A bash script for Ubiquiti EdgeRouters (tested on EdgeOS 3.x) that keeps the DNSSEC root trust anchors of the router's DNS forwarder (dnsmasq) up to date.
Purpose: dnsmasq does not update root trust anchors on its own. When the root zone introduces a new key and the matching anchor is missing, DNS validation fails and the internet appears to be down. This script adds new anchors automatically, ahead of time.
What it does:
- Downloads IANA's signed trust-anchor list, with fallbacks (the router's DNS, then direct DNS lookups, then http) for when broken DNS blocks the download.
- Verifies the signature against the ICANN Root CA before trusting any data.
- Adds anchors that are valid now or become valid within a configurable lookahead (default 30 days), and saves them to the persistent config.
- Only adds, never deletes. Any failure means no change, with a clear log and syslog message.
- Runs weekly through the EdgeOS task scheduler and needs only tools already on the router (
bash,curl,openssl,vbash, Python). Full documentation and installation steps
This repo contains several feature wizards for EdgeRouter's EdgeOS.
In order to add any wizard:
- Download the Wizard's tar.gz file
- Log into your router
- Navigate to the Wizards page
- Press on the + near "Feature Wizards"
- Enter the Wizard's name and upload its file
This Feature Wizard allow to view the last 1000 lines of the primary system log file (/var/log/messages). This log file contains a historical record of all processes, system events, errors, warnings, and messages generated by the operating system and services running on the device.
This Feature Wizard allow to view the last 1000 lines of the primary system log file (/var/log/dnsmasq.log). This log file contains logging information related to the DNS and DHCP services provided by dnsmasq.
If you have any improvement ideas for these wizards or ideas for more useful feature wizards to create let me know.