Encrypted DNS: Difference between revisions
m improve formatting |
|||
| (One intermediate revision by one other user not shown) | |||
| Line 3: | Line 3: | ||
'''Encrypted DNS''' protocols aim to address this hole by encrypting queries and responses in transit between DNS resolvers and clients; the most widely deployed ones are [[wikipedia:DNS over HTTPS|DNS over HTTPS]] (DoH), [[wikipedia:DNS over TLS|DNS over TLS]] (DoT), and [https://dnscrypt.info/ DNSCrypt]. | '''Encrypted DNS''' protocols aim to address this hole by encrypting queries and responses in transit between DNS resolvers and clients; the most widely deployed ones are [[wikipedia:DNS over HTTPS|DNS over HTTPS]] (DoH), [[wikipedia:DNS over TLS|DNS over TLS]] (DoT), and [https://dnscrypt.info/ DNSCrypt]. | ||
NixOS has modules for multiple encrypted DNS proxies, including [https://github.com/DNSCrypt/dnscrypt-proxy dnscrypt-proxy 2], [https://github.com/AdguardTeam/dnsproxy dnsproxy] and [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby Stubby]. <code>services.dnscrypt- | NixOS has modules for multiple encrypted DNS proxies, including [https://github.com/DNSCrypt/dnscrypt-proxy dnscrypt-proxy 2], [https://github.com/AdguardTeam/dnsproxy dnsproxy] and [https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby Stubby]. <code>services.dnscrypt-proxy</code> is generally recommended, as it has the widest protocol and feature support, and is written in a memory-safe language. For DNS over TLS (DoT) support, <code>services.dnsproxy</code> can be used. Detailed comparison of DNS proxies can be found on [https://wiki.archlinux.org/title/Domain_name_resolution#DNS_servers ArchLinux Wiki]. | ||
== Setting nameservers == | == Setting nameservers == | ||
| Line 73: | Line 73: | ||
}; | }; | ||
systemd.services.dnscrypt- | systemd.services.dnscrypt-proxy.serviceConfig.StateDirectory = StateDirectory; | ||
} | } | ||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 81: | Line 81: | ||
=== Blocklist === | === Blocklist === | ||
Fetch a blocklist file (e.g. oisd) as a flake input: | Fetch a blocklist file (e.g. oisd) as a flake input: | ||
{{file|flake.nix|nix|3= | |||
{ | { | ||
inputs = { | inputs = { | ||
| Line 100: | Line 99: | ||
}; | }; | ||
} | } | ||
}} | |||
<syntaxhighlight lang="nixos"> | |||
{ config, lib, pkgs, inputs, ... }: | { config, lib, pkgs, inputs, ... }: | ||
let | let | ||
| Line 111: | Line 111: | ||
in | in | ||
{ | { | ||
services.dnscrypt- | services.dnscrypt-proxy.settings.blocked_names.blocked_names_file = blocklist_txt; | ||
} | } | ||
| Line 121: | Line 121: | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
{ | { | ||
services.dnscrypt- | services.dnscrypt-proxy = { | ||
enable = true; | enable = true; | ||
settings = { | settings = { | ||
| Line 142: | Line 142: | ||
networking.nameservers = [ "::1" ]; | networking.nameservers = [ "::1" ]; | ||
services.dnscrypt- | services.dnscrypt-proxy = { | ||
enable = true; | enable = true; | ||
settings = { | settings = { | ||
| Line 228: | Line 228: | ||
To update digests get the TLS certificate that signs the responses and calculate the digest: | To update digests get the TLS certificate that signs the responses and calculate the digest: | ||
<syntaxhighlight lang=" | <syntaxhighlight lang="console"> | ||
echo | openssl s_client -connect '1.1.1.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 | $ echo | openssl s_client -connect '1.1.1.1:853' 2>/dev/null | openssl x509 -pubkey -noout | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64 | ||
</syntaxhighlight> | </syntaxhighlight> | ||
Or using <code>kdig</code> from <code>knot-dns</code> | Or using <code>kdig</code> from <code>knot-dns</code> | ||
<syntaxhighlight lang=" | <syntaxhighlight lang="console"> | ||
kdig -d @1.1.1.1 +tls-ca +tls-host=one.one.one.one example.com | $ kdig -d @1.1.1.1 +tls-ca +tls-host=one.one.one.one example.com | ||
</syntaxhighlight> | </syntaxhighlight> | ||
[[Category:Networking]] | [[Category:Networking]] | ||
[[Category:DNS]] | [[Category:DNS]] | ||