Jump to content
TorGuard

Leaderboard

  1. Support

    Support

    Administrators


    • Points

      41

    • Content Count

      2,033


  2. Robyn

    Robyn

    Members


    • Points

      5

    • Content Count

      15


  3. directnupe

    directnupe

    Members


    • Points

      4

    • Content Count

      13


  4. kurisu

    kurisu

    Members


    • Points

      3

    • Content Count

      23



Popular Content

Showing content with the highest reputation since 04/21/2018 in all areas

  1. 3 points
    READ ENTIRE GUIDE BEFORE YOU BEGIN See here for GETDNS AND STUBBY on OPENWRT / LEDE: https://github.com/openwrt/packages/blob/master/net/stubby/files/README.md - this page is designed for DNS OVER TLS with DNSMASQ but it still is useful and informative . See Here For OPENWRT STUBBY DNS OVER TLS USING DNSMASQ-FULL FOR DNSSEC & CACHING https://forum.openwrt.org/t/stubby-dns-over-tls-using-dnsmasq-full-for-dnssec-caching/19107 UPDATED GUIDE For UNBOUND: ( IF YOU NEED IT ! ) https://torguard.net/forums/index.php?/topic/1509-updated-guide-for-getdns-142-2-stubby-023-3-and-unbound-181-2/ Why I am so damn serious about DNS Privacy ( just watch these when you have time - all at once or in intervals - very educational 😞 https://dnsprivacy.org/wiki/display/DP/IETF+DNS+Privacy+Tutorial https://www.youtube.com/watch?v=2JeYIecfwdc https://www.youtube.com/watch?v=JnxE5RPnyiE Active work is also underway at the IETF on DNS-over-HTTP (DOH) but today the only method standardized by the IETF is DNS-over-TLS. In the world of encryption, it's always safer to go with standardized protocols that have gone through a rigorous review process. Unfortunately DNSCrypt has not been standardized yet, and some of the ways it uses cryptography are unusual. If you need more storage and swap memory for your router see here: http://ediy.com.my/index.php/blog/item/118-how-to-increase-storage-on-tp-link-tl-mr3020-with-extroot and here: https://samhobbs.co.uk/2013/11/more-space-for-packages-with-extroot-on-your-openwrt-router For partitioning USB external flash drives I personally prefer GParted Live and / or MiniTool Partition Wizard 9.1 Boot Iso and both work great - found here: https://gparted.org/download.php and here respectively https://www.chip.de/downloads/Partition-Wizard-Bootable-CD_38297298.html For all of those who are using UNBOUND with tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt" # For OpenWrt option: found here This will have to wait until OpenSSL 1.1.x .From Unbound Recursive DNS Server with UCI found here: https://github.com/openwrt/packages/blob/master/net/unbound/files/README.md And Look for section at the bottom entitled HOW TO: TLS Over DNS read this: NOTICE: Unbound requires openssl-1.1.0 to verify host certificates. OpenWrt at present is configured with openssl-1.0.2. Connections will be over TLS, but theoretically, certificates may not be from a trusted source. See report https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658 When this is resolved, it will be recommended again to install ca-bundle, maintain it, and be sure to include the TLS certificate domain index with the host addresses. For all the doubters and naysayers concerning GETDNS and STUBBY - they are developed by NLnet Labs - the same folks who bring us Unbound, NSD, OPENDNSSEC and now GETDNS ( and STUBBY ) see here: https://www.nlnetlabs.nl/ https://www.nlnetlabs.nl/projects/getdns/ Yes I run GETDNS and STUBBY. For those who wish to explore GETDNS and STUBBY - this method is the one recommended by DNSPRIVACY - see here : https://getdnsapi.net/ 5 https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby 2 https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#DNSPrivacyClients-Unbound 3 - please read this carefully - you will note that it indicates : Unbound As A DNS TLS Client Features: Unbound can be run as a local caching forwarder, configured to use SSL upstream, however it cannot yet authenticate upstreams, re-use TCP/TLS connections, be configured for Opportunistic mode or send several of the privacy related options (padding, ECS privacy) etc. Some users combine Unbound (as a caching proxy with other features such as DNS Blacklisting) and Stubby (as a fully featured TLS forwarder). These are the reasons I choose to use GETDNS and STUBBY with Unbound. Those reasons being so that I can take full advantage of all of the most secure privacy features available when running DNS OVER TLS. What I give you here is the absolute best method of implementation and deployment of DNS OVER TLS. For any and all who may be wondering why DNS OVER TLS is all the rage - read this: https://tenta.com/blog/post/2017/12/dns-over-tls-vs-dnscrypt So here we go. FYI, David Mora aka iamperson347 the developer and maintainer of GETDNS and STUBBY package for OpenWRT / LEDE assisted me in putting this all together. Dave strongly suggested using DNSMASQ for DHCP and UNBOUND and STUBBY for DNS OVER TLS. Dave's reason was that OpenWrt / Lede performs best when configured in this fashion. Directly from David Mora aka iamperson347 the developer and maintainer of GETDNS and STUBBY and I quote: "I recommend running Unbound to utilize the caching. Sometimes the connections from stubby to the resolver can have a little but of lag, so caching + prefetch helps minimize the effects." This is why I put this all together using Unbound DNS Caching Server. Use Localhost along with Tenta nameservers 99.192.182.200 and 99.192.182.100 for your OpenWrt Router. Tenta DNS is a full-fledged DNS solution, including DNSSEC and DNS-over-TLS. These are the folks that developed and support the Tenta Browser see here: https://github.com/tenta-browser/tenta-dns and read About Tenta section at the very bottom of the page. Unbound is a recursive caching DNS Resolver - which by design and definition speeds up your DNS RESOLUTION. DNS addresses are stored in the cache and called upon and directed to almost IMMEDIATELY ! ( Query time: 0 msec ) resolve dns addresses in subsequent DNS look ups after your first visit to cached objects. A small number has questioned DNS OVER TLS and the supposed complexity of this setup vis a’ vis DNSCrypt. DNSCrypt has always been suggested to best deployed when forwarded to Unbound as a Caching Server. In effect, this methodology simply drops Stubby and GetDns in place instead of DNSCrypt. The use of DNSMasq for DHCP is particular to OpenWRT / LEDE. However, it is a fairly simple and straightforward task to setup DNSMasq for purposes of DHCP and well described and referenced in this tutorial. Lastly, GetDns and Stubby do allow for TLS OVER Port 443 and I have amended this guide to reflect that option for those who may worry about being blocked behind a firewall while using TLS OVER Port 853. https://www.nlnetlabs.nl/projects/unbound/about/ This method combines Unbound (as a caching proxy) and Stubby (as fully featured TLS forwarder). Stubby is essential - please read the following: Stubby' is an application that acts as a local DNS Privacy stub resolver (using DNS-over-TLS). Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver increasing end user privacy. Stubby is developed by the getdns project. Stubby is essential - please read the following: https://dnsprivacy.org/wiki/display/DP/About+Stubby I run GETDNS and STUBBY with Unbound DNS and Dnsmasq for DHCP. You can use odhcpd which will handle both DNS and DHCP where you disable and/ or remove DNSMASQ - but you will experience a performance hit. This why I use Unbound/ STUBBY for DNS and Dnsmasq for DHCP . Here is a basic guide as to how to do it - https://blog.grobox.de/2018/what-is-dns-privacy-and-how-to-set-it-up-for-openwrt/ 5 However a few modifications are necessary in order to to have GetDns and Stubby up and running and successfully integrated with Unbound DNS and Dnsmasq for DHCP. I will write up a guide here - but don’t give me a hard time later on. Directly From DNS Privacy Website: Stubby is an experimental implementation of a DNS Privacy enabled stub resolver. It is currently suitable for advanced/technical users - all feedback is welcome! Also see https://dnsprivacy.org/ for more information on DNS Privacy. I have read here: https://www.monperrus.net/martin/randomization-encryption-dns-requests that Also, it is good to set up some servers that listens on port 443 and others on port 853, so as to be resilient if you are on a network with blocked ports. You can also blend IPv4 and IPv6 addresses. By the way I run Davidc502 LEDE Snapshots - Moderately Customized LEDE Development Builds for Linksys 1900ac v.1 and 1900ac v.2, 1900acs v.1 v.2, 3200acm, WRT32X and 1200ac v.1 v.2 series routers. These builds keep up to date package repositories.. GetDns and Stubby are included. Dave's Builds have many other pre-installed common packages as well.. Check out homepage and downloads here: https://davidc502sis.dynamic-dns.net/ and downloads here: https://davidc502sis.dynamic-dns.net/snapshots/ . In addition, there is a very informative, instructive and active thread ( forum ) for Dave's builds and discussion of many OpenWrt / Lede packages, features, and issues. In short great technical advice and assistance can be found here: https://forum.openwrt.org/t/davidc502-wrt1200ac-wrt1900acx-wrt3200acm-wrt32x-builds/ Dave releases new updated builds every two weeks - near the middle and first of each month. - Latest Stable Version of OpenWrt / Lede 18.06.1 includes up to date Unbound, GETDNS and STUBBY: ( download and do fresh install of squashfs-factory.img on your device for best performance ) https://downloads.openwrt.org/releases/18.06.1/targets/ as do OpenWrt/LEDE Development Snapshots here: https://downloads.openwrt.org/snapshots/targets/ HINT / TIP: You can add these packages by adding package url repository URL under your " Custom Feeds " if for any reason you need to do so. Remember that the custom feed package url feed must match your router's architecture. For example if you have the Linksys WRT1900ACS then your package feed for your router is listed as Package architecture: arm_cortex-a9_vfpv3 so your custom url feed is : src/gz OpenWrt_packages https://downloads.openwrt.org/releases/18.06.1/packages/arm_cortex-a9_vfpv3/packages/ - You can find router's architecture here: https://openwrt.org/toh/start and then look on Device Page and / or Device Techdata. Remember to remove custom feed url after installing your GETDNS and SUBBY packages in order to avoid software package conflicts. As always - opkg update first and foremost Prerequisite You have a ca cert bundle installed on your router. You can do this by running the following opkg install ca-certificates Now Let’s Move On 1 - opkg install unbound odhcpd unbound-control unbound-control-setup luci-app-unbound unbound-anchor 2 - opkg install getdns stubby 3- My WORKING CONFIGS /etc/unbound/unbound_srv.conf ( Must Adjust For Your Router - I Run WRT1900ACS and WRT3200ACM So I Have Plenty Of Ram, Storage and 2 CPU's ) You should " Optimize Unbound " - especially increase size of cache among other things see guide here and adjust for your router's memory , number of cores and so on- see here: https://nlnetlabs.nl/documentation/unbound/howto-optimise/ for basic guide ( Simply Copy and Paste Into Your SSH Session and Hit Enter ) cat >> /etc/unbound/unbound_srv.conf <<UNBOUND_SERVER_CONF server: # use all CPUs num-threads: 2 # power of 2 close to num-threads msg-cache-slabs: 4 rrset-cache-slabs: 4 infra-cache-slabs: 4 key-cache-slabs: 4 # more cache memory, rrset=msg*2 rrset-cache-size: 256m msg-cache-size: 128m # more outgoing connections # make sure to install libevent outgoing-range: 8192 # Larger socket buffer. OS may need config. so-rcvbuf: 4m so-sndbuf: 4m cache-min-ttl: 600 cache-max-ttl: 14400 qname-minimisation: yes qname-minimisation-strict: yes hide-trustanchor: yes infra-cache-numhosts: 100000 num-queries-per-thread: 4096 minimal-responses: yes rrset-roundrobin: yes do-tcp: yes do-ip6: no prefetch: yes prefetch-key: yes so-reuseport: yes unwanted-reply-threshold: 10000000 interface-automatic: yes max-udp-size: 2048 num-queries-per-thread: 4096 do-not-query-localhost: no verbosity: 1 private-domain: "yourdomain.here" harden-referral-path: yes UNBOUND_SERVER_CONF As per guide :# Don’t let each server know the next recursion Enter via SSH command line: uci set ‘[email protected][0].query_minimize=1’ 4 - My WORKING CONFIG /etc/stubby/stubby.yml I prefer to run these DNS TLS SERVERS as they tend to be stable most all of the time. The mix of dns.cmrg.net, DNSPRIVACY.at and getdnsapi.net Servers work in an optimal fashion on OpnSense. However, if for any reason you lose internet while running Stubby- chances are it is due to one or more of the servers you are running being down. I told you and it is mentioned on DNSPRIVACY website that all of this ( for the time being ) is experimental. However, even if you run ssl-upstream with Unbound you still will need to monitor real time status of DNS Privacy Test Servers. So, Stubby is still the full featured way to go. See all DNS TLS SERVERS here if you choose to run others: DNS Privacy Test Servers https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers You can and should also check real time status of DNS Privacy Servers as they are experimental and are not always stable - you can monitor Dns Servers Real Time Status here below: https://dnsprivacy.org/jenkins/job/dnsprivacy-monitoring/ Here is a list of all DNS Privacy Servers in the raw. Add ( tls_port: 853 ) after ( - address_data: ) entry: https://github.com/getdnsapi/stubby/blob/release/0.2.3/stubby.yml.example See here for how to configure Stubby: https://github.com/getdnsapi/stubby DNS OVER TLS ABSOLUTE BEST CONFIGURATION FOR STUBBY FOR THE REASONS DETAILED BELOW: nano /etc/stubby/stubby.yml - replace contents of file with configuration below: resolution_type: GETDNS_RESOLUTION_STUB dns_transport_list: - GETDNS_TRANSPORT_TLS tls_authentication: GETDNS_AUTHENTICATION_REQUIRED tls_query_padding_blocksize: 128 edns_client_subnet_private : 1 idle_timeout: 60000 # keep-alive for 1 min, for better performance listen_addresses: - [email protected] ## Stubby / Unbound ## Default Address/Port round_robin_upstreams: 1 upstream_recursive_servers: # IPV4 Servers # The getdnsapi.net Server - address_data: 185.49.141.37 tls_port: 853 tls_auth_name: "getdnsapi.net" tls_pubkey_pinset: - digest: "sha256" value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q= # The Fondation RESTENA Server - address_data: 158.64.1.29 tls_auth_name: "kaitain.restena.lu" tls_port: 853 tls_pubkey_pinset: - digest: "sha256" value: 7ftvIkA+UeN/ktVkovd/7rPZ6mbkhVI7/8HnFJIiLa4= ### Test servers ### ## Surfnet/Sinodun Servers - address_data: 145.100.185.17 tls_port: 853 tls_auth_name: "dnsovertls2.sinodun.com" tls_pubkey_pinset: - digest: "sha256" value: NAXBESvpjZMnPWQcrxa2KFIkHV/pDEIjRkA3hLWogSg= # The securedns.eu Server - address_data: 146.185.167.43 tls_auth_name: "dot.securedns.eu" tls_port: 443 tls_pubkey_pinset: - digest: "sha256" value: h3mufC43MEqRD6uE4lz6gAgULZ5/riqH/E+U+jE3H8g= # The dns.cmrg.net Server - address_data: 199.58.81.218 tls_port: 443 tls_auth_name: "dns.cmrg.net" tls_pubkey_pinset: - digest: "sha256" value: 3IOHSS48KOc/zlkKGtI46a9TY9PPKDVGhE3W2ZS4JZo= # DNSPRIVACY.at Primary DNS TLS Server - address_data: 94.130.110.185 tls_port: 853 tls_auth_name: "ns1.dnsprivacy.at" tls_pubkey_pinset: - digest: "sha256" value: vqVQ9TcoR9RDY3TpO0MTXw1YQLjF44zdN3/4PkLwtEY= # DNSPRIVACY.at Secondary DNS TLS Server - address_data: 94.130.110.178 tls_port: 853 tls_auth_name: "ns2.dnsprivacy.at" tls_pubkey_pinset: - digest: "sha256" value: s5Em89o0kigwfBF1gcXWd8zlATSWVXsJ6ecZfmBDTKg= # The dns.neutopia.org Server - address_data: 89.234.186.112 tls_port: 443 tls_auth_name: "dns.neutopia.org" tls_pubkey_pinset: - digest: "sha256" value: wTeXHM8aczvhRSi0cv2qOXkXInoDU+2C+M8MpRyT3OI= ### Anycast services ### #Tenta ICANN DNS TLS Primary Server - address_data: 99.192.182.200 tls_auth_name: "iana.tenta.io" tls_port: 853 tls_pubkey_pinset: - digest: "sha256" value: nPzhfahBmQOFKbShlLBymTqPtZY31bPpKFnh0A86ys0= All of these name servers listed above DO NOT log ! repeat DO NOT log ! your DNS queries. In full disclosure some name servers claim to log traffic volume only. See here for details : https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers and look under " Logging " column. DNS query name minimisation to improve privacy, along with DNS resolution speed and accuracy - Run Test After Completing Full Setup These name servers listed above help to consistently ensure QNAME Minimisation functions as designed within UNBOUND ( The idea is to minimise the amount of data sent from the DNS resolver to the authoritative name server. ) Use either or both of these two methods to verify QNAME Minimisation A - You need to opkg install drill and - then run command : drill txt qnamemintest.internet.nl and / or B - opkg install bind-dig or opkg install bind-tools with command: dig txt qnamemintest.internet.nl +short and / or dig -t txt qnamemintest.internet.nl ( for more complete readout including DNSSEC results ). AD = Authenticated Data (for DNSSEC only; indicates that the data was authenticated) The results in any of these scenarios will show either: "HOORAY - QNAME minimisation is enabled on your resolver :)!” or “NO - QNAME minimisation is NOT enabled on your resolver :(.” Reference https://discourse.pi-hole.net/t/unbound-and-qname-minimisation/10038/4 You will and should get HOORAY ! - if you used the name servers listed in this guide for your Stubby configuration. Note: Starting with Unbound 1.7.2 qname minimisation is enabled by default. However, I still add these settings manually. These settings are entered in " /etc/unbound/unbound_srv.conf " file. qname-minimisation: yes qname-minimisation-strict: yes harden-below-nxdomain: yes See configuration above in Step # 3 . 5 - MY WORKING CONFIG /etc/unbound/unbound_ext.conf ( Simply Copy and Paste Into Your SSH Session and Hit Enter ) cat >> /etc/unbound/unbound_ext.conf <<UNBOUND_FORWARD_CONF forward-zone: name: "." # Allow all DNS queries forward-addr: [email protected] # Forward Unbound To Stubby Address/Port UNBOUND_FORWARD_CONF 6 - From The Guide referred to in the link above - self explanatory: # Move dnsmasq to port 53535 where it will still serve local DNS from DHCP# Network -> DHCP & DNS -> Advanced Settings -> DNS server port to 53535 Enter via SSH command line: uci set ‘[email protected][0].port=53535’ uci add_list “dhcp.lan.dhcp_option=option:dns-server,$(uci get network.lan.ipaddr)” uci set ‘[email protected][0].dhcp_link=dnsmasq’ uci commit /etc/init.d/unbound restart 7 - From https://github.com/openwrt/packages/tree/master/net/unbound/files HOW TO Integrate with DHCP Parallel DNSMASQ /etc/config/dhcp After Some Reflection and Observations - Fine Tuning Your DNS Resolver After reading System Logs I realized that there is a need to amend DNSMASQ ( DHCP ) after implementing option noresolv ‘1’ in /etc/config/dhcp configuration file. This dawned on me from my years of running DNSCRYPT Proxy on OpenWrt. I referred to this guide: Go to this section near bottom of page. Use specific DNS server to lookup one or more host names https://www.leowkahman.com/2016/05/23/openwrt-encrypted-dns-lookup-using-multiple-dnscrypt-servers/ option noresolv ‘1’ is to prevent using any upstream DNS server other than those specified in this file # this file being: /etc/config/dhcp Solution is as follows add these two lines to /etc/config/dhcp: nano /etc/config/dhcp - enter these lines before / option domain ‘yourdomain’ list server '127.0.0.1#5453' # Stubby/Unbound Default Address/Port option noresolv ‘1’ # Make sure to change this as indicated After you complete all the steps in this tutorial and restart your Router Check Status > System Log - You will find an entry like the one below: daemon.info dnsmasq[8532]: using nameserver 127.0.0.1#5453 - which indicates that your OpenWrt Router is using Unbound and Stubby for Encrypted DNS Resolution 8 - For better DNS resolution follow the /etc/config/unbound file in this tutorial below ( where Lan and Wan are Unbound Triggers ) then add DNS resolvers as follows: A - Under Network > Interfaces > Edit Wan > Advanced Settings > Remove Check From Box Next To " Use DNS servers advertised by peer " and enter DNS Servers in order 127.0.0.1, along with Tenta nameservers 99.192.182.200 and 99.192.182.100 - Your DNS will still resolve using the upstream name servers you selected in stubby.yml - Things Will Work Fine and as Intended. I have found that it is best to use Tenta DNS name servers as " custom DNS servers " on the Wan interface. I chose Tenta DNS because their name servers support both emerging DNS privacy standards - DNS-over-TLS, and DNS-over-HTTPS, which both provide last mile encryption to keep your DNS queries private and free from tampering. Tenta DNS also is the only AnyCast DOT service which includes built-in BGP integration, offering single engine convenience for DNS Anycasting with QNAME minimisation enabled on its' name servers by default. Main benefits of Tenta DNS as the backbone name servers on OpenWrt: A - Stop ISPs from spying on your browser history. DNS-over-TLS adds a layer of encryption over your DNS requests, keeping your ISP from seeing which websites you visit. B - Stay private online. Tenta DNS logs a counter instead of queries so your data stays private. No one, not even Tenta, has access to your browsing data. https://tenta.com/dns-setup-guides 9 - Working /etc/config/unbound file nano /etc/config/unbound config unbound option dns64 '0' option edns_size '4096' option extended_luci '1' option extended_stats '0' option hide_binddata '1' option domain 'yourdomain.here' option domain_type 'static' option enabled '1' option listen_port '53' option localservice '1' option luci_expanded '1' option manual_conf '0' option query_min_strict '1' option rebind_localhost '0' option rebind_protection '1' option recursion 'passive' option resource 'small' option root_age '9' option ttl_min '120' option unbound_control '2' option validator '1' option validator_ntp '1' option query_minimize '1' option dhcp_link 'dnsmasq' option enabled '1' option protocol 'ip4_only' option prefetch_root '0' list trigger_interface 'lan' list trigger_interface 'wan' VERY IMPORTANT STEP: Now run /etc/init.d/unbound restart one more time. When you do this you will see that your unbound root.key will be installed to /var/lib/unbound/root.key and also it will install root.key to /etc/unbound/root.key. This will automatically configure DNSSEC on your router. The function also lists your auto-trust anchor in your /var/lib/unbound/unbound.conf file. You will now be running DNS OVER TLS with GETDNS and Stubby on LEDE / OpenWrt Make sure to follow this guide precisely and it works GREAT!!! You can check logs under Services > Recursive DNS > Status > Log - you will see that you have a caching encrypted DNS Resolver !!! You can install - opkg install bind-dig or opkg install bind-tools in order to be able to issue dig commands in order to check DNS resolution if you opt to - as you test you will see that your cache is working also. Bonus Setup Option ( Highly Recommended ) - Install WatchCat http://www.ibuyopenwrt.com/index.php/2-uncategorised/224-watchcat-reboot-on-internet-drop I set "Reboot on Internet Connection Lost" option. I have WatchCat set to ping Fourth Estate DNS address - 179.43.139.226 - every 20 minutes. This will keep your router up and running consistently. Now all you need to do is run is a properly configured VPN Service. By doing so, running DNS over TLS with Stubby and GetDns will keep your VPN provider from spying on your encrypted DNS look ups - and also your DNS providers both the ISP ( replaced by encrypted Stubby ) and your Encrypted TLS DNS Service Provider will see your IP as the one from your encrypted tunneled VPN provider. I am convinced this setup is the right strategy for both security and privacy. I think it to be the best practice for all those most serious about multi-layered cyber security. Lastly, you can check your DNS at GRC Spoofability Test - DNS Leak - or any of such service. Your results will render the DNS PRIVACY Name Servers which you selected in your stubby.yml configuration file. You are now running DNS OVER TLS with GETDNS plus STUBBY ( a fully featured TLS forwarder ) along with an Unbound DNS Caching Server. VERY IMPORTANT TIP: Please note that right at the top of the main DNS Privacy Test Servers Homepage ( https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers ) It Ominously Declares: DoT servers The following servers are experimental DNS-over-TLS servers. Note that they are experimental offerings (mainly by individuals/small organisations) with no guarantees on the lifetime of the service, service level provided. The level of logging may also vary (see the individual websites where available) - the information here about logging has not been verified.Also note that the single SPKI pins published here for many of these servers are subject to change (e.g on Certificate renewal) and should be used with care!! For these reasons it is most important to check and verify your SPKI pin(s) for TLS authentication manually yourself from time to time. There are sure fire methods to make sure that you are using the correct value for any upstream nameserver ( aka tls_pubkey_pinset value ) - Go to https://blahdns.com/ and scroll down to the section to the yellow section entitled What is DNS OVER TLS click on it and it will open up. When you do it will state some general information, but what you want to pay attention to is this section: How to get SPKI gnutls-cli --print-cert -p 853 185.49.141.37 - where you must opkg install gnutls-utils OR echo | openssl s_client -connect '185.49.141.37:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 There is also a third option. kdig -d @185.49.141.37 +tls-ca +tls-host=getdnsapi.net example.com - where you must install knot-dig / opkg install knot-dig This is my personal favorite as the readout from this command will list the certificate specifically like so: ;; DEBUG: #1, CN=getdnsapi.net ;; DEBUG: SHA-256 PIN: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q= and let you know that the certificate is valid like so: ;; DEBUG: TLS, The certificate is trusted. Remember to change port to 443 or port for IPV6 if different than standard 853 where applicable. To use kdig certificate verification method on an alternate port example: kdig -d @199.58.81.218 -p 443 +tls-ca +tls-host=dns.cmrg.net example.com https:/www.dnsleaktest.com/ https://www.perfect-privacy.com/dns-leaktest/ https://www.grc.com/dns/dns.htm http://www.vpninsights.com/dns-leak-test and last but not least https://cmdns.dev.dns-oarc.net/ for a thorough in depth DNS Test https://bash.ws/dnsleak/test/ See here for TorGuard Open VPN Setup https://torguard.net/forums/index.php?/topic/1247-lede-openwrt-torguard-vpn-setup/ And now you are cooking with plenty of Gas - c'est fini c'est manifique c'est ci bon
  2. 3 points
    ====================================== TorGuard v3.85.0 Release ====================================== ChangeLog: * All platforms: Direct IP Cache more robust Sometimes, more often in MacOSX, it was possible that the Direct IP Cache file was not properly saved. With this patch, we improve the code with a double check. * All platforms: Warning dialogue when Log to File is active Recently a new option was added, to write a Debugging Log File. This option was intended only for debugging purpose and it is disabled by default. With this patch a warning will be shown when saving the settings, asking confirmation to the user. * Windows: installer improved The TAP driver installer was left behind after uninstalling the program. The bug is fixed with this patch. * MacOSX: Auto start on boot With this option checked, TorGuard will be automatically started on System boot. This option is equivalent to manually change the System Preferences -> Users & Groups -> Login Items * MacOSX: Bug fix: Hide from Dock option repaired In the last version, the Hide from Dock option was broken. With this patch we fixed the bug. ========================================== Downloads
  3. 3 points
    Hey there, 2048 bit RSA is more than adequate today, however, we are going to offer the option to choose between both very soon. Regards
  4. 2 points
    At the moment it is not possible bit but rest assured we will get some WireGuard servers going very soon Regards
  5. 2 points
  6. 2 points
    Protocol: TCP is more reliable, bypasses firewalls that ban UDP traffic. Use if A: You are behind a restricted network(School, Government, Corporate Business), or B: You only surf the web/check emails, or various other light tasks that don't require speed). UDP is more faster, best for downloading, streaming, gaming. Use this if you have no issues connecting to stuff and require fastest speeds. Cipher: Cipher is the level of encryption the VPN will use, which will basically scramble your data in a unreadable format so if someone is spying on your network connections they won't be able to see what you are accessing/visiting(Your ISP for example). Which is important to use if you are going to be accessing questionable material. AES-256-CBC will provide with the highest level of encryption. Use this if you are paranoid. SLOWEST. BF-CBC (Blowfish), offers better encryption than AES-128 with minor speed difference, this is my go to cipher. SLOW. AES-128-CBC will provide minimum level of encryption, good for most people. FAST. No Cipher - You never want to use this as it doesn't encrypt your data at all, so people can see what you are doing online. FASTEST. Note: You won't notice much difference between the highest level and lowest level of encryption unless you do a lot of downloading. You can play online games, stream content without much difference on BF-CBC or AES-256-CBC. Fastest to Slowest: No Cipher >> AES-128-CBC >> BF-CBC >> AES-256-CBC Fastest to Slowest: HMAC-SHA1 >> HMAC-SHA256 >> HMAC-SHA512 You can see all the encryption ciphers here: https://torguard.net/tgspec.php Checks to make sure the adapter is installed. It's for the killswitch feature, if you lose connection to the VPN you can instruct torguard to disable your main network device, then have it re-enabled when you try to connect again. You can leave this disabled, I think it increases the quality of the TorGuard menu if on a higher resolution monitor. I never had to use it. Cipher Warning is when you don't set an encryption level as explained above. Network tab is where you will be able to set which device you want TorGuard to disable when you lose connection. There is also various other things, like webrtc/dns leak prevention on that tab. It's rather straight forward, if there is something in particular you don't understand feel free to ask. Proxy TAB is for STEALTH connections to bypass restrictive firewalls (School, Government, Corporate and Government networks like China). Generally you shouldn't have to worry about that tab. The last tab is for dedicated ip's that you purchase through TorGuard. Set: Cipher AES-128-CBC STEALTH Protocol TCP Enable DNS Leak Prevention Enable Webrtc Leak Prevention Enable IPV6 Leak Prevention Set DNS servers to OpenDNS or Level3 or Torguard You shouldn't rely on others to give you "best" settings, as it depends on what you need the VPN to do and should be tweaked accordingly by you for best results. The proxy service gives you access to Socks5/HTTP/HTTPS/SSH proxies, which is useful for torrenting or added protection, if you don't know what a proxy is: look it up. It's just an extension for Chrome that uses SSL proxies which doesn't offer the same level of security as TorGuards VPN client. Explained above. Umm, not sure what you mean by "proxy servers from Google", I am going to assume you mean the DNS servers settings for: Google, OpenDNS. Which in that case, it's for preventing IP leaks, so you don't use your ISP's dns servers which will pass on all your hostname queries to your ISP which is bad. Google is bad pick for DNS servers if you care about privacy. Use openDNS or TorGuards servers. Hopefully that helped explain things better.
  7. 1 point
  8. 1 point
    We can now confirm that all torguard servers are now safe from the VORACLE attack brought to light by Ahamed Nafeez at the DEF CON 26 hacker conference on Saturday - you do not have to do anything client side as this is a server side fix but we do recommend all users upgrade to the latest TG version from our downloads page released on the 8th of August. Regards
  9. 1 point
    You are fine using TLS 1.2, if it is implemented correctly it is secure - you are fine Regards
  10. 1 point
    Certainly will, as soon as they are ready we will post a little announcement on these forums. Regards
  11. 1 point
    Hey Everyone. I made a good tutorial on how to properly use TorGuard VPN + their mini VPN router sold from the router store, to access Netflix US content on the Ps4. This also works with any wi-fi enabled streaming device!
  12. 1 point
    Thanks for your suggestions, we are working to improve port forwards and will take note Regards
  13. 1 point
    Yes, absolutely, I will get this added to the to-do list, shouldn't be much of a problem for adding on one of our next couple of releases. Regards
  14. 1 point
  15. 1 point
    Greetings! I've been trying to determine if there is a way to pick the fastest server every time I launch Torguard LT or Torguard Visc. Currently, I do it manually by connecting, running a speed test, disconnecting...rinse repeat. Takes longer sometimes as the servers don't always connect quickly. I would like to automate this and was wondering if any way to do this with either app. The communities thoughts / opinions / advice is appreciated! Thanks!
  16. 1 point
    Hi - OpenVPN is an option but you still have to have the OpenVPN connect app installed. We are adding this yes. Regards
  17. 1 point
    It won't be an overhaul just a general improvement at first Security, speed and functionality are most important to us. Regards
  18. 1 point
    =============================================== TorGuard Production Release Release torguard-v0.3.84, 2018-04-28 ==================================== * All platforms: Disable cipher negotiation Ensure OpenVPN will use the user selected cipher by disabling cipher auto-negotiation We recommend you update to this release. Downloads
  19. 1 point
    Try adding stunnel/openconnect/openvpn2.4/2.3/ss-local/TorGuarddesktopQT binaries under C:\Program Files\VPNetwork LLC\TorGuard tls-crypt should be more than sufficient to bypass most dpi/firewall blocks - using stunnel is optional if you want a second SSL layer then, by all means use it, it is not "needed" in a sense to bypass blocks when using tls-crypt. Regards
  20. 1 point
    There can be a benefit on mobile devices yes, all GCM ciphers will be available in our Android app in our next release. Regards
  21. 1 point
  22. 1 point
    Both are good options - the shadowsocks (stealth proxy) will be removed in our next release - we find it slower than stunnel and less adequate at bypassing certain firewalls. Regards
  23. 1 point
    Welcome to TorGuard 1) OpenVPN is version 2.3, OpenVPN 2.4 is the newest version of OpenVPN and this version we recommend you use, OpenVPN 2.3 will be removed in a future release. 2) sTunnel is handy in locations where you might be blocked, Uni, public wifi hotspots, work, library etc it is also very useful in countries such as China and Iran, it can help speed up TCP based connections too. 3) Depends if you are in a highly restrictive country, network, you may just want to speedup TCP based connections or just want that extra layer of protection. 4) It helps obfuscate the OpenVPN signature - it won't hide the location of an IP address that you connect to. 5) If they block IP addresses directly or ASN numbers for the provider then the only way around such blocks are to find an IP that is not blocked, stealth wotn help you with website blocks unless that block is done via DPI etc. Regards
  24. 1 point
    Customer support is really good at fixing speed issues. They usually suggest doing the following when using the TORguard app Please click more Settings-> Network on the VPN app Uncheck the block outside DNS boxLocate three drop downs under the " use these nameservers" section Choose Google under all three of them on by oneClick Save and restart App firstTry to ConnectPlease connect with tunnel type as Open Connect and Protocol as UDP this time. I recently changed ISP providers to also get 100/10 service and the same setting above were not working for me. I kept google as the name servers and went back to tunneltype = OPENVPN, protocol UDP, port 1195(SHA 256) Ciper AES-256-CBC The servers closest to me I was getting about 60-70 Mbps, if you in USA, the Chicago server seems to connect fastest for me I now get 108/11 when connected to torguard. Before I made changes my downloads would not get pass 20. Try the first suggestion as this is what Torguard support usually recommends.
  25. 1 point
    Not bad at all for simply connecting but as you see, even connecting to torguard brings issues if your ISP is spying on you. This is very good example of something, where other tests show you that everyhing is ok but this test clearly shows you that your ISP is hijacking DNS. You need to have Java installed on your pc to run these tests, it does not work in chrome, but on firefox it does even if using combination of proxifier and foxyproxy (because java tool does all the job, not the browser itself) TEST NOW WITH ANALYZR Good article in german explaining it a little bit and includes the test itself. Send your tests to TorGuard support, they will help you very fast with any leaks, problems or even unintentionally missconfigured device like to open ports which you do not want at all opened. Here is one example (it provides a link which you can send to torguard support if your tests show any issues): More test results (example):
×