Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can run a DNS server (2025)

simonsafar.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: You can run a DNS server (2025)

#41

Post by jcgl »

locknitpicker wrote: post #19
9dev wrote: post #3

Earlier quoted context omitted.

Seconded. Don’t use certbot; it’s an awful piece of user-hostile software, starting from snap being the only supported installation channel. Everything it does wrong, acme.sh does right.

> starting from snap being the only supported installation channel. This sounds like you are complaining about Ubuntu, not the software you wish to install in Ubuntu.

Unfortunately, it's more than that: the Linux installation instructions on the certbot website[0] give options for pip or snap. Distro packages are not mentioned.

[0] https://certbot.eff.org/

Re: You can run a DNS server (2025)

#43

Post by jcgl »

tzury wrote: post #37

Just remember, if you run your own DNS, and you do so for a mission critical platform, the platform is exposed to a udp DDoS that will be hard to detect let alone prevent. Unless of course you will invest 5-6 figures worth of US dollars worth of equipment, which by then you can look back and ask yourself, was I better off with Google Cloud DNS, AWS Route 53 and the likes.

Not that I disagree with the fact that these risks exist, but how is that different than running any other service for a mission critical platform?

The main thing I can think of is DNS amplification attacks, but that's more your DNS server being used as part of a DDoS attack rather than being targeted for one. Also (afaik) resolvers are more common targets for DNS amplification than authoritative.

Re: You can run a DNS server (2025)

#44

Post by Xylakant »

ssl-3 wrote: post #36
Xylakant wrote: post #26

Earlier quoted context omitted.

That assumes a device that can enter a VPN. I’d like to run a DNS server for a group of kids playing Minecraft on a switch. Since they’re not in the same (W)LAN, I can’t do it on the local network level. And the switch doesn’t have a VPN client.

Perhaps it seems obvious to some, but it's not obvious to me so I need to ask: What's the advantage of a selectively-available DNS for kids playing Minecraft with Nintendo Switch instead of regular DNS [whether self-hosted or not]? All I can think of is that it adds obscurity, in that it makes the address of the Minecraft server more difficult to discover or guess (and thus keeps everything a bit more private/griefin…

Ok, why would I want to do that? Because when Microsoft bought Minecraft they decided to split the ecosystem into the Java Edition (everyone playing on a computer) and Bedrock Edition (Consoles, Tablets, ...) and cross-play is not possible on the official realms. That leaves out the option to just pay and rent a realm for the group.

So we're hosting our own minecraft server and a suitable connector for cross-play - and it's easy to join on tablets, computers and so on because there's a button that allows you to enter an address. But on the switch, Microsoft in its wisdom decided that there'd be no "join random server" button. But there are some official realm servers, and they just happen to host a lobby and the client understands some interface commands sent by the server (1). Some folks in the community devised a great hack - you just host a lobby yourself that presents a list of servers of your choice. But to do that, you need to bend the DNS entries of a few select hostnames that host the "official" lobbies so that they now point to your lobby. Which means you need to run a resolver that is capable of resolving all hostnames, because you need to set it in the switchs networking settings as the primary DNS server.

Now, there are people that run resolvers in the community and that might be one option, but I'm honestly a bit picky about who gets to see what hostnames my kids switch wants to resolve.

Whitelisting networks is impossible - it's residential internet.

The reason I'd be interested in running this behind a VPN is that I don't want to run an open resolver and become part of an amplification attack. (And sadly, the Switch 1 does not have a sufficiently modern DNS stack so that I can just enable DNS cookies and be done with it. The Switch 2 supports it).

Sorry if this sounds complicated. It's just hacks on hacks on hacks. But it works.

(1) judging from the looks and feel, this is actually implemented as a minecraft game interface and the client just treats that as a game server. It even reports the number of players hanging out in the lobby.

Re: You can run a DNS server (2025)

#45

Post by jcgl »

deepsun wrote: post #5

How to make it DNSSEC?

Knot (as suggested by others) is good. As are BIND and PowerDNS. These are the big authoritative resolvers I think of at least, and all of them allow for basically hands-free DNSSEC; just flip a switch and you'll have it. I've run DNSSEC with all three and have no complaints.

And when using such turn-key DNSSEC support, I think there's very little risk to enabling it. While other commenters pointing out its marginal utility are correct, turn-key DNSSEC support that Just Works™ de-risks it enough for me that the relatively marginal utility just isn't a concern.

Plus, once you've got DNSSEC enabled, you can at the very least start to enjoy stuff like SSHFP records. DANE may not have any real-world traction, but who knows what the future may bring.

Re: You can run a DNS server (2025)

#46

Post by pgporada »

jcgl wrote: post #41
locknitpicker wrote: post #19

Earlier quoted context omitted.

> starting from snap being the only supported installation channel. This sounds like you are complaining about Ubuntu, not the software you wish to install in Ubuntu.

Unfortunately, it's more than that: the Linux installation instructions on the certbot website[0] give options for pip or snap. Distro packages are not mentioned. [0] https://certbot.eff.org/

Make a PR or an issue on the project.

Re: You can run a DNS server (2025)

#47

Post by Spivak »

adiabatichottub wrote: post #7
DaSHacka wrote: post #6

Earlier quoted context omitted.

Neat, I've used lego ( https://github.com/go-acme/lego ) but will certainly have to give uacme a look, love me a simple ACME client. acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.

Certbot has earned my ire on just about every occasion I've had to interact with it. It is a terrible program and I can't wait to finish replacing it everywhere. The new setup is using uAcme and nsupdate to do DNS-01 challenges. No more fiddling with any issues in the web server config for a particular virtual host, like some errant rewrite rule that prevents access to .well-known/.

I mean certbot handles the just issue me a cert via DNS-01 and I'll do the rest flow just fine. Massive overkill of a program for just that use-case but it's been humming along for me for years at this point. What's the selling point for uACME?

Re: You can run a DNS server (2025)

#48

Post by jcgl »

pgporada wrote: post #46
jcgl wrote: post #41

Earlier quoted context omitted.

Unfortunately, it's more than that: the Linux installation instructions on the certbot website[0] give options for pip or snap. Distro packages are not mentioned. [0] https://certbot.eff.org/

Make a PR or an issue on the project.

I feel no need to. I'm quite certain that the certbot folks are aware of the existence of distro packages and even know how to check https://pkgs.org/download/certbot for availability. One might guess that they only want to supply instructions for upstream-managed distribution channels rather than dealing with e.g. some ancient version being shipped on Debian.

Re: You can run a DNS server (2025)

#49

Post by ssl-3 »

Xylakant wrote: post #44
ssl-3 wrote: post #36

Earlier quoted context omitted.

Perhaps it seems obvious to some, but it's not obvious to me so I need to ask: What's the advantage of a selectively-available DNS for kids playing Minecraft with Nintendo Switch instead of regular DNS [whether self-hosted or not]? All I can think of is that it adds obscurity, in that it makes the address of the Minecraft server more difficult to discover or guess (and thus keeps everything a bit more private/griefin…

Ok, why would I want to do that? Because when Microsoft bought Minecraft they decided to split the ecosystem into the Java Edition (everyone playing on a computer) and Bedrock Edition (Consoles, Tablets, ...) and cross-play is not possible on the official realms. That leaves out the option to just pay and rent a realm for the group. So we're hosting our own minecraft server and a suitable connector for cross-play - a…

Thanks. I suspected that this is where things were heading. I don't see a problem with using hacks-on-hacks to get a thing done with closed systems; one does what one must.

On the DNS end, it seems the constraints are shaped like this:

  1.  Provides custom responses for arbitrary DNS requests, and resolves regular [global] DNS
  2.  Works with residential internet
  3.  Uses no open resolvers (because of amplification attacks)
  4.  Works with standalone [Internet-connected] Nintendo Switch devices
  5.  Avoids VPN (because #4 -- Switch doesn't grok VPN)
With that set of rules, I think the idea is constrained completely out of existence. One or more of them need to be relaxed in order for it to get off the ground.

The most obvious one to relax seems to to be #3, open resolvers. If an open resolver is allowed then the rest of the constraints fit just fine.

DNS amplification can be mitigated well-enough for limited-use things like this Minecraft server in various ways, like implementing per-address rate limiting and denying AXFR completely. These kinds of mitigations can be problematic with popular services, but a handful of Switch devices won't trip over them at all.

Or: VPN could be used. But that will require non-zero hardware for remote players (which can be cheap-ish, but not free), and that hardware will need power, and the software running on that hardware will need configured for each WLAN it is needed to work with. That path is something I wouldn't wish upon a network engineer, much less a kid with a portable game console. It's possible, but it's feels like a complete non-starter.

Post reply on HN