Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revision | |||
| router:dns [2024/10/24 18:48] – willy | router:dns [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== Simple Approach: DNS ===== | ||
| - | |||
| - | [[https:// | ||
| - | |||
| - | It's very simple to setup on Gentoo (see [[https:// | ||
| - | |||
| - | So, first of all enable DNSCrypt for Unbound by creating the file **/ | ||
| - | <file - unbound> | ||
| - | net-dns/ | ||
| - | </ | ||
| - | |||
| - | then emerge Unbound: | ||
| - | <code bash> | ||
| - | emerge unbound | ||
| - | </ | ||
| - | |||
| - | I am using the following **/ | ||
| - | <file - unbound.conf> | ||
| - | server: | ||
| - | verbosity: 1 | ||
| - | num-threads: | ||
| - | interface: 10.0.0.1@53 | ||
| - | interface: 127.0.0.1@53 | ||
| - | interface: 127.0.0.1@4443 # listen for DoH on local only port | ||
| - | https-port: 4443 # move defsault DNS over HTTPS port not to clash with NGINX | ||
| - | http-notls-downstream: | ||
| - | so-reuseport: | ||
| - | cache-min-ttl: | ||
| - | cache-max-ttl: | ||
| - | do-ip4: yes | ||
| - | do-ip6: yes | ||
| - | do-udp: yes | ||
| - | do-tcp: yes | ||
| - | use-systemd: | ||
| - | do-daemonize: | ||
| - | # For security reasons, only clients on the home interface can use the DNS service | ||
| - | access-control: | ||
| - | access-control: | ||
| - | use-syslog: yes | ||
| - | hide-identity: | ||
| - | hide-version: | ||
| - | harden-short-bufsize: | ||
| - | harden-large-queries: | ||
| - | harden-glue: | ||
| - | harden-dnssec-stripped: | ||
| - | harden-below-nxdomain: | ||
| - | harden-referral-path: | ||
| - | harden-algo-downgrade: | ||
| - | qname-minimisation: | ||
| - | qname-minimisation-strict: | ||
| - | aggressive-nsec: | ||
| - | use-caps-for-id: | ||
| - | prefetch: yes | ||
| - | rrset-roundrobin: | ||
| - | minimal-responses: | ||
| - | |||
| - | tls-cert-bundle: | ||
| - | auto-trust-anchor-file: | ||
| - | | ||
| - | include: / | ||
| - | | ||
| - | include: / | ||
| - | | ||
| - | remote-control: | ||
| - | control-enable: | ||
| - | |||
| - | forward-zone: | ||
| - | name: " | ||
| - | # Use Google DNS as upstream DNS (put here your preferred ones if not Google) | ||
| - | forward-tls-upstream: | ||
| - | forward-addr: | ||
| - | forward-addr: | ||
| - | </ | ||
| - | |||
| - | To configure specific _internal_ hosts, you need to define a **local-zone** and a matching **local-data** rows as defined above. You might want to move these information to specific files to include (like the adservers.conf) for easier maintenance if you have lots of internal names. | ||
| - | |||
| - | At this point, read the [[router: | ||
| - | |||
| - | You need to populate your **/ | ||
| - | <file - resolv.conf> | ||
| - | # My own local DNS resolver (Unbound) | ||
| - | nameserver 127.0.0.1 | ||
| - | </ | ||
| - | |||
| - | Don't forget to autostart Unbound service: | ||
| - | <code bash> | ||
| - | rc-update add unbound default | ||
| - | / | ||
| - | </ | ||
| - | |||
| - | __NOTE:__ as far as i managed to understand, DoT is always enabled on the upstream connection only. You do not need DoT within your home network. | ||
| - | |||
| - | ==== Local zone ==== | ||
| - | |||
| - | The **local.conf** will contain your own home local addresses: | ||
| - | <file - local.conf> | ||
| - | server: | ||
| - | # Add a local resolve for the home server | ||
| - | local-zone: " | ||
| - | local-data: " | ||
| - | </ | ||
| - | |||
| - | ==== DNSSEC ==== | ||
| - | |||
| - | Enabling DNSSEC is a good idea, and it's pretty simple. This will ensure that all your DNS queries will be checked against signed results, to prevent spoofing attempts. | ||
| - | |||
| - | First of all you need to ensure your trust anchors is generated once: | ||
| - | <code bash> | ||
| - | mkdir / | ||
| - | chown unbound: | ||
| - | unbound-anchor -a / | ||
| - | </ | ||
| - | |||
| - | the root anchors file needs to be writable by Unbound and inside the chroot where unbound runs. | ||
| - | |||
| - | The above unbound config file will take care of enabling DNSSEC directly. | ||
| - | |||
| - | To test it: | ||
| - | <code bash> | ||
| - | delv www.kde.org | ||
| - | </ | ||
| - | |||
| - | should return a "fully validated" | ||
| - | |||
| - | Enabling DNSSEC can be tricky, while simple: make sure the trust-anchor.txt file can be written by the unbound user... And in case you are stuck, raise verbosity to 2. | ||
| - | |||
| - | |||
| - | ==== DNS over HTTPS ==== | ||
| - | |||
| - | The above configuration already enable DoH (DNS over HTTPS) in Unbound. I set it up on port 4443 because port 443 is already taken by the NGINX reverse proxy, of course, so you will need to create a reverse proxy from NGINX to Unbound covering the endpoint **/ | ||
| - | |||
| - | Drop the following configuration file into your NGINX home server configuration (see [[selfhost: | ||
| - | <file - dns.conf> | ||
| - | location /dns-query { | ||
| - | if ( $request_method !~ ^(GET|POST|HEAD)$ ) { | ||
| - | return 501; | ||
| - | } | ||
| - | proxy_set_header Host $http_host; | ||
| - | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| - | proxy_redirect off; | ||
| - | proxy_buffering off; | ||
| - | grpc_pass grpc:// | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | Note that the classic __proxy_pass__ cannot be used because it does not support HTTP2 upstream, which is mandatory for Unbound, so you need to use // | ||
| - | |||
| - | Restart your NGINX, and your DoH should be operative. | ||
| - | |||
| - | Please keep in mind that DoH **only works with domain names** due to how certificates work, IP addresses **won' | ||
| - | |||
| - | Just to be clear: this DNS over HTTPS is a huge mess and a great headache. In fact, it's more a shitty way to prevent people to run DNS-based ad-blockers than anything. DoT already provided everything needed, but DoH is actually in the hands of the "big players" | ||
| - | |||