Dns over tls support

[daggs]

Greetings,

I've stumbled onto this: https://blog.cloudflare.com/dns-over-tls-for-openwrt/ has anyone tried this and got it to work with latest openwrt? is it demanding?

thanks.

[jeff]

Might want to search the forum. Plenty of discussion and tutorials over the last year or two

[dos]

I used the methods in this post:
https://candrews.integralblue.com/2018/08/dns-over-tls-on-openwrt-18-06/
including the DNSSEC method linked to (after setting up the DNS over TLS).
Not overly demanding, but when I upgraded from 18.06.1 to 18.06.2 I needed to add a public server to the list and set noresolv to '0'

[vgaetera]

https://openwrt.org/docs/guide-user/services/dns/start#encryption

[jeff]

[Frood42]

not sure which posting I should hijack, but I see well known names above so I try to post my question here. Apologies upfront.
Looking at the options I have https://openwrt.org/docs/guide-user/services/dns/start it feels like " DNS over TLS via Unbound" looks the best.
But which one is the most recommended - most stable option for the future?
I don't really care about performance and speed, Internet is fast enough. Security and stability is more important.
In the TLS via unbound wiki I see that google dns is used. This is like using TOR and making sure that the exit nodes are operated by some of the agencies... (if possible)
Is it possible to use another one like opendns instead? Shouldn't the wiki be changed and google be removed?

BR, Frood

[tectonic]

@Frood42

Is it possible to use another one like opendns instead?

Yes, it is. I use Unbound (and Stubby, for that matter) with alternative DoT and DoH resolvers. Personally, I like CleanBrowsing's resolvers.

You can find a pretty comprehensive list of resolvers that you might like to use on the DNS Privacy Project's homepage: test servers and public resolvers

[Frood42]

First of all, I don't understand why this option (Unbound & Stubby) isn't explained in the Wiki:

Second, I do also not understand why do you need Stubby?

Why is it not possible to simply use another resolver and replace the 8888 as described in "DNS over TLS via Unbound"?

But I do understand that I should not replace / turn off dnsmasq if I already need it for other internal name resolution stuff...

[tectonic]

I think it depends on your use case. For me, personally: I have multiple dnsmasq instances and forward to either Stubby or Unbound for reasons to which I allude here.

If you search this forum and the web, there are a number of tutorials / guides which you may find more useful than the Wiki. I cobbled-together a solution that works for my use-case based on a number of these.

I'd recommend trying one of them out: learn by doing and making mistakes; then, if you get stuck on a particular problem, start a new thread here and there are plenty of folk who are happy to try and help you out.

[jeff]

@Frood42

I don't understand why this option (Unbound & Stubby) isn't explained in the Wiki:

Because

• All of this is relatively new and changing quickly
• The wiki is basically volunteer effort
• There are literally dozens of threads here on various way to implement “secure” / “hidden” DNS
• The wiki is, at least in my opinion, such a pain to edit in any non-trivial way that it drives away would-be contributors

[Frood42]

@jeff

The wiki is, at least in my opinion, such a pain to edit in any non-trivial way that it drives away would-be contributors

Yes. It is not just a pain, it is like Spanish or Chinese. Simply requires a two - three year study to try to get along with it.

[tmomas]

@Frood42

Yes. It is not just a pain, it is like Spanish or Chinese. Simply requires a two - three year study to try to get along with it.

Do you know https://openwrt.org/wiki/syntax? You only need a fraction of this for every day use.
If you need 3 years to understand this, you should really not mess with anything technical at all.

But this is a separate discussion which does not belong in this topic.

[Frood42]

Is it me Frood, Junior Member to tell tmomas "the Leader" to take a look here
https://forum.openwrt.org/guidelines
?
No, I don't think I want to do that. Instead, I will take a deeper look at the forum postings about this topic and I might raise a new posting as mentioned by tectonic.

Thanks.

[jeff]

@tmomas

[The usability of the wiki] is a separate discussion

Perhaps that discussion should be reopened, as there seems to be many contributions on this topic alone that chose to post here, with a modern topic editor and a readable layout, as opposed to the 1990s wiki and style sheet still in place. It's not just one poster either

( From The DNS Privacy Project ) DNS-OVER-TLS on OpenWrt/LEDE FEATURING UNBOUND GETDNS and STUBBY

READ ENTIRE GUIDE BEFORE YOU BEGIN This Tutorial / Guide Was Updated on Jan 19 2020 in order to keep you in step with changes needed for OpenWrt 19.07.0 For those who want to obtain full new updated upstream DOT Server List and Keys August 21 2020 see here below : https://forums.torguard.net/index.php?/topic/1861-openwrt-new-and-improved-getdns-stubby-and-unbound-aka-dns-privacy/ NOW ! is the time for all of US ( A ) to GET UP & GET INVLOVED and act with SOUL POWER ! - lyrics : https://g…

UPDATED GUIDE FOR Getdns 1.4.2-2 stubby 0.2.3-3 and unbound 1.8.1-2

READ ENTIRE GUIDE BEFORE YOU BEGIN Tutorial / Guide Was Updated on Jan 15 2020 in order to keep you in step with changes on packages needed for OpenWrt 19.07.0 For those who want to obtain full new updated upstream DOT Server List and Keys August 21 2020 see here below : https://forums.torguard.net/index.php?/topic/1861-openwrt-new-and-improved-getdns-stubby-and-unbound-aka-dns-privacy/ I was asked by a still skeptical devotee of DOH " What makes this way better than just running the DNS-o…

Stubby dns over tls using dnsmasq-full for dnssec & caching

This Tutorial / Guide Was Updated on Jan 19 2020 in order to keep you in step with changes on packages needed for OpenWrt 19.07.0 For those who want to obtain full new updated upstream DOT Server List and Keys August 21 2020 see here below : https://forums.torguard.net/index.php?/topic/1861-openwrt-new-and-improved-getdns-stubby-and-unbound-aka-dns-privacy/ See here for GETDNS AND STUBBY on OPENWRT / LEDE: https://github.com/openwrt/packages/blob/master/net/stubby/files/README.md " The Int…

Utmost Security For Those Who Deploy Stubby GETDNS

How Maintain Online Optimal Security - DNS OVER TLS Servers' SPKI pin(s) Maintenance and UpKeep - See VERY IMPORTANT UPDATE: at end of this post for best DNS Privacy Test Servers configuration for STUBBY. ForeThought: If you have figured out how to keep your DNS OVER TLS servers' SPKI pin(s) up to date and secure then skip to the last section where there is an excellent website : https://www.immuniweb.com/ssl/?id=Su8SeUQ4 for running an in depth SSL Security Test for all the servers you chose …

[Tutorial] DNS-over-TLS with dnsmasq and stubby (no need for unbound)

All the guides I see for using DNS-over-TLS on OpenWRT require unbound, what I found out is that in fact you only need stubby, which does the DNS-over-TLS and acts as a proxy for DN resolution. Stubby is simple to configure and dnsmasq can point to this proxy instead and continue to do all the things it needs to do such as domain name caching. Because I have this setup running in a old router (4/32) without much space on the overlay to install stubby and its dependencies I have it setup so it …

[Tutorial] [No CLI] Configuring DNS over TLS with LuCI using Stubby and Dnsmasq

I recently decided to implement DNS over TLS and found that many tutorials were not oriented to those who are less tech savvy. This is a simple approach which allows you to do all configuration in LuCI without any CLI commands. I have to give credit to https://candrews.integralblue.com/2018/08/dns-over-tls-on-openwrt-18-06/, as that is where I got my setup instructions from, and just figured out how to do them in LuCI Notes: This setup expects you to use Cloudflare's DNS resolvers. If you wan…

[tmomas]

Last posting from my side to this off-topic discussion.

@jeff

[The usability of the wiki] is a separate discussion

Your additions do not meet my intention.

@tmomas

If you need 3 years to understand this [the wiki syntax], you should really not mess with anything technical at all.

But this is a separate discussion which does not belong in this topic.

---

@jeff

the 1990s wiki and style sheet still in place.

That is yet a different discussion.

Feel free to open new topics in the Talk about Documentation section of the forum.