Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| router:dhcp-dns [2024/09/17 09:52] – willy | router:dhcp-dns [2025/02/06 08:03] (current) – removed willy | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== DNS, DHCP and routing for the internal network ===== | ||
| - | |||
| - | Since your home network is connected **only** to your home server (right?), in order to be able to navigate and use the home network you must configure some services on your home server. | ||
| - | |||
| - | In detail, you will need: | ||
| - | * one DNS server, so that devices in the home network can resolve names to addresses (and filter ads) | ||
| - | * one DHCP server, so provide devices in the home network with automatic configuration | ||
| - | * one default gateway and router: to allow devices in the home network to access stuff on the internet | ||
| - | |||
| - | At first i have been using DNSmasq, which is a seemingly easy approach to both DNS and DHCP for the home network. After a lengthly and annoying debugging session with Android devices i found out that DNS has evolved a lot and DNSMasq is today a bit outdated. | ||
| - | |||
| - | I decided then to go straight to the Gentoo standard DHCP server and Unbound DNS resolver/ | ||
| - | |||
| - | For future reference, the older DNSMasq information has been moved to a separate page. | ||
| - | |||
| - | To create a router, you will be using the Linux built-in great nftables tools that today has replaced the older iptables. | ||
| - | |||
| - | |||
| - | === Unbound, your very own DNS resolver === | ||
| - | |||
| - | [[https:// | ||
| - | |||
| - | [[https:// | ||
| - | |||
| - | It's very simple to setup on Gentoo (see [[https:// | ||
| - | |||
| - | So, first of all enable DNSCrypt for Unbound by creating the file **/ | ||
| - | <file - unbound> | ||
| - | net-dns/ | ||
| - | </ | ||
| - | |||
| - | then emerge Unbound: | ||
| - | <code bash> | ||
| - | emerge unbound | ||
| - | </ | ||
| - | |||
| - | I am using the following **/ | ||
| - | <file - unbound.conf> | ||
| - | server: | ||
| - | verbosity: 1 | ||
| - | num-threads: | ||
| - | interface: 10.0.0.1@53 | ||
| - | interface: 127.0.0.1@53 | ||
| - | interface: 10.0.0.1@853 | ||
| - | interface: 127.0.0.1@853 | ||
| - | interface: 127.0.0.1@4443 # listen for DoH on local only port | ||
| - | port: 53 | ||
| - | https-port: 4443 | ||
| - | http-notls-downstream: | ||
| - | so-reuseport: | ||
| - | cache-min-ttl: | ||
| - | cache-max-ttl: | ||
| - | do-ip4: yes | ||
| - | do-ip6: yes | ||
| - | do-udp: yes | ||
| - | do-tcp: yes | ||
| - | use-systemd: | ||
| - | do-daemonize: | ||
| - | # For security reasons, only clients on the home interface can use the DNS service | ||
| - | | ||
| - | access-control: | ||
| - | use-syslog: yes | ||
| - | hide-identity: | ||
| - | hide-version: | ||
| - | harden-short-bufsize: | ||
| - | harden-large-queries: | ||
| - | harden-glue: | ||
| - | harden-dnssec-stripped: | ||
| - | harden-below-nxdomain: | ||
| - | harden-referral-path: | ||
| - | harden-algo-downgrade: | ||
| - | qname-minimisation: | ||
| - | qname-minimisation-strict: | ||
| - | aggressive-nsec: | ||
| - | use-caps-for-id: | ||
| - | prefetch: yes | ||
| - | rrset-roundrobin: | ||
| - | minimal-responses: | ||
| - | # This will enable DoT (upstream) | ||
| - | tls-cert-bundle: | ||
| - | | ||
| - | # This will add Ad blocking | ||
| - | include: / | ||
| - | include: / | ||
| - | | ||
| - | remote-control: | ||
| - | control-enable: | ||
| - | |||
| - | forward-zone: | ||
| - | name: " | ||
| - | # Use Google DNS as upstream DNS (put here your preferred ones if not Google) | ||
| - | forward-tls-upstream: | ||
| - | forward-addr: | ||
| - | forward-addr: | ||
| - | </ | ||
| - | |||
| - | To configure specific _internal_ hosts, you need to define a **local-zone** and a matching **local-data** rows as defined above. You might want to move these information to specific files to include (like the adservers.conf) for easier maintenance if you have lots of internal names. | ||
| - | |||
| - | At this point, read the [[router: | ||
| - | |||
| - | You need to populate your **/ | ||
| - | <file - resolv.conf> | ||
| - | # My own local DNS resolver (Unbound) | ||
| - | nameserver 127.0.0.1 | ||
| - | </ | ||
| - | |||
| - | Don't forget to autostart Unbound service: | ||
| - | <code bash> | ||
| - | rc-update add unbound default | ||
| - | / | ||
| - | </ | ||
| - | |||
| - | __NOTE:__ as far as i managed to understand, DoT is always enabled on the upstream connection only. You do not need, not want, DoT within your home network. | ||
| - | |||
| - | ==== Local zone ==== | ||
| - | |||
| - | The **local.conf** will contain your own home local addresses: | ||
| - | <file - local.conf> | ||
| - | server: | ||
| - | # Add a local resolve for the home server | ||
| - | local-zone: " | ||
| - | local-data: " | ||
| - | </ | ||
| - | |||
| - | ==== DNS over HTTPS ==== | ||
| - | |||
| - | The above configuration already enable DoH (DNS over HTTPS) in Unbound. I set it up on port 4443 because port 443 is already taken by the NGINX reverse proxy, of course, so you will need to create a reverse proxy from NGINX to Unbound covering the endpoint **/ | ||
| - | |||
| - | Drop the following configuration file into your NGINX home server configuration (see [[selfhost: | ||
| - | <file - dns.conf> | ||
| - | location /dns-query { | ||
| - | if ( $request_method !~ ^(GET|POST|HEAD)$ ) { | ||
| - | return 501; | ||
| - | } | ||
| - | proxy_set_header Host $http_host; | ||
| - | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| - | proxy_redirect off; | ||
| - | proxy_buffering off; | ||
| - | grpc_pass grpc:// | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Note that the classic __proxy_pass__ cannot be used because it does not support HTTP2 upstream, which is mandatory for Unbound, so you need to use // | ||
| - | |||
| - | Restart your NGINX, and your DoH should be operative. | ||
| - | |||
| - | Please keep in mind that DoH **only works with domain names** due to how certificates work, IP addresses **won' | ||
| - | |||
| - | Just to be clear: this DNS over HTTPS is a huge mess and a great headache. In fact, it's more a shitty way to prevent people to run DNS-based ad-blockers than anything. DoT already provided everything needed, but DoH is actually in the hands of the "big players" | ||
| - | |||
| - | |||
| - | ==== DHCP server ==== | ||
| - | |||
| - | Using the [[https:// | ||
| - | |||
| - | You should disable the ISC DHCP client as it is deprecated (and you already have the Gentoo' | ||
| - | <file - dhcp> | ||
| - | net-misc/ | ||
| - | </ | ||
| - | |||
| - | then just emerge it: | ||
| - | <code bash> | ||
| - | emerge net-misc/ | ||
| - | </ | ||
| - | |||
| - | Edit the DHCP configuration file **/ | ||
| - | <file - dhcpd.conf> | ||
| - | authoritative; | ||
| - | subnet 192.168.0.0 netmask 255.255.255.0 { | ||
| - | # disable DHCP on ISP#1 upstream network | ||
| - | } | ||
| - | subnet 192.168.1.0 netmask 255.255.255.0 { | ||
| - | # disable DHCP on ISP#2 upstream network | ||
| - | } | ||
| - | subnet 10.0.0.0 netmask 255.255.255.0 { | ||
| - | range 10.0.0.100 10.0.0.250; | ||
| - | option domain-name-servers 10.0.0.1; | ||
| - | option domain-name " | ||
| - | option routers 10.0.0.1; | ||
| - | } | ||
| - | host fixed-ip-pc { | ||
| - | hardware ethernet 12: | ||
| - | fixed-address 10.0.0.95; | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Here i assign a pool od dynamic IP addresses (from 100 to 254) on the 10.0.0.0 subnet. Addresses under 100 can be used for static assignments. For example, i use static IPs for all my OpenWRT Access Points and wired security cameras, and dynamic for all other devices. I have also defined my two ISP's subnets to explicitly disable DHCP assignments on them, which is not needed and might be an attack vector. | ||
| - | |||
| - | This config will also ensure that all devices will use the home server both as DNS server and gateway. | ||
| - | |||
| - | This will **not work** for devices that use hard-coded DNS servers (like Fire Sticks and Google Chromecasts...) but there is a workaround for those too, and i will show you on [[router: | ||
| - | |||
| - | This will **not work** with some Android devices either, and it's a massive PITA, because Android is moving to DoH and this will totally bypass your internal Unbound resolver, and there is __no way__ to fix it. This means also issues with Ad Blocking, go figure why Google is pushing this hard. | ||
| - | |||
| - | Well, this is almost all. Start //dhcp// service and make it start on boot: | ||
| - | <code bash> | ||
| - | rc-update add dhcp default | ||
| - | / | ||
| - | </ | ||
| - | |||
| - | Now you can connect your devices to the home network and they will get an IP address and a full network configuration to go with it. | ||
| - | |||