Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AdGuard DNS: A Privacy-Oriented DNS Server

adguard.com

Post reply on HN
Print view View original

81–90 of 111 posts

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#81

Post by dspillett »

vinay_ys wrote: post #67
intopieces wrote: post #11

Earlier quoted context omitted.

For $5/month you can roll your own OpenVPN server with Digital Ocean and it will. [0] Bonus: your cellular ISP can't see your traffic and you're automatically protected at coffee shops. Downside: Battery life takes a slight hit due to encryption. [0] https://www.digitalocean.com/community/tutorials/how-to-bloc...

For some reason apple blocks access to appleid via Digital Ocean. Have you experienced this?

If many hosts get abused (usually due to people setting up a quick VM for a task and forgetting to update it manually and not setting up automatic security patching) even a reputable hosting service becomes a script-kiddie farm.

Perhaps this has happened with DO and Apple have blocked its host address ranges from the API due to unwitting past involvement in hack/DDoS attempts?

This is common with public VPN services that people I know have used. I have the luxury of fixed addressing and decent bandwidth at home, so I run my VPN there and have thus far not noticed any such issues. This also means that services that are location sensitive work as if I'm at home (not some random other place the VPN endpoint appears at).

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#82

Post by eps »

LeonM wrote: post #61
m0zg wrote: post #60

Earlier quoted context omitted.

If your goal is to get rid of ads, why would you use _anything_ made by an ad company?

Because some don't mind the text-based ads, but do mind the 10mb+ animated flashing overlay ads with audio that make the internet unusable.

The principal concern is pervasive tracking, not ads.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#83

Post by Fnoord »

plg wrote: post #13

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.

> When my wife goes out onto another network

This is why I implemented WireGuard on top of it. All the traffic is encrypted through our home network (200/20 mbit) with DNS over TLS and adblocking due to Pi-Hole. LTE, open WLAN networks, all of these work. And roaming works very well with WireGuard. The downside is the 20 mbit upload.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#84

Post by [deleted] »

Fnoord wrote: post #83
plg wrote: post #13

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.

> When my wife goes out onto another network This is why I implemented WireGuard on top of it. All the traffic is encrypted through our home network (200/20 mbit) with DNS over TLS and adblocking due to Pi-Hole. LTE, open WLAN networks, all of these work. And roaming works very well with WireGuard. The downside is the 20 mbit upload.

[deleted]

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#85

Post by madspindel »

Fnoord wrote: post #83
plg wrote: post #13

I’ve been using Pi-Hole on my home network and it’s amazing. Routinely 18-20%% of DNS requests are blocked. When my wife goes out onto another network she says she is shocked at how ugly her web browsing becomes (ads on nytimes, huffpo, etc). I highly recommend it. Am using it with cloudfare’s encrypted DNS just as one more middle finger to my ISP.

> When my wife goes out onto another network This is why I implemented WireGuard on top of it. All the traffic is encrypted through our home network (200/20 mbit) with DNS over TLS and adblocking due to Pi-Hole. LTE, open WLAN networks, all of these work. And roaming works very well with WireGuard. The downside is the 20 mbit upload.

Any recommended tutorial for setting this up? I have a Raspberry Pi with Pi-hole and would be great to add Wireguard on top of that.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#86

Post by Fnoord »

madspindel wrote: post #85
Fnoord wrote: post #83

Earlier quoted context omitted.

> When my wife goes out onto another network This is why I implemented WireGuard on top of it. All the traffic is encrypted through our home network (200/20 mbit) with DNS over TLS and adblocking due to Pi-Hole. LTE, open WLAN networks, all of these work. And roaming works very well with WireGuard. The downside is the 20 mbit upload.

Any recommended tutorial for setting this up? I have a Raspberry Pi with Pi-hole and would be great to add Wireguard on top of that.

I use WireGuard on my router (ER-L) and Pi-Hole on the router as well, with a primary DNS on my Synology which uses Pi-Hole's Docker image [1]. Docker runs on Raspberry Pi, so I recommend you look into that route. Jessfraz wrote a howto on running WireGuard in Docker [2]

[1] https://github.com/pi-hole/docker-pi-hole

[2] https://blog.jessfraz.com/post/installing-and-using-wireguar...

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#87

Post by JdeBP »

Isomer wrote: post #75

There's lots of "privacy" improving DNS servers, but none of them mention trying to remove unintentional DNS queries. It turns out lots of things will resolve anything that looks vaguely like a hostname to see if, in fact, they are a hostname. eg, "untitled.pdf". These queries get passed to your ISP, and then on towards the root name servers. So if you run a large nameserver, you quickly find that most of your DNS qu…

The easiest solution to that, that has been known for many years, and the actual first step that one has been able to take for quite some time now, is running one's own root content DNS server on the LAN. DNS traffic for queries that use invalid top-level domains never escapes the LAN and never even reaches an ISP.

It's a fairly simple exercise in content DNS service. I actually set my machines up with a root content DNS server each.

* http://jdebp.eu./Softwares/nosh/guide/services/djbdns.html#D...

* http://cr.yp.to/dnsroot.html

Search paths are a subject in their own rights.

* http://jdebp.eu./FGA/web-fully-qualified-domain-name.html

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#88

Post by LogicX »

Isomer wrote: post #75

There's lots of "privacy" improving DNS servers, but none of them mention trying to remove unintentional DNS queries. It turns out lots of things will resolve anything that looks vaguely like a hostname to see if, in fact, they are a hostname. eg, "untitled.pdf". These queries get passed to your ISP, and then on towards the root name servers. So if you run a large nameserver, you quickly find that most of your DNS qu…

At DNSFilter we solve for this by loading the list of valid TLDs from official sources every few hours and immediately rejecting invalid TLD requests. Works great for those who have mis-configured their LAN DNS and are sending us all their companydomain.lan traffic.

Doesn't solve for cases where it's a valid TLD, but the domain doesn't have a valid DNS record. Guess it would depend if the TLD in question is publishing said dnssec record.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#89

Post by JdeBP »

greglindahl wrote: post #45
2bitencryption wrote: post #27

I never liked the idea of using DNS services for filtering web content. For one, it seems like the wrong tool for the job. Filtered content can simply switch to identifying content by IP address instead of DNS, correct? Or change DNS constantly. And for two, of course there are concerns with handing someone your DNS queries in return for filtering...

In practice, I’ve never seen filtered content change to ip addresses or rotating dns names. Do you know of an example?

This particular arms race happened in the world of WWW pornography back in the 1990s. I'll leave finding examples to you.

People have been blocking stuff for decades now, and we know what the responses to some of the initial moves will be, because the world has already gone through the dance.

Re: AdGuard DNS: A Privacy-Oriented DNS Server

#90

Post by LogicX »

drewg123 wrote: post #8
EpiphanyMachine wrote: post #7

update: They say they do not log anything, and pass no information upstream to the authoritative DNS server. ------ I didn't see anything in the announcement about logging or other privacy related questions. The FAQ also didn't list this information. The only thing they mention about privacy is how a dns request to them is protected, but not what they do with the data. Did I miss something? ------- Reading their priv…

I suspect this really screws with the DNS tricks used by many CDNs to route requests to near-by servers. So I would not be surprised if, when using this, YouTube, Netflix, etc, get much slower.

depends whether or not they're passing EDNS0 Client Subnet data to the authoritative DNS parties, and whether those parties are listening for it / trusting it.

We embed ECS data in our requests at DNSFilter to the authoritative upstreams, and we have a large global anycast network, so even if they're not accepting it, the answer is coming from a server 'nearby' the originating dns request, so CDN requests shouldn't be affected much.

Post reply on HN