Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

nextdns.io

Post reply on HN
Print view View original

71–80 of 151 posts

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#71

Post by jamesog »

I've been using nextdns since I saw it posted on Twitter a few weeks ago. It's been great.

I used to run something like PiHole on my home network but ultimately dnsmasq is not a good DNS server so I ditched it. I've been running CoreDNS for a while, forwarding to Google DNS and Cloudflare DNS (both using DNS over TLS) for a while and that worked fine. I'd augmented CoreDNS to serve a hosts file as a blocklist, similar to PiHole.

Nextdns has replaced Google and Cloudflare as forwarders in CoreDNS and it's working really well. I've been liking the proper network-level ad-blocking and being able to use the analytics to figure out what was blocked when something doesn't work.

The nextdns guys are also really responsive and helpful. One of them spent a couple of hours on live-chat with me debugging an analytics issue.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#72

Post by jen729w »

nextdns wrote: post #48
AtHeartEngineer wrote: post #3

Earlier quoted context omitted.

Good on ya. How is this all being paid for? How are you making money? Is there a subscription fee?

It's free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

I love this model. Get people in for free, let them discover how fabulous it is, then by the time they need a pro-grade thing they're happy to throw money at you.

See also: Netlify.

Best of luck! Looks great.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#73

Post by xyz-x »

yegle wrote: post #45
paxys wrote: post #42

Earlier quoted context omitted.

Even if the setup is easy, production-grade hosting is not.

Not saying my setup has lower reliability than the hosted service (did nextdns.io promise any SLA?). For the added privacy, the potential lower reliability is a risk that I'm willing to take. Even with this setup there are ways to increase reliability with-in the budget/skill set of a normal engineer, e.g. run two RasPi with keepalived and run VRRP on your routers. As a last resort, I can disable the "Private DNS" se…

keepalived is never the answer; if you can run it, your services are by definition crash-only share-nothing or inconsistent by design, or else you wouldn't let keepalived choose when to move the "primary flag" to the other service (as there'd be no way of sending the last ACKed data from the previous primary). Since this is the case, you could just load balance across the services and have them both active.

From a networking perspective, getting VRRP working on anything but physical equipment (e.g. in the cloud) is a fool's errand; it's L7/API-based and not on the ethernet level. Similarly with keepalived, which will get isolated from the monitored instances (thereby failing to the other, also "down" instance) — except it might have access to the API gateway of the cloud provider thereby disassociating the V-IP from both your instances; so you'll end up with more downtime with keepalived than you gain by it.

Since DNS is by default inconsistent, but eventually consistent and thereby possible to load-balance, you could run one instance of this stack on your static home IP and another instance on GCP/DO/AWS and configure multiple DNS servers in your DHCP options and on your phone, to get higher availability.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#74

Post by jamesog »

underwater wrote: post #30
nextdns wrote: post #19

Earlier quoted context omitted.

Motivations: like most tech startups, scratching your own itch :) Funding: Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

I wouldn't know if 500k is a little or a lot.

According to my nextdns analytics from the last few weeks my house has peaked at around 28,000 queries a day, 331k so far this month.

Nextdns is blocking somewhere in the region of 400-600 queries each day, mostly things like Google Analytics, Apple iAd.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#75

Post by _b8r0 »

yegle wrote: post #23

I don't understand why any privacy conscious person would choose a hosted service instead of self-hosting your own solution. Implementing the whole thing (modulo the anycast IP, which is the only thing I did not use) is easy. I have a docker-compose file which does the whole stack: 1. Unbound DNS which provides DNS-over-TLS service at port 853. It forward request to my local pihole's 53 port. 2. Pihole forward reques…

I'm amazed that on a site called "Hacker News" people are giving you hassle for building your own self-hosted solution rather than handing control of your DNS over to random people, possibly for money down the line.

Well done.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#76

Post by _b8r0 »

jamesog wrote: post #71

I've been using nextdns since I saw it posted on Twitter a few weeks ago. It's been great. I used to run something like PiHole on my home network but ultimately dnsmasq is not a good DNS server so I ditched it. I've been running CoreDNS for a while, forwarding to Google DNS and Cloudflare DNS (both using DNS over TLS) for a while and that worked fine. I'd augmented CoreDNS to serve a hosts file as a blocklist, simila…

What's wrong with DNSmasq?

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#79

Post by jamesog »

_b8r0 wrote: post #76
jamesog wrote: post #71

I've been using nextdns since I saw it posted on Twitter a few weeks ago. It's been great. I used to run something like PiHole on my home network but ultimately dnsmasq is not a good DNS server so I ditched it. I've been running CoreDNS for a while, forwarding to Google DNS and Cloudflare DNS (both using DNS over TLS) for a while and that worked fine. I'd augmented CoreDNS to serve a hosts file as a blocklist, simila…

What's wrong with DNSmasq?

It's not great as a DNS server. It has some really odd behaviour. One of the things which used to annoy me a lot when using it as a recursor is things like `dig +trace` would just stop at dnsmasq, so you'd have to bypass it by doing something like `dig +trace @8.8.8.8`.

Every DNS expert I know says to avoid dnsmasq.

It works fine as a DHCP server, though.

Re: Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

#80

Post by microtonal »

nextdns wrote: post #44
ignoramous wrote: post #12

Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations. A few suggestions: - Auto-detect OS and suggest specific setup instructions right on the landing page? - The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that? - simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard…

Thanks! > Auto-detect OS and suggest specific setup instructions right on the landing page? It should already pre-select your OS tab on my.nextdns.io on the Setup page? If that's not the case, then it's probably a bug. > The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that? Weird, we will have a look. > simplednscrypt has been handy for me to DoT/DoH/DNSCrypt…

The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that?

Weird, we will have a look.

For those that block JavaScript by default, it would also be nice to get something more than You need to enable JavaScript to run this app. on the main page. At least a short blurb what this is.

(Since the most recent batch of CPU vulnerabilities, I have decided to use uMatrix to block anything but CSS by default.)

Post reply on HN