This repo is a collection of scripts and config files to apply allowedlist/whitelist DNS filtering to all traffic from or passing through a lineageos phone.
-
It blocks the android builtin DNS over TLS feature and redirects all regular DNS queries (using iptables) to the custom port 55 on which dnscrypt is configured to listen.
-
It also blocks the DoT port 853 in general since dnscrypt does not need it.
-
All traffic passing through the phone (Thethering wifi/bluetooth/usb) is blocked through iptables (Because google family link does not cover thethering).
-
These adjustments are meant to be used together with google family link to prevent the user from installing apps which can break the DNS filter (e.g. cloudflare WARP, firefox with addons, it is best to stick to a mobile browser which does not allow the configuration of a DNS server or VPN addons (e.g. chrome))
The scripts in in this repo are inspired by these guides:
- Running shell scripts as root during boot on lineageos
- Running dnscrypt-proxy on android as a local DNS resolver
- 21
- (Deprecated) 20
You need to enable adb debugging and adb root debugging in the developer settings.
- Install ADB tools on your linux/mac (I have not tested it on windows)
- Modify the config files for dnscrypt and lineageos
- Enable developer settings on your phone
- Enable USB debugging and USB root debugging (On your lineageos phone)
- Connect your phone (approve adb access)
- Run the setup script 'bash ./setup.sh'
- The scripts and services currently run as root, which is not necessary (see the first attribution link)
- No auto updates for the dnscrypt binary