Ubuntu server 22.04 LTS - Connection refused

[SunnyMoo]

Discussed in #2178

^{Originally posted by SunnyMoo August 9, 2022}
Hi,
trying to set dnscrypt-proxy on my freshly installed from scratch Ubuntu 22.04 server but can't make it work. Tried from scratch once again same problem.
I followed mixed wiki instruction for Ubuntu and generic linux as I have no NetworkManager.conf nor dnsmasq.

$@$:/etc# systemctl status NetworkManager
Unit NetworkManager.service could not be found.

Briefly it looks like:

 apt install dnscrypt-proxy
 cd /etc/dnscrypt-proxy
 cp dnscrypt-proxy.toml dnscrypt-proxy.toml.original

Here I copy my backed up toml and forwarding rules files. (github's version has invalid keys I had to comment)
Then:

 systemctl stop systemd-resolved
 systemctl disable systemd-resolved
 systemctl restart dnscrypt-proxy

I guess it's all good, so I check:

$:$# systemctl status systemd-resolved
○ systemd-resolved.service - Network Name Resolution
     Loaded: loaded (/lib/systemd/system/systemd-resolved.service; disabled; vendor preset: enabled)
     Active: inactive (dead)
       Docs: man:systemd-resolved.service(8)
             man:org.freedesktop.resolve1(5)
             https://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
             https://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
$:$# systemctl status dnscrypt-proxy
● dnscrypt-proxy.service - DNSCrypt client proxy
     Loaded: loaded (/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor preset: enabled)
     Active: active (running) since Tue 2022-08-09 17:11:33 UTC; 1min 10s ago
TriggeredBy: ● dnscrypt-proxy.socket
       Docs: https://github.com/DNSCrypt/dnscrypt-proxy/wiki
   Main PID: 885 (dnscrypt-proxy)
      Tasks: 10 (limit: 18969)
     Memory: 20.2M
        CPU: 345ms
     CGroup: /system.slice/dnscrypt-proxy.service
             └─885 /usr/sbin/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Aug 09 17:11:55 _ dnscrypt-proxy[885]: [2022-08-09 17:11:55] [NOTICE] dnscrypt-proxy is ready - live servers: 56
^C
$:$# ss -lp 'sport = :domain'
Netid   State    Recv-Q   Send-Q     Local Address:Port        Peer Address:Port   Process
udp     UNCONN   0        0              127.0.2.1:domain           0.0.0.0:*       users:(("dnscrypt-proxy",pid=885,fd=9),("systemd",pid=1,fd=66))
tcp     LISTEN   0        4096           127.0.2.1:domain           0.0.0.0:*       users:(("dnscrypt-proxy",pid=885,fd=8),("systemd",pid=1,fd=65))

Finally to the failure:

$:$# dnscrypt-proxy -resolve github.com -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
Resolving [github.com] using 127.0.0.1 port 53

Unable to resolve: [read udp 127.0.0.1:39262->127.0.0.1:53: read: connection refused]

I don't understand what's wrong.
Note I also tried resolv.conf manipulations (removal, edit, override) with no success.
Note2: server is hosted by OVH and has DHCP pushed configuration I guess.

Many thanks for your help !

[lifenjoiner]

$:$# ss -lp 'sport = :domain'
Netid   State    Recv-Q   Send-Q     Local Address:Port        Peer Address:Port   Process
udp     UNCONN   0        0              127.0.2.1:domain           0.0.0.0:*       users:(("dnscrypt-proxy",pid=885,fd=9),("systemd",pid=1,fd=66))
tcp     LISTEN   0        4096           127.0.2.1:domain           0.0.0.0:*       users:(("dnscrypt-proxy",pid=885,fd=8),("systemd",pid=1,fd=65))

Vs

$:$# dnscrypt-proxy -resolve github.com -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
Resolving [github.com] using 127.0.0.1 port 53

Unable to resolve: [read udp 127.0.0.1:39262->127.0.0.1:53: read: connection refused]

127.0.2.1:domain Vs 127.0.0.1:53, different IPs, it should be the reason.
Same /etc/dnscrypt-proxy/dnscrypt-proxy.toml on the same machine? How could that happen?
... Keep listen_addresses the same.

[SunnyMoo]

Hi lifenjoiner,
both commands are done together using the same toml where "listen_addresses = []" by default from apt install and according to https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Installation-on-Debian-and-Ubuntu
I don't know where this 127.0.2.1 IP comes from.

After disable dnscrypt-proxy here's the output:

# ss -lp 'sport = :domain'
Netid     State      Recv-Q      Send-Q           Local Address:Port             Peer Address:Port     Process
udp       UNCONN     0           0                    127.0.2.1:domain                0.0.0.0:*         users:(("systemd",pid=1,fd=68))
udp       UNCONN     0           0                127.0.0.53%lo:domain                0.0.0.0:*         users:(("systemd-resolve",pid=936,fd=13))
tcp       LISTEN     0           4096                 127.0.2.1:domain                0.0.0.0:*         users:(("systemd",pid=1,fd=67))
tcp       LISTEN     0           4096             127.0.0.53%lo:domain                0.0.0.0:*         users:(("systemd-resolve",pid=936,fd=14))

grep -rnw '/etc' -e '127.0.2.1'
returns no result

grep -rnw '/etc' -e '127.0.0.53'
returns /etc/resolv.conf

edit:

/# grep -rnw '/usr' -e '127.0.2.1'
/usr/lib/systemd/system/dnscrypt-proxy.socket:9:ListenStream=127.0.2.1:53
/usr/lib/systemd/system/dnscrypt-proxy.socket:10:ListenDatagram=127.0.2.1:53

127.0.2.1 seems to be set by dnscrypt-proxy itself.

[SunnyMoo]

I may find a workaround by changing 127.0.2.1 in /usr/lib/systemd/system/dnscrypt-proxy.socket by 127.0.0.53
Seems to work but I don't know if this workaround is acceptable.

[lifenjoiner]

In my knowledge, listen_addresses in dnscrypt-proxy.toml should be the same one as (or a super set of) the system DNS is configured.

I am not an Ubuntu user, and don't known why the Wiki suggests:

In dnscrypt-proxy.toml, replace listen_addresses = ['127.0.0.1:53'] with listen_addresses = [] (by default, after DNSCrypt-Proxy install, there shouldn't be any IP address in this option).

[SunnyMoo]

When I change listen_adresses in the toml it ends to:
[FATAL] listen udp 127.0.0.1:53: bind: permission denied
or
[FATAL] listen udp 127.0.0.53:53: bind: permission denied

[SunnyMoo]

Tried this guide and its update, with no success at all: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/systemd#disable-systemd-socket-activation
Modifying listen_adresses in toml file always ends up to read connection refused.