul 28 08:38:49.495172 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] Server with the lowest initial latency: RD (rtt: 114ms) Jul 28 08:38:49.495172 osdx dnscrypt-proxy[119947]: [2025-07-28 08:38:49] [NOTICE] dnscrypt-proxy is ready - live servers: 1
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:
^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$Show output
Jul 28 08:38:40.699120 osdx systemd-journald[1575]: Runtime Journal (/run/log/journal/f2423ef2694c4ab083bba56aa5a0f772) is 992.0K, max 7.2M, 6.2M free. Jul 28 08:38:40.701785 osdx systemd-journald[1575]: Received client request to rotate journal, rotating. Jul 28 08:38:40.701883 osdx systemd-journald[1575]: Vacuuming done, freed 0B of archived journals from /run/log/journal/f2423ef2694c4ab083bba56aa5a0f772. Jul 28 08:38:40.738362 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:38:41.309960 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:38:44.115318 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:38:44.370776 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Jul 28 08:38:44.478650 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:38:44.638056 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service ssh'. Jul 28 08:38:44.841625 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:38:45.010232 osdx ubnt-cfgd[62470]: inactive Jul 28 08:38:45.064943 osdx INFO[62484]: FRR daemons did not change Jul 28 08:38:45.097765 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:38:45.346673 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Jul 28 08:38:45.368953 osdx sshd[62598]: Server listening on 0.0.0.0 port 22. Jul 28 08:38:45.369283 osdx sshd[62598]: Server listening on :: port 22. Jul 28 08:38:45.369514 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Jul 28 08:38:45.426814 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:38:45.444772 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:38:45.483489 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:38:45.717816 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jul 28 08:38:50.771256 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:38:50.912960 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Jul 28 08:38:51.063158 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Jul 28 08:38:51.259871 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Jul 28 08:38:51.420444 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Jul 28 08:38:51.518930 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Jul 28 08:38:51.635083 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Jul 28 08:38:51.795977 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae'. Jul 28 08:38:52.038499 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:38:52.166773 osdx ubnt-cfgd[62654]: inactive Jul 28 08:38:52.228191 osdx INFO[62662]: FRR daemons did not change Jul 28 08:38:52.271756 osdx ca-certificates[62678]: Updating certificates in /etc/ssl/certs... Jul 28 08:38:53.561323 osdx ubnt-cfgd[63676]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:38:53.585527 osdx ca-certificates[63683]: 1 added, 0 removed; done. Jul 28 08:38:53.592693 osdx ca-certificates[63688]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:38:53.599186 osdx ca-certificates[63690]: done. Jul 28 08:38:53.750525 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:38:53.753100 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:38:53.757042 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:38:53.798531 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:38:53.799071 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] Network connectivity detected Jul 28 08:38:53.799514 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] Dropping privileges Jul 28 08:38:53.803197 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:38:53.804770 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] Network connectivity detected Jul 28 08:38:53.804893 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:38:53.804953 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:38:53.805033 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] Firefox workaround initialized Jul 28 08:38:53.805096 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:53] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpz4iiksnw] Jul 28 08:38:54.106244 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:54] [NOTICE] [DUT0] OK (DoH) - rtt: 118ms Jul 28 08:38:54.106244 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:54] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 118ms) Jul 28 08:38:54.106244 osdx dnscrypt-proxy[63697]: [2025-07-28 08:38:54] [NOTICE] dnscrypt-proxy is ready - live servers: 1 Jul 28 08:38:54.139470 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal show | cat'.
Step 5: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:
teldat.com has address 10.11.12.13Show output
;; communications error to ::1#53: connection refused ;; communications error to ::1#53: connection refused teldat.com has address 10.11.12.13
Server With Upstream DoH With Stamp
Description
Configures DUT0 to connect, using DNS-over-HTTPS (DoH) over an upstream server (generating a DNS stamp and using it to configure the connection).
Scenario
Step 1: Run command service dns proxy stamp calculate dns-over-https host-name remote.dns host-path /dns-query host-port 443 ip 10.215.168.1 hash 7a276ec6f016f07a2d927114530d93b01a6cd79114899028c0cea34c7e3237d1 at DUT0 and expect this output:
Show output
sdns://AgAAAAAAAAAADDEwLjIxNS4xNjguMSB6J27G8Bbwei2ScRRTDZOwGmzXkRSJkCjAzqNMfjI30QpyZW1vdGUuZG5zCi9kbnMtcXVlcnk
Step 2: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD stamp 'sdns://AgAAAAAAAAAADDEwLjIxNS4xNjguMSB6J27G8Bbwei2ScRRTDZOwGmzXkRSJkCjAzqNMfjI30QpyZW1vdGUuZG5zCi9kbnMtcXVlcnk' set service dns resolver local set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
^(?m)^.*\[RD\] OK \(DoH\) - rtt: \d+ms$Show output
Jul 28 08:39:09.494773 osdx systemd-journald[1773]: Runtime Journal (/run/log/journal/a46937b51a3a4c469575696f63c9d620) is 2.0M, max 15.3M, 13.3M free. Jul 28 08:39:09.495693 osdx systemd-journald[1773]: Received client request to rotate journal, rotating. Jul 28 08:39:09.495762 osdx systemd-journald[1773]: Vacuuming done, freed 0B of archived journals from /run/log/journal/a46937b51a3a4c469575696f63c9d620. Jul 28 08:39:09.518459 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:39:09.974776 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:39:10.417591 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:39:10.596288 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 28 08:39:10.729629 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:39:10.924811 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:11.065072 osdx ubnt-cfgd[121649]: inactive Jul 28 08:39:11.114606 osdx INFO[121657]: FRR daemons did not change Jul 28 08:39:11.163337 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:39:11.372592 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:39:11.397803 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:39:11.465689 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:39:11.721510 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 28 08:39:13.889407 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-over-https host-name remote.dns host-path /dns-query host-port 443 ip 10.215.168.1 hash 7a276ec6f016f07a2d927114530d93b01a6cd79114899028c0cea34c7e3237d1'. Jul 28 08:39:14.145171 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:39:14.335007 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'. Jul 28 08:39:14.466364 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'. Jul 28 08:39:14.653897 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD stamp sdns://AgAAAAAAAAAADDEwLjIxNS4xNjguMSB6J27G8Bbwei2ScRRTDZOwGmzXkRSJkCjAzqNMfjI30QpyZW1vdGUuZG5zCi9kbnMtcXVlcnk'. Jul 28 08:39:14.856266 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'. Jul 28 08:39:15.047011 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'. Jul 28 08:39:15.219404 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'. Jul 28 08:39:15.426206 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns resolver local'. Jul 28 08:39:15.608261 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'. Jul 28 08:39:15.897774 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:16.080945 osdx ubnt-cfgd[121816]: inactive Jul 28 08:39:16.187180 osdx INFO[121824]: FRR daemons did not change Jul 28 08:39:16.216963 osdx ca-certificates[121840]: Updating certificates in /etc/ssl/certs... Jul 28 08:39:17.778466 osdx ubnt-cfgd[122838]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:39:17.845797 osdx ca-certificates[122844]: 1 added, 0 removed; done. Jul 28 08:39:17.858869 osdx ca-certificates[122850]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:39:17.865505 osdx ca-certificates[122852]: done. Jul 28 08:39:18.254638 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:39:18.263006 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:39:18.268580 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:39:18.310739 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:39:18.311228 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Network connectivity detected Jul 28 08:39:18.311770 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Dropping privileges Jul 28 08:39:18.331209 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Network connectivity detected Jul 28 08:39:18.331209 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:39:18.331209 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:39:18.331209 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH] Jul 28 08:39:18.331209 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Firefox workaround initialized Jul 28 08:39:18.331209 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Loading the set of cloaking rules from [/tmp/tmp6hymgzhw] Jul 28 08:39:18.337277 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:39:18.556798 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] [RD] OK (DoH) - rtt: 114ms Jul 28 08:39:18.557098 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] Server with the lowest initial latency: RD (rtt: 114ms) Jul 28 08:39:18.557098 osdx dnscrypt-proxy[122912]: [2025-07-28 08:39:18] [NOTICE] dnscrypt-proxy is ready - live servers: 1
Step 4: Run command service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae at DUT1 and expect this output:
Show output
sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg8uZKJlpeiLFZcSn0X8fmjBYM7IwyU-S2fzavb9eUda4NZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5
Step 5: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server-name DUT0 set service dns proxy static DUT0 stamp 'sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg8uZKJlpeiLFZcSn0X8fmjBYM7IwyU-S2fzavb9eUda4NZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5' set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 6: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:
^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$Show output
Jul 28 08:39:09.545611 osdx systemd-journald[1575]: Runtime Journal (/run/log/journal/f2423ef2694c4ab083bba56aa5a0f772) is 1020.0K, max 7.2M, 6.2M free. Jul 28 08:39:09.553927 osdx systemd-journald[1575]: Received client request to rotate journal, rotating. Jul 28 08:39:09.553998 osdx systemd-journald[1575]: Vacuuming done, freed 0B of archived journals from /run/log/journal/f2423ef2694c4ab083bba56aa5a0f772. Jul 28 08:39:09.576705 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:39:09.956326 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:39:11.916115 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:39:12.067718 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Jul 28 08:39:12.176962 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:39:12.289716 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service ssh'. Jul 28 08:39:12.487714 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:12.603263 osdx ubnt-cfgd[65377]: inactive Jul 28 08:39:12.666399 osdx INFO[65391]: FRR daemons did not change Jul 28 08:39:12.701584 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:39:12.993999 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Jul 28 08:39:13.059000 osdx sshd[65505]: Server listening on 0.0.0.0 port 22. Jul 28 08:39:13.059394 osdx sshd[65505]: Server listening on :: port 22. Jul 28 08:39:13.059672 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Jul 28 08:39:13.095749 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:39:13.120592 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:39:13.167057 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:39:13.433061 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jul 28 08:39:18.820190 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae'. Jul 28 08:39:19.079740 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:39:19.277728 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Jul 28 08:39:19.417878 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Jul 28 08:39:19.611415 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Jul 28 08:39:19.800548 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 stamp sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg8uZKJlpeiLFZcSn0X8fmjBYM7IwyU-S2fzavb9eUda4NZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5'. Jul 28 08:39:20.044731 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:20.194427 osdx ubnt-cfgd[65560]: inactive Jul 28 08:39:20.245142 osdx INFO[65568]: FRR daemons did not change Jul 28 08:39:20.264897 osdx ca-certificates[65584]: Updating certificates in /etc/ssl/certs... Jul 28 08:39:21.467038 osdx ubnt-cfgd[66582]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:39:21.479924 osdx ca-certificates[66592]: 1 added, 0 removed; done. Jul 28 08:39:21.486616 osdx ca-certificates[66594]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:39:21.492896 osdx ca-certificates[66596]: done. Jul 28 08:39:21.666509 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:39:21.669763 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:39:21.682095 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:39:21.728968 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:39:21.740300 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:39:21.740300 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] Network connectivity detected Jul 28 08:39:21.740300 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] Dropping privileges Jul 28 08:39:21.750217 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] Network connectivity detected Jul 28 08:39:21.750542 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:39:21.750542 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:39:21.750542 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] Firefox workaround initialized Jul 28 08:39:21.750542 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:21] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpn8q_60mo] Jul 28 08:39:22.032338 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:22] [NOTICE] [DUT0] OK (DoH) - rtt: 130ms Jul 28 08:39:22.032338 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:22] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 130ms) Jul 28 08:39:22.033186 osdx dnscrypt-proxy[66603]: [2025-07-28 08:39:22] [NOTICE] dnscrypt-proxy is ready - live servers: 1 Jul 28 08:39:22.062772 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal show | cat'.
Step 7: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:
teldat.com has address 10.11.12.13Show output
;; communications error to ::1#53: connection refused ;; communications error to ::1#53: connection refused teldat.com has address 10.11.12.13
Server With Upstream DNSCrypt
Description
Configures DUT0 to connect, using DNSCrypt over an upstream server.
Scenario
Step 1: Run command service dns proxy dnscrypt public-key running://dnscrypt.crt at DUT0 and expect this output:
Show output
46:79:bf:bd:69:eb:a1:3b:87:3a:d8:fc:fa:4b:94:9f:9e:6d:10:1e:e6:7f:f0:72:18:86:7e:54:3d:3f:40:cc
Step 2: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD protocol dns-crypt ip 10.215.168.1 set service dns proxy static RD protocol dns-crypt port 8443 set service dns proxy static RD protocol dns-crypt provider name 2.dnscrypt-cert.remote.dns set service dns proxy static RD protocol dns-crypt provider public-key '46:79:bf:bd:69:eb:a1:3b:87:3a:d8:fc:fa:4b:94:9f:9e:6d:10:1e:e6:7f:f0:72:18:86:7e:54:3d:3f:40:cc' set service dns resolver local set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 3: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
^(?m)^.*\[RD\] OK \(DNSCrypt\) - rtt: \d+ms$Show output
Jul 28 08:39:37.536539 osdx systemd-journald[1773]: Runtime Journal (/run/log/journal/a46937b51a3a4c469575696f63c9d620) is 2.0M, max 15.3M, 13.2M free. Jul 28 08:39:37.545299 osdx systemd-journald[1773]: Received client request to rotate journal, rotating. Jul 28 08:39:37.545607 osdx systemd-journald[1773]: Vacuuming done, freed 0B of archived journals from /run/log/journal/a46937b51a3a4c469575696f63c9d620. Jul 28 08:39:37.569867 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:39:38.237952 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:39:38.801953 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:39:38.973475 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 28 08:39:39.189035 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:39:39.342137 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:39.518950 osdx ubnt-cfgd[124611]: inactive Jul 28 08:39:39.565557 osdx INFO[124619]: FRR daemons did not change Jul 28 08:39:39.599729 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:39:39.751955 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:39:39.788440 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:39:39.872268 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:39:40.144743 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 28 08:39:42.825476 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'service dns proxy dnscrypt public-key running://dnscrypt.crt'. Jul 28 08:39:43.062849 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:39:43.270823 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'. Jul 28 08:39:43.433426 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'. Jul 28 08:39:43.617559 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt ip 10.215.168.1'. Jul 28 08:39:43.832565 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt port 8443'. Jul 28 08:39:44.011323 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt provider name 2.dnscrypt-cert.remote.dns'. Jul 28 08:39:44.169832 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt provider public-key 46:79:bf:bd:69:eb:a1:3b:87:3a:d8:fc:fa:4b:94:9f:9e:6d:10:1e:e6:7f:f0:72:18:86:7e:54:3d:3f:40:cc'. Jul 28 08:39:44.300947 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns resolver local'. Jul 28 08:39:44.448340 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'. Jul 28 08:39:44.598837 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'. Jul 28 08:39:44.789451 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'. Jul 28 08:39:45.017848 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:45.191502 osdx ubnt-cfgd[124777]: inactive Jul 28 08:39:45.264489 osdx INFO[124785]: FRR daemons did not change Jul 28 08:39:45.313947 osdx ca-certificates[124801]: Updating certificates in /etc/ssl/certs... Jul 28 08:39:46.951153 osdx ubnt-cfgd[125799]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:39:46.965333 osdx ca-certificates[125804]: 1 added, 0 removed; done. Jul 28 08:39:46.970781 osdx ca-certificates[125811]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:39:46.977749 osdx ca-certificates[125813]: done. Jul 28 08:39:47.240312 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:39:47.242171 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:39:47.245536 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:39:47.286424 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:39:47.286941 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Network connectivity detected Jul 28 08:39:47.287469 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Dropping privileges Jul 28 08:39:47.296789 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:39:47.300557 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Network connectivity detected Jul 28 08:39:47.300557 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:39:47.300557 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:39:47.300557 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH] Jul 28 08:39:47.300557 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Firefox workaround initialized Jul 28 08:39:47.300557 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpc_0h_y54] Jul 28 08:39:47.301670 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] [RD] OK (DNSCrypt) - rtt: 0ms Jul 28 08:39:47.301670 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] Server with the lowest initial latency: RD (rtt: 0ms) Jul 28 08:39:47.301670 osdx dnscrypt-proxy[125873]: [2025-07-28 08:39:47] [NOTICE] dnscrypt-proxy is ready - live servers: 1
Step 4: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server-name DUT0 set service dns proxy static DUT0 protocol dns-over-https hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0 set service dns proxy static DUT0 protocol dns-over-https host port 3000 set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64 set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 5: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:
^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$Show output
Jul 28 08:39:37.581734 osdx systemd-journald[1575]: Runtime Journal (/run/log/journal/f2423ef2694c4ab083bba56aa5a0f772) is 1.8M, max 7.2M, 5.4M free. Jul 28 08:39:37.582515 osdx systemd-journald[1575]: Received client request to rotate journal, rotating. Jul 28 08:39:37.582588 osdx systemd-journald[1575]: Vacuuming done, freed 0B of archived journals from /run/log/journal/f2423ef2694c4ab083bba56aa5a0f772. Jul 28 08:39:37.616346 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:39:38.208919 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:39:40.350218 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:39:40.502717 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Jul 28 08:39:40.653269 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:39:40.828128 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service ssh'. Jul 28 08:39:41.044722 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:41.224360 osdx ubnt-cfgd[68279]: inactive Jul 28 08:39:41.318345 osdx INFO[68293]: FRR daemons did not change Jul 28 08:39:41.414119 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:39:41.742944 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Jul 28 08:39:41.799624 osdx sshd[68407]: Server listening on 0.0.0.0 port 22. Jul 28 08:39:41.802147 osdx sshd[68407]: Server listening on :: port 22. Jul 28 08:39:41.803014 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Jul 28 08:39:41.897102 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:39:41.916180 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:39:42.041241 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:39:42.382257 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jul 28 08:39:47.869463 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:39:48.027594 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Jul 28 08:39:48.310720 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Jul 28 08:39:48.426182 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Jul 28 08:39:48.626904 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'. Jul 28 08:39:48.751656 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'. Jul 28 08:39:48.918284 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'. Jul 28 08:39:49.099584 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae'. Jul 28 08:39:49.315233 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:39:49.585821 osdx ubnt-cfgd[68462]: inactive Jul 28 08:39:49.759601 osdx INFO[68470]: FRR daemons did not change Jul 28 08:39:49.786244 osdx ca-certificates[68484]: Updating certificates in /etc/ssl/certs... Jul 28 08:39:51.239954 osdx ubnt-cfgd[69484]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:39:51.257600 osdx ca-certificates[69488]: 1 added, 0 removed; done. Jul 28 08:39:51.278835 osdx ca-certificates[69496]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:39:51.300516 osdx ca-certificates[69498]: done. Jul 28 08:39:51.538571 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:39:51.543302 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:39:51.550963 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:39:51.606841 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:39:51.607177 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Network connectivity detected Jul 28 08:39:51.607302 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Dropping privileges Jul 28 08:39:51.620012 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Network connectivity detected Jul 28 08:39:51.620012 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:39:51.620012 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:39:51.620012 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Firefox workaround initialized Jul 28 08:39:51.620012 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpjv2r1trd] Jul 28 08:39:51.637258 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:39:51.940644 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal show | cat'. Jul 28 08:39:51.952345 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] [DUT0] OK (DoH) - rtt: 141ms Jul 28 08:39:51.952427 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 141ms) Jul 28 08:39:51.952427 osdx dnscrypt-proxy[69505]: [2025-07-28 08:39:51] [NOTICE] dnscrypt-proxy is ready - live servers: 1
Step 6: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:
teldat.com has address 10.11.12.13Show output
;; communications error to ::1#53: connection refused ;; communications error to ::1#53: connection refused teldat.com has address 10.11.12.13
Server With Upstream DNSCrypt With Stamp
Description
Configures DUT0 to connect, using DNSCrypt over an upstream server (generating a DNS stamp and using it to configure the connection).
Scenario
Step 1: Run command service dns proxy dnscrypt public-key running://dnscrypt.crt at DUT0 and expect this output:
Show output
46:79:bf:bd:69:eb:a1:3b:87:3a:d8:fc:fa:4b:94:9f:9e:6d:10:1e:e6:7f:f0:72:18:86:7e:54:3d:3f:40:cc
Step 2: Run command service dns proxy stamp calculate dns-crypt provider-name 2.dnscrypt-cert.remote.dns provider-key 46:79:bf:bd:69:eb:a1:3b:87:3a:d8:fc:fa:4b:94:9f:9e:6d:10:1e:e6:7f:f0:72:18:86:7e:54:3d:3f:40:cc ip 10.215.168.1 port 8443 at DUT0 and expect this output:
Show output
sdns://AQAAAAAAAAAAETEwLjIxNS4xNjguMTo4NDQzIEZ5v71p66E7hzrY_PpLlJ-ebRAe5n_wchiGflQ9P0DMGjIuZG5zY3J5cHQtY2VydC5yZW1vdGUuZG5z
Step 3: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server cert file 'running://dns.dut0.crt' set service dns proxy server cert key 'running://dns.dut0.key' set service dns proxy server-name RD set service dns proxy static RD stamp 'sdns://AQAAAAAAAAAAETEwLjIxNS4xNjguMTo4NDQzIEZ5v71p66E7hzrY_PpLlJ-ebRAe5n_wchiGflQ9P0DMGjIuZG5zY3J5cHQtY2VydC5yZW1vdGUuZG5z' set service dns resolver local set service dns static host-name teldat.com inet 10.11.12.13 set system certificate trust 'running://remote.dns-server.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:
^(?m)^.*\[RD\] OK \(DNSCrypt\) - rtt: \d+ms$Show output
Jul 28 08:40:07.503935 osdx systemd-journald[1773]: Runtime Journal (/run/log/journal/a46937b51a3a4c469575696f63c9d620) is 2.0M, max 15.3M, 13.2M free. Jul 28 08:40:07.505763 osdx systemd-journald[1773]: Received client request to rotate journal, rotating. Jul 28 08:40:07.505849 osdx systemd-journald[1773]: Vacuuming done, freed 0B of archived journals from /run/log/journal/a46937b51a3a4c469575696f63c9d620. Jul 28 08:40:07.522540 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:40:07.953037 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:40:08.446296 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:40:08.679998 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'. Jul 28 08:40:08.809196 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:40:08.979617 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:40:09.110643 osdx ubnt-cfgd[127573]: inactive Jul 28 08:40:09.157504 osdx INFO[127581]: FRR daemons did not change Jul 28 08:40:09.193763 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:40:09.385054 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:40:09.406174 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:40:09.464331 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:40:09.701010 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'. Jul 28 08:40:11.973966 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'service dns proxy dnscrypt public-key running://dnscrypt.crt'. Jul 28 08:40:12.208600 osdx OSDxCLI[70716]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-crypt provider-name 2.dnscrypt-cert.remote.dns provider-key 46:79:bf:bd:69:eb:a1:3b:87:3a:d8:fc:fa:4b:94:9f:9e:6d:10:1e:e6:7f:f0:72:18:86:7e:54:3d:3f:40:cc ip 10.215.168.1 port 8443'. Jul 28 08:40:12.504088 osdx OSDxCLI[70716]: User 'admin' entered the configuration menu. Jul 28 08:40:12.760680 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'. Jul 28 08:40:12.891330 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'. Jul 28 08:40:13.106112 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy static RD stamp sdns://AQAAAAAAAAAAETEwLjIxNS4xNjguMTo4NDQzIEZ5v71p66E7hzrY_PpLlJ-ebRAe5n_wchiGflQ9P0DMGjIuZG5zY3J5cHQtY2VydC5yZW1vdGUuZG5z'. Jul 28 08:40:13.236670 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns resolver local'. Jul 28 08:40:13.440486 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'. Jul 28 08:40:13.661932 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'. Jul 28 08:40:13.810846 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'. Jul 28 08:40:14.001290 osdx OSDxCLI[70716]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:40:14.158669 osdx ubnt-cfgd[127739]: inactive Jul 28 08:40:14.225274 osdx INFO[127747]: FRR daemons did not change Jul 28 08:40:14.254234 osdx ca-certificates[127763]: Updating certificates in /etc/ssl/certs... Jul 28 08:40:15.555773 osdx ubnt-cfgd[128761]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:40:15.573428 osdx ca-certificates[128766]: 1 added, 0 removed; done. Jul 28 08:40:15.580661 osdx ca-certificates[128773]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:40:15.587261 osdx ca-certificates[128775]: done. Jul 28 08:40:15.786355 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:40:15.788367 osdx cfgd[1473]: [70716]Completed change to active configuration Jul 28 08:40:15.791536 osdx OSDxCLI[70716]: User 'admin' committed the configuration. Jul 28 08:40:15.834030 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:40:15.834386 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Network connectivity detected Jul 28 08:40:15.834597 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Dropping privileges Jul 28 08:40:15.835450 osdx OSDxCLI[70716]: User 'admin' left the configuration menu. Jul 28 08:40:15.838131 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Network connectivity detected Jul 28 08:40:15.838204 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:40:15.838204 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:40:15.838204 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH] Jul 28 08:40:15.838301 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Firefox workaround initialized Jul 28 08:40:15.838301 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpa5dupxzn] Jul 28 08:40:15.839129 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] [RD] OK (DNSCrypt) - rtt: 0ms Jul 28 08:40:15.839231 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] Server with the lowest initial latency: RD (rtt: 0ms) Jul 28 08:40:15.839317 osdx dnscrypt-proxy[128835]: [2025-07-28 08:40:15] [NOTICE] dnscrypt-proxy is ready - live servers: 1
Step 5: Run command service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae at DUT1 and expect this output:
Show output
sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg8uZKJlpeiLFZcSn0X8fmjBYM7IwyU-S2fzavb9eUda4NZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5
Step 6: Set the following configuration in DUT1 :
set interfaces ethernet eth0 address 10.215.168.65/24 set protocols static route 0.0.0.0/0 next-hop 10.215.168.1 set service dns proxy server-name DUT0 set service dns proxy static DUT0 stamp 'sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg8uZKJlpeiLFZcSn0X8fmjBYM7IwyU-S2fzavb9eUda4NZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5' set service dns static host-name dns.dut0 inet 10.215.168.64 set service ssh set system certificate trust 'running://CA.crt' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 7: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:
^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$Show output
Jul 28 08:40:07.499594 osdx systemd-journald[1575]: Runtime Journal (/run/log/journal/f2423ef2694c4ab083bba56aa5a0f772) is 1.8M, max 7.2M, 5.4M free. Jul 28 08:40:07.500483 osdx systemd-journald[1575]: Received client request to rotate journal, rotating. Jul 28 08:40:07.500541 osdx systemd-journald[1575]: Vacuuming done, freed 0B of archived journals from /run/log/journal/f2423ef2694c4ab083bba56aa5a0f772. Jul 28 08:40:07.528035 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal clear'. Jul 28 08:40:07.921322 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system coredump delete all'. Jul 28 08:40:09.803312 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:40:10.063656 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'. Jul 28 08:40:10.165219 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'. Jul 28 08:40:10.304886 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service ssh'. Jul 28 08:40:10.459024 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:40:10.590646 osdx ubnt-cfgd[71185]: inactive Jul 28 08:40:10.657505 osdx INFO[71199]: FRR daemons did not change Jul 28 08:40:10.696479 osdx kernel: 8021q: adding VLAN 0 to HW filter on device eth0 Jul 28 08:40:10.912947 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server... Jul 28 08:40:10.936586 osdx sshd[71313]: Server listening on 0.0.0.0 port 22. Jul 28 08:40:10.936933 osdx sshd[71313]: Server listening on :: port 22. Jul 28 08:40:10.937212 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server. Jul 28 08:40:11.280405 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:40:11.298616 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:40:11.352138 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:40:11.603959 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'. Jul 28 08:40:16.150097 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash f2e64a265a5e88b1597129f45fc7e68c160cec8c3253e4b67f36af6fd79475ae'. Jul 28 08:40:16.393460 osdx OSDxCLI[1850]: User 'admin' entered the configuration menu. Jul 28 08:40:16.509091 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'. Jul 28 08:40:16.637098 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'. Jul 28 08:40:16.745636 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'. Jul 28 08:40:16.897682 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 stamp sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg8uZKJlpeiLFZcSn0X8fmjBYM7IwyU-S2fzavb9eUda4NZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5'. Jul 28 08:40:17.022577 osdx OSDxCLI[1850]: User 'admin' added a new cfg line: 'show working'. Jul 28 08:40:17.137309 osdx ubnt-cfgd[71368]: inactive Jul 28 08:40:17.170878 osdx INFO[71376]: FRR daemons did not change Jul 28 08:40:17.193637 osdx ca-certificates[71392]: Updating certificates in /etc/ssl/certs... Jul 28 08:40:18.294627 osdx ubnt-cfgd[72390]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL Jul 28 08:40:18.313292 osdx ca-certificates[72396]: 1 added, 0 removed; done. Jul 28 08:40:18.321522 osdx ca-certificates[72402]: Running hooks in /etc/ca-certificates/update.d... Jul 28 08:40:18.329487 osdx ca-certificates[72404]: done. Jul 28 08:40:18.589304 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy. Jul 28 08:40:18.592763 osdx cfgd[1277]: [1850]Completed change to active configuration Jul 28 08:40:18.599903 osdx OSDxCLI[1850]: User 'admin' committed the configuration. Jul 28 08:40:18.637921 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] dnscrypt-proxy 2.0.45 Jul 28 08:40:18.638394 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Network connectivity detected Jul 28 08:40:18.638710 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Dropping privileges Jul 28 08:40:18.646217 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Network connectivity detected Jul 28 08:40:18.646217 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Now listening to 127.0.0.1:53 [UDP] Jul 28 08:40:18.646217 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Now listening to 127.0.0.1:53 [TCP] Jul 28 08:40:18.646217 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Firefox workaround initialized Jul 28 08:40:18.646217 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpix58evqg] Jul 28 08:40:18.647558 osdx OSDxCLI[1850]: User 'admin' left the configuration menu. Jul 28 08:40:18.911943 osdx OSDxCLI[1850]: User 'admin' executed a new command: 'system journal show | cat'. Jul 28 08:40:18.991222 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] [DUT0] OK (DoH) - rtt: 119ms Jul 28 08:40:18.991222 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 119ms) Jul 28 08:40:18.991222 osdx dnscrypt-proxy[72411]: [2025-07-28 08:40:18] [NOTICE] dnscrypt-proxy is ready - live servers: 1
Step 8: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:
teldat.com has address 10.11.12.13Show output
;; communications error to ::1#53: connection refused ;; communications error to ::1#53: connection refused teldat.com has address 10.11.12.13