Static Server

Test suite that connects DUT1 over DUT0 using DoH. Meanwhile, DUT0 establishes a connection with the upstream server and forwards DNS queries to it.

Server With Upstream DoH

Description

Configures DUT0 to connect, using DNS-over-HTTPS (DoH) over an upstream server.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-over-https hash 3da01845fbcfc1579f9eca2d995ba22ecb78951c4fead8f8e986fc6d1e954848
set service dns proxy static RD protocol dns-over-https host name remote.dns
set service dns proxy static RD protocol dns-over-https ip 10.215.168.1
set service dns resolver local
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

^(?m)^.*\[RD\] OK \(DoH\) - rtt: \d+ms$

Show output

Sep 05 09:43:51.299748 osdx systemd-journald[1764]: Runtime Journal (/run/log/journal/8e652e5518b84f0bb5a60f6ad502329f) is 1.8M, max 13.8M, 11.9M free.
Sep 05 09:43:51.301700 osdx systemd-journald[1764]: Received client request to rotate journal, rotating.
Sep 05 09:43:51.301768 osdx systemd-journald[1764]: Vacuuming done, freed 0B of archived journals from /run/log/journal/8e652e5518b84f0bb5a60f6ad502329f.
Sep 05 09:43:51.310260 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:43:51.514901 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:43:51.737451 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:43:51.810576 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Sep 05 09:43:51.895686 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:43:51.961919 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:43:52.056128 osdx ubnt-cfgd[33382]: inactive
Sep 05 09:43:52.074822 osdx INFO[33390]: FRR daemons did not change
Sep 05 09:43:52.188008 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:43:52.199112 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:43:52.216388 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:43:52.351358 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Sep 05 09:43:53.400143 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:43:53.460143 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Sep 05 09:43:53.557513 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Sep 05 09:43:53.619414 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https host name remote.dns'.
Sep 05 09:43:53.726608 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https ip 10.215.168.1'.
Sep 05 09:43:53.825824 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-over-https hash 3da01845fbcfc1579f9eca2d995ba22ecb78951c4fead8f8e986fc6d1e954848'.
Sep 05 09:43:53.878178 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'.
Sep 05 09:43:53.974578 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'.
Sep 05 09:43:54.028868 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Sep 05 09:43:54.133139 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'.
Sep 05 09:43:54.204519 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:43:54.305268 osdx ubnt-cfgd[33547]: inactive
Sep 05 09:43:54.325054 osdx INFO[33555]: FRR daemons did not change
Sep 05 09:43:54.338263 osdx ca-certificates[33571]: Updating certificates in /etc/ssl/certs...
Sep 05 09:43:54.818988 osdx ubnt-cfgd[34569]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:43:54.826767 osdx ca-certificates[34575]: 1 added, 0 removed; done.
Sep 05 09:43:54.829783 osdx ca-certificates[34581]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:43:54.832499 osdx ca-certificates[34583]: done.
Sep 05 09:43:54.957944 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:43:54.959037 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:43:54.961065 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:43:54.977555 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:43:54.987802 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:43:54.988051 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Network connectivity detected
Sep 05 09:43:54.988298 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Dropping privileges
Sep 05 09:43:54.990422 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Network connectivity detected
Sep 05 09:43:54.990460 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:43:54.990460 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:43:54.990488 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH]
Sep 05 09:43:54.990488 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Firefox workaround initialized
Sep 05 09:43:54.990511 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:54] [NOTICE] Loading the set of cloaking rules from [/tmp/tmp9ct_7fgv]
Sep 05 09:43:55.160742 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system journal show | cat'.
Sep 05 09:43:55.250069 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:55] [NOTICE] [RD] OK (DoH) - rtt: 175ms
Sep 05 09:43:55.250069 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:55] [NOTICE] Server with the lowest initial latency: RD (rtt: 175ms)
Sep 05 09:43:55.250069 osdx dnscrypt-proxy[34643]: [2025-09-05 09:43:55] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:

^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$

Show output

Sep 05 09:43:51.267690 osdx systemd-journald[1555]: Runtime Journal (/run/log/journal/50a598a116a9494aab0ac4ddc8eeff40) is 900.0K, max 6.5M, 5.6M free.
Sep 05 09:43:51.271017 osdx systemd-journald[1555]: Received client request to rotate journal, rotating.
Sep 05 09:43:51.271070 osdx systemd-journald[1555]: Vacuuming done, freed 0B of archived journals from /run/log/journal/50a598a116a9494aab0ac4ddc8eeff40.
Sep 05 09:43:51.277271 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:43:51.475211 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:43:52.414456 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:43:52.492550 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Sep 05 09:43:52.577991 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:43:52.632231 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service ssh'.
Sep 05 09:43:52.744461 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:43:52.808536 osdx ubnt-cfgd[16306]: inactive
Sep 05 09:43:52.833538 osdx INFO[16320]: FRR daemons did not change
Sep 05 09:43:52.999300 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Sep 05 09:43:53.012945 osdx sshd[16434]: Server listening on 0.0.0.0 port 22.
Sep 05 09:43:53.013151 osdx sshd[16434]: Server listening on :: port 22.
Sep 05 09:43:53.013269 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Sep 05 09:43:53.032959 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:43:53.044063 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:43:53.066692 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:43:53.197863 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Sep 05 09:43:57.284770 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:43:57.343859 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Sep 05 09:43:57.445681 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Sep 05 09:43:57.511681 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Sep 05 09:43:57.616805 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Sep 05 09:43:57.696030 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Sep 05 09:43:57.808832 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Sep 05 09:43:57.868270 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2'.
Sep 05 09:43:57.985541 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:43:58.059657 osdx ubnt-cfgd[16489]: inactive
Sep 05 09:43:58.081954 osdx INFO[16497]: FRR daemons did not change
Sep 05 09:43:58.113674 osdx ca-certificates[16513]: Updating certificates in /etc/ssl/certs...
Sep 05 09:43:58.659553 osdx ubnt-cfgd[17511]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:43:58.673221 osdx ca-certificates[17515]: 1 added, 0 removed; done.
Sep 05 09:43:58.676286 osdx ca-certificates[17521]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:43:58.678903 osdx ca-certificates[17524]: done.
Sep 05 09:43:58.775416 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:43:58.777395 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:43:58.780865 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:43:58.797355 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:43:58.948893 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal show | cat'.
Sep 05 09:43:58.975689 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:43:58.975934 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] Network connectivity detected
Sep 05 09:43:58.975958 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] Dropping privileges
Sep 05 09:43:58.978439 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] Network connectivity detected
Sep 05 09:43:58.978439 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:43:58.978439 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:43:58.978439 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] Firefox workaround initialized
Sep 05 09:43:58.978439 osdx dnscrypt-proxy[17532]: [2025-09-05 09:43:58] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpqxsgrbej]
Sep 05 09:44:01.058881 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal show | cat'.
Sep 05 09:44:01.178733 osdx dnscrypt-proxy[17532]: [2025-09-05 09:44:01] [NOTICE] System DNS configuration not usable yet, exceptionally resolving [dns.dut0] using fallback resolvers over tcp
Sep 05 09:44:01.334251 osdx dnscrypt-proxy[17532]: [2025-09-05 09:44:01] [NOTICE] [DUT0] OK (DoH) - rtt: 128ms
Sep 05 09:44:01.334251 osdx dnscrypt-proxy[17532]: [2025-09-05 09:44:01] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 128ms)
Sep 05 09:44:01.334251 osdx dnscrypt-proxy[17532]: [2025-09-05 09:44:01] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 5: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:

teldat.com has address 10.11.12.13

Server With Upstream DoH With Stamp

Description

Configures DUT0 to connect, using DNS-over-HTTPS (DoH) over an upstream server (generating a DNS stamp and using it to configure the connection).

Scenario

Step 1: Run command service dns proxy stamp calculate dns-over-https host-name remote.dns host-path /dns-query host-port 443 ip 10.215.168.1 hash 3da01845fbcfc1579f9eca2d995ba22ecb78951c4fead8f8e986fc6d1e954848 at DUT0 and expect this output:

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD stamp 'sdns://AgAAAAAAAAAADDEwLjIxNS4xNjguMSA9oBhF-8_BV5-eyi2ZW6Iuy3iVHE_q2PjphvxtHpVISApyZW1vdGUuZG5zCi9kbnMtcXVlcnk'
set service dns resolver local
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

^(?m)^.*\[RD\] OK \(DoH\) - rtt: \d+ms$

Show output

Sep 05 09:44:08.000170 osdx systemd-timedated[20827]: Changed local time to Fri 2025-09-05 09:44:08 UTC
Sep 05 09:44:08.001278 osdx systemd-journald[1764]: Time jumped backwards, rotating.
Sep 05 09:44:08.001797 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'set date 2025-09-05 09:44:08'.
Sep 05 09:44:08.301214 osdx systemd-journald[1764]: Runtime Journal (/run/log/journal/8e652e5518b84f0bb5a60f6ad502329f) is 1.8M, max 13.8M, 11.9M free.
Sep 05 09:44:08.301612 osdx systemd-journald[1764]: Received client request to rotate journal, rotating.
Sep 05 09:44:08.301648 osdx systemd-journald[1764]: Vacuuming done, freed 0B of archived journals from /run/log/journal/8e652e5518b84f0bb5a60f6ad502329f.
Sep 05 09:44:08.311623 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:44:08.523778 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:44:08.740688 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:44:08.823803 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Sep 05 09:44:08.912366 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:44:08.987414 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:09.073279 osdx ubnt-cfgd[36352]: inactive
Sep 05 09:44:09.092404 osdx INFO[36360]: FRR daemons did not change
Sep 05 09:44:09.186780 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:44:09.200922 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:44:09.220916 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:44:09.364438 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Sep 05 09:44:10.445923 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-over-https host-name remote.dns host-path /dns-query host-port 443 ip 10.215.168.1 hash 3da01845fbcfc1579f9eca2d995ba22ecb78951c4fead8f8e986fc6d1e954848'.
Sep 05 09:44:10.598833 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:44:10.660449 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Sep 05 09:44:10.761752 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Sep 05 09:44:10.825085 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD stamp sdns://AgAAAAAAAAAADDEwLjIxNS4xNjguMSA9oBhF-8_BV5-eyi2ZW6Iuy3iVHE_q2PjphvxtHpVISApyZW1vdGUuZG5zCi9kbnMtcXVlcnk'.
Sep 05 09:44:10.921230 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'.
Sep 05 09:44:10.978089 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'.
Sep 05 09:44:11.075544 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'.
Sep 05 09:44:11.130661 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Sep 05 09:44:11.230459 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'.
Sep 05 09:44:11.307102 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:11.401738 osdx ubnt-cfgd[36517]: inactive
Sep 05 09:44:11.425801 osdx INFO[36525]: FRR daemons did not change
Sep 05 09:44:11.437700 osdx ca-certificates[36540]: Updating certificates in /etc/ssl/certs...
Sep 05 09:44:11.900365 osdx ubnt-cfgd[37539]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:44:11.907767 osdx ca-certificates[37544]: 1 added, 0 removed; done.
Sep 05 09:44:11.911500 osdx ca-certificates[37551]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:44:11.914424 osdx ca-certificates[37553]: done.
Sep 05 09:44:12.033530 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:44:12.034725 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:44:12.037238 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:44:12.068150 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:44:12.068424 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Network connectivity detected
Sep 05 09:44:12.068488 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Dropping privileges
Sep 05 09:44:12.070669 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Network connectivity detected
Sep 05 09:44:12.070701 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:44:12.070701 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:44:12.070735 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH]
Sep 05 09:44:12.070735 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Firefox workaround initialized
Sep 05 09:44:12.070735 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpwkyhxfhp]
Sep 05 09:44:12.074994 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:44:12.237668 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system journal show | cat'.
Sep 05 09:44:12.260499 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] [RD] OK (DoH) - rtt: 120ms
Sep 05 09:44:12.260499 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] Server with the lowest initial latency: RD (rtt: 120ms)
Sep 05 09:44:12.260499 osdx dnscrypt-proxy[37613]: [2025-09-05 09:44:12] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 4: Run command service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2 at DUT1 and expect this output:

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server-name DUT0
set service dns proxy static DUT0 stamp 'sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg4IcFjGRdM3YRJvlGzQ8-g7yJSLtRGqJmx0e3N87O27INZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5'
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:

^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$

Show output

Sep 05 09:44:08.000167 osdx systemd-timedated[15608]: Changed local time to Fri 2025-09-05 09:44:08 UTC
Sep 05 09:44:08.001656 osdx systemd-journald[1555]: Time jumped backwards, rotating.
Sep 05 09:44:08.002066 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'set date 2025-09-05 09:44:08'.
Sep 05 09:44:08.266523 osdx systemd-journald[1555]: Runtime Journal (/run/log/journal/50a598a116a9494aab0ac4ddc8eeff40) is 948.0K, max 6.5M, 5.5M free.
Sep 05 09:44:08.269655 osdx systemd-journald[1555]: Received client request to rotate journal, rotating.
Sep 05 09:44:08.269714 osdx systemd-journald[1555]: Vacuuming done, freed 0B of archived journals from /run/log/journal/50a598a116a9494aab0ac4ddc8eeff40.
Sep 05 09:44:08.276196 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:44:08.473095 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:44:09.430896 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:44:09.511037 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Sep 05 09:44:09.585180 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:44:09.689903 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service ssh'.
Sep 05 09:44:09.758355 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:09.855422 osdx ubnt-cfgd[19218]: inactive
Sep 05 09:44:09.880779 osdx INFO[19232]: FRR daemons did not change
Sep 05 09:44:10.034074 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Sep 05 09:44:10.045391 osdx sshd[19346]: Server listening on 0.0.0.0 port 22.
Sep 05 09:44:10.045589 osdx sshd[19346]: Server listening on :: port 22.
Sep 05 09:44:10.045709 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Sep 05 09:44:10.066383 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:44:10.077450 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:44:10.094226 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:44:10.238550 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Sep 05 09:44:14.359773 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2'.
Sep 05 09:44:14.494396 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:44:14.558518 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Sep 05 09:44:14.652903 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Sep 05 09:44:14.706257 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Sep 05 09:44:14.812396 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 stamp sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg4IcFjGRdM3YRJvlGzQ8-g7yJSLtRGqJmx0e3N87O27INZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5'.
Sep 05 09:44:14.883089 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:14.984261 osdx ubnt-cfgd[19401]: inactive
Sep 05 09:44:15.003840 osdx INFO[19409]: FRR daemons did not change
Sep 05 09:44:15.019361 osdx ca-certificates[19425]: Updating certificates in /etc/ssl/certs...
Sep 05 09:44:15.492939 osdx ubnt-cfgd[20423]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:44:15.503834 osdx ca-certificates[20429]: 1 added, 0 removed; done.
Sep 05 09:44:15.507911 osdx ca-certificates[20435]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:44:15.510795 osdx ca-certificates[20437]: done.
Sep 05 09:44:15.585938 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:44:15.587581 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:44:15.592086 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:44:15.607890 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:44:15.625012 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:44:15.625269 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] Network connectivity detected
Sep 05 09:44:15.625495 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] Dropping privileges
Sep 05 09:44:15.627262 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] Network connectivity detected
Sep 05 09:44:15.627346 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:44:15.627379 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:44:15.627421 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] Firefox workaround initialized
Sep 05 09:44:15.627446 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:15] [NOTICE] Loading the set of cloaking rules from [/tmp/tmp9dj5hl8j]
Sep 05 09:44:15.781411 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal show | cat'.
Sep 05 09:44:16.181538 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:16] [NOTICE] [DUT0] OK (DoH) - rtt: 113ms
Sep 05 09:44:16.181538 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:16] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 113ms)
Sep 05 09:44:16.181538 osdx dnscrypt-proxy[20444]: [2025-09-05 09:44:16] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 7: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:

teldat.com has address 10.11.12.13

Server With Upstream DNSCrypt

Description

Configures DUT0 to connect, using DNSCrypt over an upstream server.

Scenario

Step 1: Run command service dns proxy dnscrypt public-key running://dnscrypt.crt at DUT0 and expect this output:

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD protocol dns-crypt ip 10.215.168.1
set service dns proxy static RD protocol dns-crypt port 8443
set service dns proxy static RD protocol dns-crypt provider name 2.dnscrypt-cert.remote.dns
set service dns proxy static RD protocol dns-crypt provider public-key '46:48:bf:33:d4:d9:ab:9a:0e:b5:c2:6d:61:04:8c:80:5d:50:c5:29:47:c5:0b:ef:04:3c:a3:2e:d7:98:89:0a'
set service dns resolver local
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

^(?m)^.*\[RD\] OK \(DNSCrypt\) - rtt: \d+ms$

Show output

Sep 05 09:44:24.301967 osdx systemd-journald[1764]: Runtime Journal (/run/log/journal/8e652e5518b84f0bb5a60f6ad502329f) is 2.1M, max 13.8M, 11.6M free.
Sep 05 09:44:24.304785 osdx systemd-journald[1764]: Received client request to rotate journal, rotating.
Sep 05 09:44:24.304850 osdx systemd-journald[1764]: Vacuuming done, freed 0B of archived journals from /run/log/journal/8e652e5518b84f0bb5a60f6ad502329f.
Sep 05 09:44:24.312110 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:44:24.517367 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:44:24.733235 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:44:24.808482 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Sep 05 09:44:24.891683 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:44:24.957490 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:25.052446 osdx ubnt-cfgd[39317]: inactive
Sep 05 09:44:25.072505 osdx INFO[39325]: FRR daemons did not change
Sep 05 09:44:25.176322 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:44:25.187677 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:44:25.203729 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:44:25.349479 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Sep 05 09:44:26.346212 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'service dns proxy dnscrypt public-key running://dnscrypt.crt'.
Sep 05 09:44:26.487613 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:44:26.549457 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Sep 05 09:44:26.648031 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Sep 05 09:44:26.705740 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt ip 10.215.168.1'.
Sep 05 09:44:26.806604 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt port 8443'.
Sep 05 09:44:26.866517 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt provider name 2.dnscrypt-cert.remote.dns'.
Sep 05 09:44:26.968711 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD protocol dns-crypt provider public-key 46:48:bf:33:d4:d9:ab:9a:0e:b5:c2:6d:61:04:8c:80:5d:50:c5:29:47:c5:0b:ef:04:3c:a3:2e:d7:98:89:0a'.
Sep 05 09:44:27.020634 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Sep 05 09:44:27.122793 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'.
Sep 05 09:44:27.185314 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'.
Sep 05 09:44:27.284649 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'.
Sep 05 09:44:27.358801 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:27.462733 osdx ubnt-cfgd[39483]: inactive
Sep 05 09:44:27.485113 osdx INFO[39491]: FRR daemons did not change
Sep 05 09:44:27.497867 osdx ca-certificates[39507]: Updating certificates in /etc/ssl/certs...
Sep 05 09:44:27.999578 osdx ubnt-cfgd[40505]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:44:28.007028 osdx ca-certificates[40511]: 1 added, 0 removed; done.
Sep 05 09:44:28.010032 osdx ca-certificates[40517]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:44:28.012905 osdx ca-certificates[40519]: done.
Sep 05 09:44:28.137064 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:44:28.138266 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:44:28.140122 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:44:28.157635 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:44:28.160302 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:44:28.160439 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Network connectivity detected
Sep 05 09:44:28.160671 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Dropping privileges
Sep 05 09:44:28.163279 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Network connectivity detected
Sep 05 09:44:28.163308 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:44:28.163308 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:44:28.163334 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH]
Sep 05 09:44:28.163348 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Firefox workaround initialized
Sep 05 09:44:28.163348 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpvidkewvm]
Sep 05 09:44:28.163957 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] [RD] OK (DNSCrypt) - rtt: 0ms
Sep 05 09:44:28.163957 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] Server with the lowest initial latency: RD (rtt: 0ms)
Sep 05 09:44:28.163957 osdx dnscrypt-proxy[40579]: [2025-09-05 09:44:28] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server-name DUT0
set service dns proxy static DUT0 protocol dns-over-https hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2
set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0
set service dns proxy static DUT0 protocol dns-over-https host port 3000
set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:

^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$

Show output

Sep 05 09:44:24.272636 osdx systemd-journald[1555]: Runtime Journal (/run/log/journal/50a598a116a9494aab0ac4ddc8eeff40) is 996.0K, max 6.5M, 5.5M free.
Sep 05 09:44:24.275409 osdx systemd-journald[1555]: Received client request to rotate journal, rotating.
Sep 05 09:44:24.275461 osdx systemd-journald[1555]: Vacuuming done, freed 0B of archived journals from /run/log/journal/50a598a116a9494aab0ac4ddc8eeff40.
Sep 05 09:44:24.282960 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:44:24.475284 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:44:25.371636 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:44:25.451728 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Sep 05 09:44:25.531856 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:44:25.586473 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service ssh'.
Sep 05 09:44:25.695603 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:25.762134 osdx ubnt-cfgd[22122]: inactive
Sep 05 09:44:25.790530 osdx INFO[22136]: FRR daemons did not change
Sep 05 09:44:25.943791 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Sep 05 09:44:25.954710 osdx sshd[22250]: Server listening on 0.0.0.0 port 22.
Sep 05 09:44:25.954926 osdx sshd[22250]: Server listening on :: port 22.
Sep 05 09:44:25.955041 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Sep 05 09:44:25.976720 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:44:25.998581 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:44:26.016779 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:44:26.162299 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Sep 05 09:44:28.398221 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:44:28.469419 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Sep 05 09:44:28.588035 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Sep 05 09:44:28.675179 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Sep 05 09:44:28.800134 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host name dns.dut0'.
Sep 05 09:44:28.857073 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https host port 3000'.
Sep 05 09:44:28.970524 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https ip 10.215.168.64'.
Sep 05 09:44:29.031628 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 protocol dns-over-https hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2'.
Sep 05 09:44:29.144896 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:29.218983 osdx ubnt-cfgd[22305]: inactive
Sep 05 09:44:29.237428 osdx INFO[22313]: FRR daemons did not change
Sep 05 09:44:29.249631 osdx ca-certificates[22329]: Updating certificates in /etc/ssl/certs...
Sep 05 09:44:29.779795 osdx ubnt-cfgd[23327]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:44:29.790540 osdx ca-certificates[23333]: 1 added, 0 removed; done.
Sep 05 09:44:29.794951 osdx ca-certificates[23339]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:44:29.799187 osdx ca-certificates[23341]: done.
Sep 05 09:44:29.883911 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:44:29.885469 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:44:29.888320 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:44:29.905406 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:44:29.905678 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] Network connectivity detected
Sep 05 09:44:29.905858 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:44:29.906182 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] Dropping privileges
Sep 05 09:44:29.908189 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] Network connectivity detected
Sep 05 09:44:29.908272 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:44:29.908303 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:44:29.908348 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] Firefox workaround initialized
Sep 05 09:44:29.908372 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:29] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpkx31wvof]
Sep 05 09:44:30.065180 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal show | cat'.
Sep 05 09:44:30.184162 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:30] [NOTICE] [DUT0] OK (DoH) - rtt: 169ms
Sep 05 09:44:30.184162 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:30] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 169ms)
Sep 05 09:44:30.184162 osdx dnscrypt-proxy[23348]: [2025-09-05 09:44:30] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 6: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:

teldat.com has address 10.11.12.13

Server With Upstream DNSCrypt With Stamp

Description

Configures DUT0 to connect, using DNSCrypt over an upstream server (generating a DNS stamp and using it to configure the connection).

Scenario

Step 1: Run command service dns proxy dnscrypt public-key running://dnscrypt.crt at DUT0 and expect this output:

Step 2: Run command service dns proxy stamp calculate dns-crypt provider-name 2.dnscrypt-cert.remote.dns provider-key 46:48:bf:33:d4:d9:ab:9a:0e:b5:c2:6d:61:04:8c:80:5d:50:c5:29:47:c5:0b:ef:04:3c:a3:2e:d7:98:89:0a ip 10.215.168.1 port 8443 at DUT0 and expect this output:

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server cert file 'running://dns.dut0.crt'
set service dns proxy server cert key 'running://dns.dut0.key'
set service dns proxy server-name RD
set service dns proxy static RD stamp 'sdns://AQAAAAAAAAAAETEwLjIxNS4xNjguMTo4NDQzIEZIvzPU2auaDrXCbWEEjIBdUMUpR8UL7wQ8oy7XmIkKGjIuZG5zY3J5cHQtY2VydC5yZW1vdGUuZG5z'
set service dns resolver local
set service dns static host-name teldat.com inet 10.11.12.13
set system certificate trust 'running://remote.dns-server.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command system journal show | cat at DUT0 and check if output matches the following regular expressions:

^(?m)^.*\[RD\] OK \(DNSCrypt\) - rtt: \d+ms$

Show output

Sep 05 09:44:38.331709 osdx systemd-journald[1764]: Runtime Journal (/run/log/journal/8e652e5518b84f0bb5a60f6ad502329f) is 1.9M, max 13.8M, 11.8M free.
Sep 05 09:44:38.333651 osdx systemd-journald[1764]: Received client request to rotate journal, rotating.
Sep 05 09:44:38.333706 osdx systemd-journald[1764]: Vacuuming done, freed 0B of archived journals from /run/log/journal/8e652e5518b84f0bb5a60f6ad502329f.
Sep 05 09:44:38.342856 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:44:38.580223 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:44:38.794836 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:44:38.868222 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.64/24'.
Sep 05 09:44:38.952856 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:44:39.019042 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:39.115652 osdx ubnt-cfgd[42281]: inactive
Sep 05 09:44:39.136785 osdx INFO[42289]: FRR daemons did not change
Sep 05 09:44:39.232144 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:44:39.242659 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:44:39.259119 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:44:39.403657 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'ping 10.215.168.1 count 1 size 56 timeout 1'.
Sep 05 09:44:40.484065 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'service dns proxy dnscrypt public-key running://dnscrypt.crt'.
Sep 05 09:44:40.575125 osdx OSDxCLI[2038]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-crypt provider-name 2.dnscrypt-cert.remote.dns provider-key 46:48:bf:33:d4:d9:ab:9a:0e:b5:c2:6d:61:04:8c:80:5d:50:c5:29:47:c5:0b:ef:04:3c:a3:2e:d7:98:89:0a ip 10.215.168.1 port 8443'.
Sep 05 09:44:40.734274 osdx OSDxCLI[2038]: User 'admin' entered the configuration menu.
Sep 05 09:44:40.795307 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set system certificate trust running://remote.dns-server.crt'.
Sep 05 09:44:40.894665 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server-name RD'.
Sep 05 09:44:40.956018 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy static RD stamp sdns://AQAAAAAAAAAAETEwLjIxNS4xNjguMTo4NDQzIEZIvzPU2auaDrXCbWEEjIBdUMUpR8UL7wQ8oy7XmIkKGjIuZG5zY3J5cHQtY2VydC5yZW1vdGUuZG5z'.
Sep 05 09:44:41.040112 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns resolver local'.
Sep 05 09:44:41.107793 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert file running://dns.dut0.crt'.
Sep 05 09:44:41.204586 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns proxy server cert key running://dns.dut0.key'.
Sep 05 09:44:41.264625 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'set service dns static host-name teldat.com inet 10.11.12.13'.
Sep 05 09:44:41.372179 osdx OSDxCLI[2038]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:41.444590 osdx ubnt-cfgd[42447]: inactive
Sep 05 09:44:41.464553 osdx INFO[42455]: FRR daemons did not change
Sep 05 09:44:41.477076 osdx ca-certificates[42470]: Updating certificates in /etc/ssl/certs...
Sep 05 09:44:41.958502 osdx ubnt-cfgd[43469]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:44:41.967544 osdx ca-certificates[43475]: 1 added, 0 removed; done.
Sep 05 09:44:41.970496 osdx ca-certificates[43481]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:44:41.973693 osdx ca-certificates[43483]: done.
Sep 05 09:44:42.101975 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:44:42.103214 osdx cfgd[1461]: [2038]Completed change to active configuration
Sep 05 09:44:42.105463 osdx OSDxCLI[2038]: User 'admin' committed the configuration.
Sep 05 09:44:42.122396 osdx OSDxCLI[2038]: User 'admin' left the configuration menu.
Sep 05 09:44:42.124316 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:44:42.124472 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Network connectivity detected
Sep 05 09:44:42.124689 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Dropping privileges
Sep 05 09:44:42.127275 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Network connectivity detected
Sep 05 09:44:42.127314 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:44:42.127314 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:44:42.127314 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Now listening to https://[::]:3000/dns-query [DoH]
Sep 05 09:44:42.127354 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Firefox workaround initialized
Sep 05 09:44:42.127354 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Loading the set of cloaking rules from [/tmp/tmp6ttfn2g1]
Sep 05 09:44:42.127858 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] [RD] OK (DNSCrypt) - rtt: 0ms
Sep 05 09:44:42.127858 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] Server with the lowest initial latency: RD (rtt: 0ms)
Sep 05 09:44:42.127858 osdx dnscrypt-proxy[43543]: [2025-09-05 09:44:42] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 5: Run command service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2 at DUT1 and expect this output:

Step 6: Set the following configuration in DUT1 :

set interfaces ethernet eth0 address 10.215.168.65/24
set protocols static route 0.0.0.0/0 next-hop 10.215.168.1
set service dns proxy server-name DUT0
set service dns proxy static DUT0 stamp 'sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg4IcFjGRdM3YRJvlGzQ8-g7yJSLtRGqJmx0e3N87O27INZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5'
set service dns static host-name dns.dut0 inet 10.215.168.64
set service ssh
set system certificate trust 'running://CA.crt'
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 7: Run command system journal show | cat at DUT1 and check if output matches the following regular expressions:

^(?m)^.*\[DUT0\] OK \(DoH\) - rtt: \d+ms$

Show output

Sep 05 09:44:38.327742 osdx systemd-journald[1555]: Runtime Journal (/run/log/journal/50a598a116a9494aab0ac4ddc8eeff40) is 996.0K, max 6.5M, 5.5M free.
Sep 05 09:44:38.328836 osdx systemd-journald[1555]: Received client request to rotate journal, rotating.
Sep 05 09:44:38.328883 osdx systemd-journald[1555]: Vacuuming done, freed 0B of archived journals from /run/log/journal/50a598a116a9494aab0ac4ddc8eeff40.
Sep 05 09:44:38.340557 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal clear'.
Sep 05 09:44:38.532627 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system coredump delete all'.
Sep 05 09:44:39.466671 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:44:39.543479 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set interfaces ethernet eth0 address 10.215.168.65/24'.
Sep 05 09:44:39.619838 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set protocols static route 0.0.0.0/0 next-hop 10.215.168.1'.
Sep 05 09:44:39.683783 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service ssh'.
Sep 05 09:44:39.802951 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:39.866974 osdx ubnt-cfgd[25028]: inactive
Sep 05 09:44:39.895873 osdx INFO[25042]: FRR daemons did not change
Sep 05 09:44:40.069188 osdx systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Sep 05 09:44:40.082773 osdx sshd[25156]: Server listening on 0.0.0.0 port 22.
Sep 05 09:44:40.083036 osdx sshd[25156]: Server listening on :: port 22.
Sep 05 09:44:40.083167 osdx systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Sep 05 09:44:40.101353 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:44:40.112127 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:44:40.129296 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:44:40.294018 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'ping 10.215.168.64 count 1 size 56 timeout 1'.
Sep 05 09:44:42.362962 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'service dns proxy stamp calculate dns-over-https host-name dns.dut0 host-path /dns-query host-port 3000 ip 10.215.168.64 hash e087058c645d33761126f946cd0f3e83bc8948bb511aa266c747b737cecedbb2'.
Sep 05 09:44:42.520088 osdx OSDxCLI[1828]: User 'admin' entered the configuration menu.
Sep 05 09:44:42.603746 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns static host-name dns.dut0 inet 10.215.168.64'.
Sep 05 09:44:42.705090 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set system certificate trust running://CA.crt'.
Sep 05 09:44:42.798432 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy server-name DUT0'.
Sep 05 09:44:42.911673 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'set service dns proxy static DUT0 stamp sdns://AgAAAAAAAAAADTEwLjIxNS4xNjguNjQg4IcFjGRdM3YRJvlGzQ8-g7yJSLtRGqJmx0e3N87O27INZG5zLmR1dDA6MzAwMAovZG5zLXF1ZXJ5'.
Sep 05 09:44:42.996161 osdx OSDxCLI[1828]: User 'admin' added a new cfg line: 'show working'.
Sep 05 09:44:43.111410 osdx ubnt-cfgd[25211]: inactive
Sep 05 09:44:43.131061 osdx INFO[25219]: FRR daemons did not change
Sep 05 09:44:43.145772 osdx ca-certificates[25235]: Updating certificates in /etc/ssl/certs...
Sep 05 09:44:43.652097 osdx ubnt-cfgd[26233]: rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL
Sep 05 09:44:43.660406 osdx ca-certificates[26240]: 1 added, 0 removed; done.
Sep 05 09:44:43.664030 osdx ca-certificates[26245]: Running hooks in /etc/ca-certificates/update.d...
Sep 05 09:44:43.666708 osdx ca-certificates[26247]: done.
Sep 05 09:44:43.733091 osdx systemd[1]: Started dnscrypt-proxy.service - DNSCrypt client proxy.
Sep 05 09:44:43.735793 osdx cfgd[1254]: [1828]Completed change to active configuration
Sep 05 09:44:43.738426 osdx OSDxCLI[1828]: User 'admin' committed the configuration.
Sep 05 09:44:43.755303 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] dnscrypt-proxy 2.0.45
Sep 05 09:44:43.755594 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Network connectivity detected
Sep 05 09:44:43.755824 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Dropping privileges
Sep 05 09:44:43.758960 osdx OSDxCLI[1828]: User 'admin' left the configuration menu.
Sep 05 09:44:43.759239 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Network connectivity detected
Sep 05 09:44:43.759239 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
Sep 05 09:44:43.759239 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
Sep 05 09:44:43.759239 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Firefox workaround initialized
Sep 05 09:44:43.759239 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Loading the set of cloaking rules from [/tmp/tmpt5jtx3u8]
Sep 05 09:44:43.910260 osdx OSDxCLI[1828]: User 'admin' executed a new command: 'system journal show | cat'.
Sep 05 09:44:43.966858 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] [DUT0] OK (DoH) - rtt: 122ms
Sep 05 09:44:43.966858 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] Server with the lowest initial latency: DUT0 (rtt: 122ms)
Sep 05 09:44:43.966858 osdx dnscrypt-proxy[26254]: [2025-09-05 09:44:43] [NOTICE] dnscrypt-proxy is ready - live servers: 1

Step 8: Run command show host lookup teldat.com type A at DUT1 and check if output contains the following tokens:

teldat.com has address 10.11.12.13