Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

dohproxy.com

Post reply on HN
Print view View original

31–40 of 47 posts

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#31

Post by close04 »

mike-cardwell wrote: post #26
lolc wrote: post #25

Earlier quoted context omitted.

I agree that there is little gain in hiding DNS traffic from your ISP. And like you I'm wondering what the benefit of spreading around one's DNS profile should be. I think it's better to just pick the DNS provider one distrusts the least. But once you use DoH using a private DNS proxy does in fact provide (some) protection because it detaches one's client address from the requests. Breaking this requires timing corre…

Why set up a private DNS proxy when you can (arguable more easily) set up a private VPN, which protects all of your traffic instead? A quick "apt install unbound" on the VPN server will give you a private recursive DNS resolver which supports DNSSEC, and you'll be communicating with that over the VPN, so DoH gives you nothing...

You're just choosing another ISP to give your data to. In the end the VPN server will be somewhere connected to an ISP. I'm doing just that but I'm fully aware that I have to have at least some measure of trust in my own ISP, as opposed to Google, Cloudflare, or any other such entity.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#32

Post by mercora »

madisfun wrote: post #28

Round-robin and privacy do not dwell well together. Like mike-cardwell pointed out in another comment, it just distributes the same information to more parties. As there has to be at least party which will know the request, some information will be leaked. But what can be prevented, is giving "unrelated" requests in the hands of the same resolver. Few of the request per se are interesting, the combinations of them al…

this is more or less what happens if you have an recursive resolver. in most cases your queries will be seen by the same network that will see your traffic afterwards anyways. only the TLD nameservers will somewhat occasionally depending on the TTL know which network you are about to enter and they are arguably more trustworthy. I think about this way: i already trust whichever infrastructure provider my endpoint uses and the choice of nameservers is an extension to that.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#33

Post by mike-cardwell »

close04 wrote: post #31
mike-cardwell wrote: post #26

Earlier quoted context omitted.

Why set up a private DNS proxy when you can (arguable more easily) set up a private VPN, which protects all of your traffic instead? A quick "apt install unbound" on the VPN server will give you a private recursive DNS resolver which supports DNSSEC, and you'll be communicating with that over the VPN, so DoH gives you nothing...

You're just choosing another ISP to give your data to. In the end the VPN server will be somewhere connected to an ISP. I'm doing just that but I'm fully aware that I have to have at least some measure of trust in my own ISP, as opposed to Google, Cloudflare, or any other such entity.

If you set up your own private VPN and send all traffic over it, then you're choosing another ISP to give your data to yes.

If you set up a DoH proxy, and don't route the rest of your traffic through an encrypted tunnel to the same point, then you're choosing two ISPs to give your data to, instead of just the one.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#34

Post by mike-cardwell »

t0astbread wrote: post #30
mike-cardwell wrote: post #26

Earlier quoted context omitted.

Why set up a private DNS proxy when you can (arguable more easily) set up a private VPN, which protects all of your traffic instead? A quick "apt install unbound" on the VPN server will give you a private recursive DNS resolver which supports DNSSEC, and you'll be communicating with that over the VPN, so DoH gives you nothing...

When you set up a private VPN to tunnel your traffic through, doesn't your VPN server just become your client? Or am I missing something here?

It does yes. And I think you must be missing something yes.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#35

Post by tialaramex »

t0astbread wrote: post #29
andyjohnson0 wrote: post #27

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how it breaks centralised web filtering, and has concerned-sounding quotes from child protection organisations. Probably a predictable slant for a general readership publication to take, but it is concerning that use of DoH might be being framed solely as enabling…

Couldn't the UK just work together with popular DoH providers to implement filtering in a clean way?

Mozilla's TRR agreements require that the end user willingly consented to any shenanigans done to their DNS results from your server.

So you can make a kiddy filter DNS provider that won't let you resolve pornhub, but your users need to have gone "Yeah, kiddy filter, that's what I want" not get opted into it by a government policy.

If you don't want a TRR agreement then sure, but now you'll need to teach users to go in and manually configure your servers. I have a feeling that "Here are the mandatory government instructions for ensuring censorship citizen" is not an effective strategy.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#36

Post by andyjohnson0 »

t0astbread wrote: post #29
andyjohnson0 wrote: post #27

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how it breaks centralised web filtering, and has concerned-sounding quotes from child protection organisations. Probably a predictable slant for a general readership publication to take, but it is concerning that use of DoH might be being framed solely as enabling…

Couldn't the UK just work together with popular DoH providers to implement filtering in a clean way?

I'd be ok with that. The problem would be the emergence of unscrupulous DoH providers.

Presumably the fear is that having DoH built into the browser lowers the bar to entry for people who want to use it as part of engaging in criminality.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#37

Post by Vinnl »

andyjohnson0 wrote: post #27

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how it breaks centralised web filtering, and has concerned-sounding quotes from child protection organisations. Probably a predictable slant for a general readership publication to take, but it is concerning that use of DoH might be being framed solely as enabling…

> The trade body for British ISPs even nominated Mozilla as one of its “internet villains of the year” in July over the issue.

Wow. I mean, you can have an argument over de desirability of DoH, but referring to Mozilla as internet villains is really missing the forest for the trees.

Luckily:

> A month later, the body withdrew the nomination and cancelled the “award” entirely, saying it “clearly sent the wrong message”.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#38

Post by mike-cardwell »

andyjohnson0 wrote: post #27

Today's Guardian has a piece [1] on Firefox's DNS over HTTP and how Mozilla has no plans yet to make it the default in the UK. Most of the article is about how it breaks centralised web filtering, and has concerned-sounding quotes from child protection organisations. Probably a predictable slant for a general readership publication to take, but it is concerning that use of DoH might be being framed solely as enabling…

As someone who lives in the UK and who disabled DoH in Firefox several months ago, and more recently LAN-wide using Mozillas announced canary domain (use-application-dns.net) for privacy reasons, I'm going to have to keep an eye on this.

I'm happy to hear that they currently have no plans to launch DoH in the UK, but I worry that this is only a temporary situation.

Note: If you want to protect the less tech-savy Firefox users on your LAN from Mozillas DoH implementation, update your DNS server to NXDOMAIN use-application-dns.net. You can do this easily in Unbound with the following piece of config:

  local-zone: "use-application-dns.net" static

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#39

Post by dngray »

mike-cardwell wrote: post #26
lolc wrote: post #25

Earlier quoted context omitted.

I agree that there is little gain in hiding DNS traffic from your ISP. And like you I'm wondering what the benefit of spreading around one's DNS profile should be. I think it's better to just pick the DNS provider one distrusts the least. But once you use DoH using a private DNS proxy does in fact provide (some) protection because it detaches one's client address from the requests. Breaking this requires timing corre…

Why set up a private DNS proxy when you can (arguable more easily) set up a private VPN, which protects all of your traffic instead? A quick "apt install unbound" on the VPN server will give you a private recursive DNS resolver which supports DNSSEC, and you'll be communicating with that over the VPN, so DoH gives you nothing...

> I agree that there is little gain in hiding DNS traffic from your ISP. And like you I'm wondering what the benefit of spreading around one's DNS profile should be. I think it's better to just pick the DNS provider one distrusts the least.

This assumes you trust your ISP. I know mine does metadata retention, therefore I do not trust them with my privacy. I also know mine blocks things based on a government "block list" which was implemented all in the name of stopping "serious criminals" such as pedophiles and terrorists.

However, in practice it's used for much more than that, of which does not constitute any criminality (news websites such as torrentfreak.com, that's because of corruption. The Minister for Communications https://en.wikipedia.org/wiki/George_Brandis that oversaw the implementation of this system was also the Minister for Arts and had heavy ties to the movie industry. He had a lot of collusion with Village Roadshow and Sony (evident by the leaked Sony emails) on this matter.

In other parts of the world I have heard that certain ISPs collect that data for marketing purposes.

> When you set up a private VPN to tunnel your traffic through, doesn't your VPN server just become your client? Or am I missing something here?

This is why I pipe everything through a VPN, that I trust more to protect my privacy than my ISP.

My DNS requests then go through to the DNS server on my VPN's network (it's in private address space), that recurses to Cloudflare. As far as those DNS providers are concerned "someone from that provider did a lookup for something", assuming that it isn't already cached.

The reason I use a VPN provider and don't run a VPN on my own server is because that would just link back to a server that is controlled by me, this way my network traffic is mixed with unrelated customers. For times when I need strong anonymity of course I use Tor. (Just before anyone points that out).

I have found issues in the past, particularly with EDNS subnet information not being available when accessing archive.is https://news.ycombinator.com/item?id=19828317 so that's why I have mine setup like so:

https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

My network has dual-stack IPv6 so with this kind of routing https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...

I believe this is the 'correct' way to ensure privacy. Essentially my network works like this:

    VLAN2 -> direct to ISP via ppp0
    VLAN3 -> through VPN via tun0
Local unbound server forwards everything into dnscrypt that first tries my VPN's DNS server, then tries to use DNSCrypt over the VPN

Regardless of which VLAN I am on, my DNS traffic is always sent through my VPN, https://www.dnsleaktest.com/ is a great site for testing that.

I tend to use VLAN2 for things like financial, or stuff where I do not want to be anonymous or cases that require extremely low latency such as gaming. In either case DNS lookups still go through the VPN.

Re: A guide to set up your own round-robin DNS-over-HTTPS proxy for privacy

#40

Post by t0astbread »

andyjohnson0 wrote: post #36
t0astbread wrote: post #29

Earlier quoted context omitted.

Couldn't the UK just work together with popular DoH providers to implement filtering in a clean way?

I'd be ok with that. The problem would be the emergence of unscrupulous DoH providers. Presumably the fear is that having DoH built into the browser lowers the bar to entry for people who want to use it as part of engaging in criminality.

DoH compared to plain old DNS is about as much as a crime-enabler as HTTPS compared to HTTP (probably even less)
Post reply on HN