Пролог
Сконфигурированы упомянутые в title темы сервисы для совместной работы и обхода DNS Inernet Service Provider.
Используется один из DNS resolver IPv4 из списка https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv
Сцена первая
blitz@inode ~ % sudo systemctl status systemd-networkd
● systemd-networkd.service - Network Service
Loaded: loaded (/usr/lib/systemd/system/systemd-networkd.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2017-07-21 17:32:27 CEST; 2min 3s ago
Docs: man:systemd-networkd.service(8)
Main PID: 545 (systemd-network)
Status: "Processing requests..."
Tasks: 1 (limit: 4915)
CGroup: /system.slice/systemd-networkd.service
└─545 /usr/lib/systemd/systemd-networkd
Jul 21 17:32:27 inode systemd[1]: Starting Network Service...
Jul 21 17:32:27 inode systemd-networkd[545]: Enumeration completed
Jul 21 17:32:27 inode systemd-networkd[545]: eno1: Renamed to eth0
Jul 21 17:32:27 inode systemd[1]: Started Network Service.
Jul 21 17:32:27 inode systemd-networkd[545]: eth0: Renamed to eno1
Jul 21 17:32:27 inode systemd-networkd[545]: eno1: IPv6 successfully enabled
Jul 21 17:32:30 inode systemd-networkd[545]: eno1: Gained carrier
Jul 21 17:32:32 inode systemd-networkd[545]: eno1: Gained IPv6LL
Jul 21 17:32:33 inode systemd-networkd[545]: eno1: Configured
Jul 21 17:32:34 inode systemd-networkd[545]: eno1: DHCPv4 address 192.168.1.5/24 via 192.168.1.1
blitz@inode ~ % sudo systemctl status systemd-resolved
● systemd-resolved.service - Network Name Resolution
Loaded: loaded (/usr/lib/systemd/system/systemd-resolved.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2017-07-21 17:32:28 CEST; 2min 6s ago
Docs: man:systemd-resolved.service(8)
http://www.freedesktop.org/wiki/Software/systemd/resolved
http://www.freedesktop.org/wiki/Software/systemd/writing-network-configuration-managers
http://www.freedesktop.org/wiki/Software/systemd/writing-resolver-clients
Main PID: 562 (systemd-resolve)
Status: "Processing requests..."
Tasks: 1 (limit: 4915)
CGroup: /system.slice/systemd-resolved.service
└─562 /usr/lib/systemd/systemd-resolved
Jul 21 17:32:27 inode systemd[1]: Starting Network Name Resolution...
Jul 21 17:32:27 inode systemd-resolved[562]: Positive Trust Anchors:
Jul 21 17:32:27 inode systemd-resolved[562]: . IN DS 19036 8 2 49aac11d7b6f6446702e54a1607371607a1a41855200fd2ce1cdde32f24e8fb5
Jul 21 17:32:27 inode systemd-resolved[562]: . IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d
Jul 21 17:32:27 inode systemd-resolved[562]: Negative trust anchors: 10.in-addr.arpa 16.172.in-addr.arpa 17.172.in-addr.arpa 18.172.in-addr.arpa 19.172.in-addr.arpa
Jul 21 17:32:27 inode systemd-resolved[562]: Using system hostname 'inode'.
Jul 21 17:32:28 inode systemd[1]: Started Network Name Resolution.
Jul 21 17:32:40 inode systemd-resolved[562]: Switching to DNS server 127.0.0.1 for interface eno1.
Jul 21 17:32:40 inode systemd-resolved[562]: Switching to system DNS server 127.0.0.1.
blitz@inode ~ % sudo systemctl status dnscrypt-proxy
● dnscrypt-proxy.service - DNSCrypt client proxy
Loaded: loaded (/usr/lib/systemd/system/dnscrypt-proxy.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2017-07-21 17:32:27 CEST; 2min 11s ago
Docs: man:dnscrypt-proxy(8)
Main PID: 563 (dnscrypt-proxy)
Tasks: 1 (limit: 4915)
CGroup: /system.slice/dnscrypt-proxy.service
└─563 /usr/bin/dnscrypt-proxy /etc/dnscrypt-proxy.conf
Jul 21 17:32:27 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:27 2017 [NOTICE] Starting dnscrypt-proxy 1.9.4
Jul 21 17:32:27 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:27 2017 [INFO] Loading plugin [/usr/lib/dnscrypt-proxy/libdcplugin_example_cache.so]
Jul 21 17:32:27 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:27 2017 [INFO] Loaded plugin: [A basic DNS cache]
Jul 21 17:32:27 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:27 2017 [INFO] Generating a new session key pair
Jul 21 17:32:27 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:27 2017 [INFO] Done
Jul 21 17:32:37 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:37 2017 [INFO] Server certificate with serial #1500606001 received
Jul 21 17:32:37 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:37 2017 [INFO] This certificate is valid
Jul 21 17:32:37 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:37 2017 [INFO] Chosen certificate #1500606001 is valid from [2017-07-21] to [2017-07-22]
Jul 21 17:32:37 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:37 2017 [INFO] Server key fingerprint is 9A06:0931:9CC8:23E4:E519:2A16:2E0A:6BF2:76D3:8C70:0542:6E9E:0CB6
Jul 21 17:32:37 inode dnscrypt-proxy[563]: Fri Jul 21 17:32:37 2017 [NOTICE] Proxying from 127.0.0.1:53 to [2001:19f0:5001:30a:5400:ff:fe58:7140]:443
Архиважное - timing services. systemd-resolved должна работать только с 127.0.0.1/dnscrypt-proxy. dnscrypt-proxy должен успеть обратиться к серверу DNS провайдера 192.168.1.1 первым и все DNS запросы обрабатывать сам.
Сцена вторая
При открытии китайского сайта, systemd-resolved - переключается на IPv6 - в обход dnscrypt-proxy.
Переключается на DNS servers провайдера.
Jul 25 01:45:54 inode systemd-resolved[581]: Switching to system DNS server 127.0.0.1.
Jul 25 01:46:01 inode systemd-resolved[581]: Switching to DNS server 127.0.0.1 for interface eno1.
Jul 25 01:46:02 inode systemd-resolved[581]: Switching to DNS server [b]192.168.1.1[/b] for interface eno1.
Jul 25 01:46:02 inode systemd-resolved[581]: Switching to DNS server [b]fe80::9e97:26ff:fe13:d6a9%2[/b] for interface eno1.
Эпилог
Как запретить systemd-resolved переключение на другие DNS серверы?
