Client in Monitoring UI Recent Queries/Query Log

[ups7]

Hi,

I've enabled the Monitoring UI and it shows the recent queries just fine. However, all the calls are being show as from a single IP address: 192.168.192.1. This is despite me having configured dnscrypt-proxy on 2 devices on the internal network.

My setup is:
dnscrypt-proxy installed via as a Docker container (klutchell's image).
Docker is running on a Synology NAS.
Configured both NAS and my Ubuntu Linux laptop's network settings to use dnscrypt-proxy as the DNS server.

Various services on the NAS, Docker containers on the NAS and the laptop are all making DNS calls which are answered successfully by dnscrypt-proxy based on the logs, but the client is always the same: 192.168.192.1.

The odd thing is that I can't find 192.168.192.1 on the network anywhere. The local IP addresses are all 192.168.68.*.
Synology (and dnscrypt-proxy): 192.168.68.103
Laptop: 192.168.68.124
WiFi router: 192.168.68.1

Does anyone know how to get the client IP to show correctly? Ideally I would've liked to see the IP addresses of the individual Docker containers calling for DNS resolution, but at the very least expected to see 2 client IPs (NAS and Laptop) rather than 192.168.192.1.

Here is the config:

[monitoring_ui]

## Enable the monitoring UI
enabled = true

## Listen address for the monitoring UI
listen_address = "0.0.0.0:8080"

## Optional username and password for basic authentication
## To disable authentication, set username to an empty string: username = ""
## If both username and password are empty, no authentication is required
username = "admin"
password = "changeme"

## Optional TLS certificate and key for HTTPS
## If both are empty, HTTP will be used
tls_certificate = ""
tls_key = ""

## Enable query logging in the monitoring UI
## This will show recent queries in the UI
enable_query_log = true

## Privacy level for the monitoring UI
## 0: show all details including client IPs
## 1: anonymize client IPs (default)
## 2: aggregate data only (no individual queries or domains shown)
privacy_level = 0

## Maximum number of recent query log entries to keep in memory
## Helps control memory usage on high-traffic servers
## Default: 100
# max_query_log_entries = 100

## Maximum memory usage in MB for recent query logs
## Automatic cleanup when limit is exceeded
## Default: 1
# max_memory_mb = 1

## Enable Prometheus metrics endpoint
## Default: false
# prometheus_enabled = false

## Path for Prometheus metrics endpoint
## Default: /metrics
# prometheus_path = "/metrics"

Thanks in advance!

[jedisct1]

Maybe 192.168.192.1 is just the internal IP address of the Docker container?

[ups7]

Maybe 192.168.192.1 is just the internal IP address of the Docker container?

Thanks for responding. It's not the container itself as I had already checked that, but after some further digging found out that it was the IP of the docker network gateway which was attached to the dnscrypt-proxy container.

Based on what I'm reading, one solution is to use network_mode: host for the container, but this means port mappings don't work and I have to change the listening port in the config file to 53. This however leads to a permission error (due to 53 being a privileged port) and I had to specify the user: root directive to get it to work. Once done, I can see all individual IPs in the monitoring UI which is great to see!

But... I don't really want to run the dnscrypt-proxy container as root, so will investigate any alternative options unless someone here has come across this and are able to give me some direction.

[jedisct1]

Maybe with a MACVLAN? https://docs.docker.com/engine/network/drivers/macvlan/

[jedisct1]

With docker-compose:

  networks:
    macvlan_net:
      driver: macvlan
      driver_opts:
        parent: eth0  # Host's physical interface
      ipam:
        config:
          - subnet: 192.168.68.0/24
            gateway: 192.168.68.1
            ip_range: 192.168.68.200/29  # Reserve some IPs for containers

  services:
    dnscrypt-proxy:
      networks:
        macvlan_net:
          ipv4_address: 192.168.68.200

[ups7]

Thank you for this, it is very helpful. I will give it a go this week and let you know.