Systemd/resolved: Difference between revisions
→Configuration: Cleanup |
add link Encrypted DNS |
||
| (7 intermediate revisions by 4 users not shown) | |||
| Line 3: | Line 3: | ||
[https://www.freedesktop.org/software/systemd/man/systemd-resolved.html systemd-resolved] is a [[systemd]] service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage. | [https://www.freedesktop.org/software/systemd/man/systemd-resolved.html systemd-resolved] is a [[systemd]] service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage. | ||
== Configuration = | = Secure DNS and Captive Portal = | ||
Secure DNS will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points. | |||
In that case, use <code>networkctl status ${wlan interface}</code> to show the default DNS provided by the network, and temporarily change nameserver inside <code>/etc/resolv.conf</code> from <code>127.0.0.53</code> to the provided one. | |||
Alternatively, if you have Chromium installed, you can use the <code>programs.captive-browser.enable</code> Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings". | |||
= Configuration Example: Enforce secure DNS = | |||
See also [[Encrypted DNS]]. | |||
The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption. | The following configuration configures resolved daemon to use the public DNS resolver provided by [https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/ Cloudflare]. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption. | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
networking.nameservers = [ | |||
"1.1.1.1" | |||
"1.0.0.1" | |||
]; | |||
services.resolved = { | services.resolved = { | ||
enable = true; | enable = true; | ||
| Line 21: | Line 37: | ||
[[Category:systemd]] | [[Category:systemd]] | ||
[[Category:Networking]] | [[Category:Networking]] | ||
[[Category:DNS]] | |||
Latest revision as of 21:35, 21 September 2025
systemd-resolved is a systemd service that provides network name resolution to local applications via a D-Bus interface, the resolve NSS service (nss-resolve(8)), and a local DNS stub listener on 127.0.0.53. See systemd-resolved(8) for the usage.
Secure DNS and Captive Portal
Secure DNS will break most captive portals like those of public or hotel wifi access points, resulting in inability to gain internet access through such access points.
In that case, use networkctl status ${wlan interface} to show the default DNS provided by the network, and temporarily change nameserver inside /etc/resolv.conf from 127.0.0.53 to the provided one.
Alternatively, if you have Chromium installed, you can use the programs.captive-browser.enable Chromium wrapper, which is "Dedicated Chrome instance to log into captive portals without messing with DNS settings".
Configuration Example: Enforce secure DNS
See also Encrypted DNS.
The following configuration configures resolved daemon to use the public DNS resolver provided by Cloudflare. DNSSEC and DNS-over-TLS is enabled for authenticity and encryption.
networking.nameservers = [
"1.1.1.1"
"1.0.0.1"
];
services.resolved = {
enable = true;
dnssec = "true";
domains = [ "~." ];
fallbackDns = [
"1.1.1.1"
"1.0.0.1"
];
dnsovertls = "true";
};