this post was submitted on 05 Sep 2023
15 points (89.5% liked)

Selfhosted

40356 readers
361 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
ruud
Loki
CannaVet
devve
HybridSarcasm
[email protected]
15
DoH in unbound (self.selfhosted)
submitted 1 year ago by badgrandpa to c/selfhosted
7 comments fedilink hide all child comments
 

Hi guys

Anyone knows how to configure Unbound as doh server? At the moment I using recursive default option.

Will DoH give me more privacy?

Thx

all 8 comments
sorted by: hot top controversial new old
[–] vegetaaaaaaa 2 points 1 year ago

I'm interested in the same thing (both query upstream DNS over HTTPS servers, and answer to DoH queries), but using dnsmasq. I haven't had much time to look into this yet, but will definitely try to implement it later, so any recommendations would be appreciated. So far my research notes on this topic only contain:

https://wiki.archlinux.org/index.php/Dnscrypt-proxy
https://packages.debian.org/sid/main/nss-tlsd
https://packages.debian.org/sid/main/tlslookup
https://blitiri.com.ar/git/r/dnss/b/master/t/f=README.md.html
[–] [email protected] 2 points 1 year ago* (last edited 1 year ago) (1 children)

Do you want Unbound to query upstream DNS over HTTPS servers or do you want unbound to answer to DoH queries?

For the former, unbound cannot query upstream DoH servers, only DoT and DNS at the moment. An issue is still open for setting DoH as upstream. A solution is to use cloudflared or dnsproxy to proxy DNS queries to DoH upstream servers.

As for the latter, unbound can be set to answer to DoH queries.

[–] badgrandpa 1 points 1 year ago

Ok so how can is set up unbound with DoT?

[–] [email protected] 1 points 1 year ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
Git Popular version control system, primarily for code
HTTP Hypertext Transfer Protocol, the Web
HTTPS HTTP over SSL
PiHole Network-wide ad-blocker (DNS sinkhole)
SSL Secure Sockets Layer, for transparent encryption

[Thread #111 for this sub, first seen 6th Sep 2023, 05:45] [FAQ] [Full list] [Contact] [Source code]

[–] foggenbooty 1 points 1 year ago* (last edited 1 year ago) (2 children)

Are you using the Unbound built into OPNsense, or something else? I ask because it's easy to configure Unbound in OPNsense for DoT. If your ISP isn't blocking DoT it will be just as secure.

And yes, it will be much more private. Right now if you're using neither DoT or DoH your ISP will be able to see all your DNS requests in the clear. With either of the above it will be encrypted and they will not be able to read them.

[–] badgrandpa 1 points 1 year ago

I installed it on mini pc along with AdGuard home

[–] badgrandpa 1 points 1 year ago

I’ve seen it on pfsense it’s easy yes