mirror of
https://git.freebsd.org/ports.git
synced 2025-05-06 19:06:44 -04:00
60 lines
1.6 KiB
Text
60 lines
1.6 KiB
Text
[
|
|
{ type: install
|
|
message: <<EOM
|
|
Version 2 of dnscrypt-proxy is written in Go. by default, this port's daemon
|
|
will listen on port 5353 (TCP/UDP) as the %%USER%% user.
|
|
|
|
It's possible to bind it and listen on port 53 (TCP/UDP) with mac_portacl(4)
|
|
kernel module (network port access control policy). For this add
|
|
dnscrypt_proxy_mac_portacl_enable=YES in your rc.conf. The dnscrypt-proxy
|
|
startup script will load mac_portacl and add a rule where %%USER%% user will
|
|
be able to bind on port 53 (TCP/UDP). This port can be changed by
|
|
dnscrypt_proxy_mac_portacl_port variable in your rc.conf. You also need to
|
|
change dnscrypt-proxy config file to use port 53.
|
|
|
|
Below are a few examples on how to redirect local connections from port
|
|
5353 to 53.
|
|
|
|
[ipfw]
|
|
|
|
ipfw nat 1 config if lo0 reset same_ports \
|
|
redirect_port tcp 127.0.0.1:5353 53 \
|
|
redirect_port udp 127.0.0.1:5353 53
|
|
ipfw add nat 1 ip from any to 127.0.0.1 via lo0
|
|
|
|
/etc/rc.conf:
|
|
firewall_enable="YES"
|
|
firewall_nat_enable="YES"
|
|
|
|
/etc/sysctl.conf:
|
|
net.inet.ip.fw.one_pass=0
|
|
|
|
[pf]
|
|
|
|
set skip on lo0
|
|
rdr pass on lo0 proto { tcp udp } from any to port 53 -> 127.0.0.1 port 5353
|
|
|
|
/etc/rc.conf:
|
|
pf_enable="YES"
|
|
|
|
[unbound]
|
|
|
|
/etc/rc.conf:
|
|
local_unbound_enable="YES"
|
|
|
|
/var/unbound/unbound.conf:
|
|
server:
|
|
interface: 127.0.0.1
|
|
do-not-query-localhost: no
|
|
|
|
/var/unbound/forward.conf:
|
|
forward-zone:
|
|
name: "."
|
|
forward-addr: 127.0.0.1@5353
|
|
|
|
If you are using local_unbound, DNSSEC is enabled by default. You should
|
|
comment the "auto-trust-anchor-file" line or change dnscrypt-proxy to use
|
|
servers with DNSSEC support only.
|
|
EOM
|
|
}
|
|
]
|