Forwarding .onion doesn't work with my configuration #2943

hamedsbt · 2025-09-04T08:01:08Z

hamedsbt
Sep 4, 2025

Hi there,

forwarding-rules.txt:

onion 127.0.0.1:9053
exit 127.0.0.1:9053

dnscrypt-proxy.toml:

forwarding_rules = '/etc/forwarding-rules.txt'

Tor config:

AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
DNSPort 127.0.0.1:9053

dnscrypt-proxy log:

[2025-09-04 06:26:56] [NOTICE] dnscrypt-proxy 2.1.13
[2025-09-04 06:26:56] [NOTICE] Network connectivity detected
[2025-09-04 06:26:56] [NOTICE] Now listening to 192.168.0.1:53 [UDP]
[2025-09-04 06:26:56] [NOTICE] Now listening to 192.168.0.1:53 [TCP]
[2025-09-04 06:26:56] [NOTICE] Source [public-resolvers] loaded
[2025-09-04 06:26:56] [NOTICE] Source [relays] loaded
[2025-09-04 06:26:56] [NOTICE] Source [odoh-servers] loaded
[2025-09-04 06:26:56] [NOTICE] Source [odoh-relays] loaded
[2025-09-04 06:26:56] [NOTICE] Loading the set of allowed names from [/etc/dnscrypt-proxy-allowlist.txt]
[2025-09-04 06:26:56] [NOTICE] Firefox workaround initialized
[2025-09-04 06:26:56] [NOTICE] Loading the set of blocking rules from [/etc/dnscrypt-proxy-blocklist.txt]
[2025-09-04 06:27:00] [NOTICE] Loading the set of cloaking rules from [/etc/dnscrypt-proxy-cloaking-rules.txt]
[2025-09-04 06:27:00] [NOTICE] Loading the set of forwarding rules from [/etc/forwarding-rules.txt]
[2025-09-04 06:27:00] [INFO] Forwarding [onion] to [127.0.0.1:9053]
[2025-09-04 06:27:00] [INFO] Forwarding [exit] to [127.0.0.1:9053]
[2025-09-04 06:27:00] [NOTICE] Hot reload is disabled
[2025-09-04 06:27:00] [NOTICE] Initializing monitoring UI
...

But it can't resolve michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion

It seems that dnscrypt-proxy doesn't forward query:

# nslookup michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
Server:		192.168.0.1
Address:	192.168.0.1:53

Non-authoritative answer:

*** Can't find michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion: No answer

But the tor dns service is working:

# nslookup michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion 127.0.0.1:9053
Server:		127.0.0.1:9053
Address:	127.0.0.1:9053

Non-authoritative answer:
Name:	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
Address: 127.241.247.60

Non-authoritative answer:
Name:	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
Address: febc:1f10:783:686c:a006:7063:da74:c8e7

I have configured the tor dns service as 192.168.0.1:9053 but it didn't work too.

Answered by hamedsbt

Sep 7, 2025

I have fixed the issue by set force_tcp = false
Thank you for support.

View full answer

lifenjoiner · 2025-09-04T08:36:03Z

lifenjoiner
Sep 4, 2025
Maintainer

Works on my Win10.

Enable query log and see?

dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

Line 546 in e27f9b8

# file = 'query.log'

0 replies

hamedsbt · 2025-09-04T09:42:11Z

hamedsbt
Sep 4, 2025
Author

Thank you for your support.

OS: OpenWrt 24.10.2 and I have changed tor and dnscrypt configs from 127.0.0.1 to 192.168.0.1

forwarding-rules.txt:

onion 192.168.0.1:9053
exit 192.168.0.1:9053

Tor config:

AutomapHostsSuffixes .onion,.exit
AutomapHostsOnResolve 1
DNSPort 192.168.0.1:9053

log config:

[query_log]

## Path to the query log file (absolute, or relative to the same directory as the config file)
## Can be set to /dev/stdout in order to log to the standard output.

file = '/var/log/dnscrypt-proxy-query.log'


## Query log format (currently supported: tsv and ltsv)

format = 'tsv'


## Do not log these query types, to reduce verbosity. Keep empty to log everything.

# ignored_qtypes = ['DNSKEY', 'NS']

log:

[2025-09-04 xxx]	192.168.0.1	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion	AAAA	SYNTH	1ms	-
[2025-09-04 xxx]	192.168.0.1	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion	A	DROP	2ms	192.168.0.1:9053
[2025-09-04 xxx]	192.168.0.1	michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion	A	DROP	2ms	192.168.0.1:9053

I'm wondering why it was dropped?! Is the Tor config incorrect?

0 replies

lifenjoiner · 2025-09-04T11:07:31Z

lifenjoiner
Sep 4, 2025
Maintainer

Test other forwarding rules instead of onion names?

1 reply

hamedsbt Sep 4, 2025
Author

All other forwarding rules are working.

lifenjoiner · 2025-09-04T11:53:11Z

lifenjoiner
Sep 4, 2025
Maintainer

Let's bring out the big guns!

Set log_level to 0

dnscrypt-proxy/dnscrypt-proxy/example-dnscrypt-proxy.toml

Line 209 in e27f9b8

# log_level = 2
Set environment variable DEBUG to 1, and then lauch the program
Query and get the logs

9 replies

hamedsbt Sep 6, 2025
Author

I've enabled debug mode by adding procd_set_param env DEBUG=1 to the service file.

Debug log:

[2025-09-06 x] [DEBUG] clients count: 1
[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.1:40607
[2025-09-06 x] [DEBUG] Using candidate [dnscry.pt-yerevan-ipv4] RTT: 125 Score: 0.912
[2025-09-06 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-06 x] [DEBUG] Calling UpdateMetrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-06 x] [DEBUG] Updating metrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-06 x] [DEBUG] Total queries now: 31
[2025-09-06 x] [DEBUG] Updated QPS: 0.01
[2025-09-06 x] [DEBUG] Cache miss, total misses: 27
[2025-09-06 x] [DEBUG] Query type AAAA, count: 7
[2025-09-06 x] [DEBUG] Response time: 2ms, avg: 242.97ms
[2025-09-06 x] [DEBUG] No server name or server is '-'
[2025-09-06 x] [DEBUG] Domain michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion, count: 3
[2025-09-06 x] [DEBUG] Added query log entry, total entries: 31,memory usage: 4304 bytes
[2025-09-06 x] [DEBUG] clients count: 0
[2025-09-06 x] [DEBUG] GetMetrics called
[2025-09-06 x] [DEBUG] GetMetrics - total queries: 31
[2025-09-06 x] [DEBUG] Computed and cached new metrics
[2025-09-06 x] [DEBUG] clients count: 1
[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.15:40607
[2025-09-06 x] [DEBUG] Using candidate [cs-de] RTT: 247 Score: 0.827
[2025-09-06 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-06 x] [DEBUG] Forwarding [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion] to [127.0.0.1:9053]
[2025-09-06 x] [DEBUG] clients count: 0

lifenjoiner Sep 7, 2025
Maintainer

Over?

Didn't get why it's dropped.

Try the binary from my branch https://github.com/lifenjoiner/dnscrypt-proxy/actions/runs/17523155580, and show the drop reason.

?

[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.1:40607

Vs

[2025-09-06 x] [DEBUG] Processing incoming query from 192.168.0.15:40607

hamedsbt Sep 7, 2025
Author

Thnk you again for your support. I think I found the reason for the drop:

[2025-09-07 x] [DEBUG] Drops query: dial tcp 127.0.0.1:9053: connect: connection refused

AFAIK, the Tor client (as a DNS server) only listens on UDP (not TCP) ports. Am I right?

# netstat -tunlp | grep tor
tcp        0      0 192.168.0.1:9050      0.0.0.0:*               LISTEN      2093/tor
udp        0      0 127.0.0.1:9053          0.0.0.0:*                           2093/tor

log:

[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] clients count: 2
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.1:1551
[2025-09-07 x] [DEBUG] Using candidate [cs-belgium] RTT: 252 Score: 0.824
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.1:1551
[2025-09-07 x] [DEBUG] Using candidate [dnscry.pt-moscow-ipv4] RTT: 269 Score: 0.812
[2025-09-07 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-07 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-07 x] [DEBUG] Forwarding [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion] to [127.0.0.1:9053]
[2025-09-07 x] [DEBUG] Calling UpdateMetrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-07 x] [DEBUG] Updating metrics for query: michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion
[2025-09-07 x] [DEBUG] Total queries now: 48
[2025-09-07 x] [DEBUG] Updated QPS: 0.04
[2025-09-07 x] [DEBUG] Cache miss, total misses: 44
[2025-09-07 x] [DEBUG] Query type AAAA, count: 20
[2025-09-07 x] [DEBUG] Response time: 2ms, avg: 141.98ms
[2025-09-07 x] [DEBUG] No server name or server is '-'
[2025-09-07 x] [DEBUG] Domain michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion, count: 4
[2025-09-07 x] [DEBUG] Added query log entry, total entries: 48, memory usage: 6495 bytes
[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] Drops query: dial tcp 127.0.0.1:9053: connect: connection refused
[2025-09-07 x] [DEBUG] clients count: 0
[2025-09-07 x] [DEBUG] GetMetrics called
[2025-09-07 x] [DEBUG] GetMetrics - total queries: 48
[2025-09-07 x] [DEBUG] Computed and cached new metrics
[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.1:1551
[2025-09-07 x] [DEBUG] Using candidate [dnscry.pt-telaviv-ipv4] RTT: 380 Score: 0.734
[2025-09-07 x] [DEBUG] Handling query for [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion]
[2025-09-07 x] [DEBUG] Forwarding [michaelahgu3sqef5yz3u242nok2uczduq5oxqfkwq646tvjhdnl35id.onion] to [127.0.0.1:9053]
[2025-09-07 x] [DEBUG] Drops query: dial tcp 127.0.0.1:9053: connect: connection refused
[2025-09-07 x] [DEBUG] clients count: 0
[2025-09-07 x] [DEBUG] clients count: 1
[2025-09-07 x] [DEBUG] Processing incoming query from 192.168.0.15:53935
[2025-09-07 x] [DEBUG] Using candidate [dnscry.pt-frankfurt-ipv4] RTT: 272 Score: 0.810
[2025-09-07 x] [DEBUG] Handling query for [excess.duolingo.com]
[2025-09-07 x] [DEBUG] Calling UpdateMetrics for query: excess.duolingo.com
[2025-09-07 x] [DEBUG] Updating metrics for query: excess.duolingo.com
[2025-09-07 x] [DEBUG] Total queries now: 49
[2025-09-07 x] [DEBUG] Updated QPS: 0.08
[2025-09-07 x] [DEBUG] Cache miss, total misses: 45
[2025-09-07 x] [DEBUG] Blocked query (return code: REJECT), total blocks: 10
[2025-09-07 x] [DEBUG] Query type A, count: 29
[2025-09-07 x] [DEBUG] Response time: 0ms, avg: 139.08ms
[2025-09-07 x] [DEBUG] No server name or server is '-'
[2025-09-07 x] [DEBUG] Domain excess.duolingo.com, count: 10
[2025-09-07 x] [DEBUG] Added query log entry, total entries: 49, memory usage: 6622 bytes
[2025-09-07 x] [DEBUG] clients count: 0
[2025-09-07 x] [DEBUG] GetMetrics called
[2025-09-07 x] [DEBUG] GetMetrics - total queries: 49
[2025-09-07 x] [DEBUG] Computed and cached new metrics

hamedsbt Sep 7, 2025
Author

I have fixed the issue by set force_tcp = false
Thank you for support.

Answer selected by hamedsbt

hamedsbt Sep 7, 2025
Author

Is it possible to leave force_tcp = true as the default and overwrite it in the forward rule by specifying the forward type (TCP or UDP) in the forward rule?

I've got to use TCP for plain DNS requests because it can bypass some censorship systems more easily.

jedisct1 · 2025-09-04T13:03:39Z

jedisct1
Sep 4, 2025
Maintainer

Set block_undelegated = false

1 reply

hamedsbt Sep 6, 2025
Author

Thank you for support.
Didn't work.

Forwarding .onion doesn't work with my configuration #2943

Uh oh!

Uh oh!

hamedsbt Sep 4, 2025

Replies: 5 comments · 11 replies

Uh oh!

lifenjoiner Sep 4, 2025 Maintainer

Uh oh!

hamedsbt Sep 4, 2025 Author

Uh oh!

lifenjoiner Sep 4, 2025 Maintainer

Uh oh!

hamedsbt Sep 4, 2025 Author

Uh oh!

lifenjoiner Sep 4, 2025 Maintainer

Uh oh!

hamedsbt Sep 6, 2025 Author

Uh oh!

lifenjoiner Sep 7, 2025 Maintainer

Uh oh!

hamedsbt Sep 7, 2025 Author

Uh oh!

hamedsbt Sep 7, 2025 Author

Uh oh!

Uh oh!

hamedsbt Sep 7, 2025 Author

Uh oh!

jedisct1 Sep 4, 2025 Maintainer

Uh oh!

hamedsbt Sep 6, 2025 Author

hamedsbt
Sep 4, 2025

Replies: 5 comments 11 replies

lifenjoiner
Sep 4, 2025
Maintainer

hamedsbt
Sep 4, 2025
Author

lifenjoiner
Sep 4, 2025
Maintainer

hamedsbt Sep 4, 2025
Author

lifenjoiner
Sep 4, 2025
Maintainer

hamedsbt Sep 6, 2025
Author

lifenjoiner Sep 7, 2025
Maintainer

hamedsbt Sep 7, 2025
Author

hamedsbt Sep 7, 2025
Author

hamedsbt Sep 7, 2025
Author

jedisct1
Sep 4, 2025
Maintainer

hamedsbt Sep 6, 2025
Author