Introduction

This document contains notes on an installation and set up of dnscrypt-proxy on pfSense. These instructions apply to dnscrypt-proxy version 2 and are tested on pfSense 2.4.

There are two approaches: 1) have clients talk directly to dnscrypt-proxy from the network, or 2) use the built in dnsmasq forwarder in pfSense. The latter makes it possible to use extra functionality like registering DHCP hostnames in DNS.

Preperation

Using dnscrypt-proxy directly

Note down the IP adresses of the interfaces you want dnscrypt-proxy to listen on, to put in the configuration file. Make sure both DNS Forwarder and DNS Resolver are disabled.

Using both dnscrypt-proxy and dnsmasq

Create a new virtual IP in "Firewall->Virtul IPs" in the pfSense GUI:

Type: IP Alias
Interface: Localhost
IP address: 127.0.0.2/32

Configure "Services->DNS Forwarder" in the pfSense GUI:

Interfaces: Select all needed except for the 127.0.0.2 VIP interface.
Strict interface binding: true

Use the following custom options to enable DNSSEC:

dnssec
trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5
dnssec-check-unsigned

Install dnscrypt-proxy

Run the following to get dnscrypt-proxy and move the files in place.

cd /tmp
fetch https://github.com/jedisct1/dnscrypt-proxy/releases/download/2.0.2/dnscrypt-proxy-freebsd_amd64-2.0.2.tar.gz
tar -zxvf dnscrypt-proxy-freebsd_amd64-2.0.2.tar.gz
cp dnscrypt-proxy /usr/local/bin/
mkdir /usr/local/etc/dnscrypt-proxy
cp example-dnscrypt-proxy.toml /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml

Edit /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml as needed.

Create blacklists, cloaking and forwarding rules as needed. This is a compact example of a configuration for use with dnsmasq:

server_names = ['dnscrypt.eu-nl', 'dnscrypt.eu-dk']
listen_addresses = ['127.0.0.2:53']
max_clients = 250
ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = true
doh_servers = true
require_dnssec = true
use_syslog = true
cache = false
[sources]
  [sources.'public-resolvers']
  url = 'https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md'
  cache_file = 'public-resolvers.md'
  minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
  refresh_delay = 72
  prefix = ''

Create a start up script at /usr/local/etc/rc.d/dnscrypt-proxy.sh. Remember to chmod +x dnscrypt-proxy.sh:

#!/bin/sh
 /usr/local/bin/dnscrypt-proxy -config /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml

Finishing up

In "System->General Setup" in the GUI set the DNS servers to use, depending on where you are running dnscrypt-proxy.

Restart pfSense and check everything works.