Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technitium DNS Server: Self host a DNS server for privacy and security

technitium.com

Post reply on HN
Print view View original

81–87 of 87 posts

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#81

Post by ProllyInfamous »

accrual wrote: post #80
ProllyInfamous wrote: post #68

Earlier quoted context omitted.

For a sole user, yours is definitely a great way to economically utilize a single PiHole at home. A suggestion for tho$e with multiple users: set up multiple PiHoles on your same network, then have "blocking levels" which each user can set up, e.g: 192.168.0.2 x.x.x.3 x.x.x.4 x.x.x.5 x.x.x.n My DHCP auto-issues the "lowest level of blocking" PiHole to any client not specifying their own DNS (only 7 rules, mostly bloc…

That's a slick solution, thanks for sharing! Pihole resource needs are pretty low so I could see easily running several in parallel on a Docker host.

That'd probably be much less expensive than the four RaspberryPi3b+ fleet I assembled for an otherwise virtualizable solution.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#82

Post by magicalhippo »

mianos wrote: post #76
magicalhippo wrote: post #46

Earlier quoted context omitted.

So how low can you go? I'm running PiHole on some small SMBs with 1GB RAM.

Trying to post a listing but cloudflare seems to block me from saying anything but one line. VSZ RSS 275156560 151048 using lxc info Memory 276.90MiB Swap 16.00KiB wow, that is a PITA, just trying to be helpful. Anyway, seems a lot of virtual but next to no real memory. edit: as I said, aside from the scary VM size, very small. I only have 60 local hosts though. edit: ps, the dhcp/dns integration first class. I have…

Thanks. Time to dig in the drawers and see if I can't find another SBC to spin it up on.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#83

Post by egberts1 »

greenshackle2 wrote: post #73
egberts1 wrote: post #64

Earlier quoted context omitted.

Thats why you block 53/udp and 53/tcp ports in your home gateway IP forwarder. Insidious things, tsk tsk.

DNS over HTTPS is using port 443 because it's... HTTPS. Are you blocking that too?

That's why you run a transparent HTTPS proxy gateway with iCAP DNS filters

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#85

Post by cookiengineer »

neuromanser wrote: post #59
poisonborz wrote: post #12

Earlier quoted context omitted.

Where the DNS server lives is a detail. What is a "root DNS"?

A Root domain, or a name server authoritative for such. I don't think OP meant either.

Technitium advertises itself with being able to serve as a root DNS, in both its documentation and on their blog [1]. So I think my argument is still valid, as it's way too over engineered to be a simple, self-hosted, home lab solution for the problem at hand.

[1] https://blog.technitium.com/2021/07/running-root-server-loca...

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#86

Post by LinuxBender »

greenshackle2 wrote: post #73
egberts1 wrote: post #64

Earlier quoted context omitted.

Thats why you block 53/udp and 53/tcp ports in your home gateway IP forwarder. Insidious things, tsk tsk.

DNS over HTTPS is using port 443 because it's... HTTPS. Are you blocking that too?

Have you found any open resolvers that are using a shared CDN IP? I've been on the lookout for those ever since the first discussion of DoH appeared on HN. I have yet to find one but I would really like to know details if you have found one. Thus far I have been able to block DoH by NXDOMAIN'ing "use-application-dns.net" and blackhole routing about 80 IP addresses.

Re: Technitium DNS Server: Self host a DNS server for privacy and security

#87

Post by vin047 »

greenshackle2 wrote: post #73
egberts1 wrote: post #64

Earlier quoted context omitted.

Thats why you block 53/udp and 53/tcp ports in your home gateway IP forwarder. Insidious things, tsk tsk.

DNS over HTTPS is using port 443 because it's... HTTPS. Are you blocking that too?

You can block HTTPS to known DoH providers. You can set up an alias in a firewall to load the list from https://public-dns.info/nameservers-all.txt. Its a bit of a cat-and-mouse game as it relies on that list being updated frequently and reliably, but its the best you're gonna get for blocking DoH.

Also make sure to block outgoing TCP and UDP 853 – this blocks DoT and DoQ too.

Post reply on HN