Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can run a DNS server (2025)

simonsafar.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: You can run a DNS server (2025)

#51

Post by 0x00cl »

Xylakant wrote: post #44
ssl-3 wrote: post #36

Earlier quoted context omitted.

Perhaps it seems obvious to some, but it's not obvious to me so I need to ask: What's the advantage of a selectively-available DNS for kids playing Minecraft with Nintendo Switch instead of regular DNS [whether self-hosted or not]? All I can think of is that it adds obscurity, in that it makes the address of the Minecraft server more difficult to discover or guess (and thus keeps everything a bit more private/griefin…

Ok, why would I want to do that? Because when Microsoft bought Minecraft they decided to split the ecosystem into the Java Edition (everyone playing on a computer) and Bedrock Edition (Consoles, Tablets, ...) and cross-play is not possible on the official realms. That leaves out the option to just pay and rent a realm for the group. So we're hosting our own minecraft server and a suitable connector for cross-play - a…

You could run a DNS server and configure the server with a whitelist of allowed IPs on the network level, so connections are dropped before even reaching your DNS service.

For example, any red-hat based linux distro comes with Firewalld, you could set rules that by default will block all external connections and only allow your kids and their friends IP addresses to connect to your server (and only specifically on port 53). So your DNS server will only receive connections from the whitelisted IPs. Of course the only downside is that if their IP changes, you'll have to troubleshoot and whitelist the new IP, and there is the tiny possibility that they might be behind CGNAT where their IPv4 is shared with another random person, who is looking to exploit DNS servers.

But I'd say that is a pretty good solution, no one will know you are even running a DNS service except for the whitelisted IPs.

Re: You can run a DNS server (2025)

#52

Post by Xylakant »

ssl-3 wrote: post #49
Xylakant wrote: post #44

Earlier quoted context omitted.

Ok, why would I want to do that? Because when Microsoft bought Minecraft they decided to split the ecosystem into the Java Edition (everyone playing on a computer) and Bedrock Edition (Consoles, Tablets, ...) and cross-play is not possible on the official realms. That leaves out the option to just pay and rent a realm for the group. So we're hosting our own minecraft server and a suitable connector for cross-play - a…

Thanks. I suspected that this is where things were heading. I don't see a problem with using hacks-on-hacks to get a thing done with closed systems; one does what one must. On the DNS end, it seems the constraints are shaped like this: 1. Provides custom responses for arbitrary DNS requests, and resolves regular [global] DNS 2. Works with residential internet 3. Uses no open resolvers (because of amplification attack…

Yep, I agree. It's essentially impossible given the contraints. I'm mostly responding to a post that says "just run it on a VPN" with an example that just can't run on a VPN.

(3) would be easy to handle if DNS Cookies were sufficiently well supported because they solve reflection attacks and that's the most prominent. Rate limiting also helps.

At the moment I'm at selectively running the DNS server when the kids want to play because we're still at the supervised pre-planned play-session. And I hope that by the time they plan their own sessions, they've all moved on to a Switch 2.

Re: You can run a DNS server (2025)

#53

Post by Xylakant »

0x00cl wrote: post #51
Xylakant wrote: post #44

Earlier quoted context omitted.

Ok, why would I want to do that? Because when Microsoft bought Minecraft they decided to split the ecosystem into the Java Edition (everyone playing on a computer) and Bedrock Edition (Consoles, Tablets, ...) and cross-play is not possible on the official realms. That leaves out the option to just pay and rent a realm for the group. So we're hosting our own minecraft server and a suitable connector for cross-play - a…

You could run a DNS server and configure the server with a whitelist of allowed IPs on the network level, so connections are dropped before even reaching your DNS service. For example, any red-hat based linux distro comes with Firewalld, you could set rules that by default will block all external connections and only allow your kids and their friends IP addresses to connect to your server (and only specifically on po…

They're all playing from home, connected to their residential internet. I don't know their IP addresses.

Re: You can run a DNS server (2025)

#55

Post by rdevilla »

dwedge wrote: post #34
ozim wrote: post #18

Earlier quoted context omitted.

I think CNAME redirections being not supported is reasonable choice. Would make my life easier as well but it opens all kinds of bad possibilities that bad actors would definitely use.

Can you give me an example where this is a problem? If someone can create a CNAME they can create a TXT (ignoring the possibility of an API being restricted to just one). Without CNAME redirect I wouldn't be able to automatically renew wildcard ssl for client domains with dns that has no API. Even if they do have an API, doing it this way stops me from needing to deal with two different APIs

GP comment is just vague distilled model AI slop.

Re: You can run a DNS server (2025)

#56

Post by simoncion »

Xylakant wrote: post #53
0x00cl wrote: post #51

Earlier quoted context omitted.

You could run a DNS server and configure the server with a whitelist of allowed IPs on the network level, so connections are dropped before even reaching your DNS service. For example, any red-hat based linux distro comes with Firewalld, you could set rules that by default will block all external connections and only allow your kids and their friends IP addresses to connect to your server (and only specifically on po…

They're all playing from home, connected to their residential internet. I don't know their IP addresses.

Correct me if I misunderstand what you're trying to do:

What you want to do is -on each LAN that has a Switch that you want to play on your specific Minecraft server- report that the IP for the hostname of the Minecraft server the Switch would ordinarily connect to is the server that you're hosting?

If you're using OpenWRT, it looks like you can add the relevant entries to '/etc/hosts' on the system and dnsmasq will serve up that name data. [0] I'd be a little shocked (but only a little) if something similar were impossible on all non-OpenWRT consumer-grade routers.

My Switch 1 is more than happy to use the DNS server that DHCP tells it to. I assume the Switch 2 is the same way.

[0] https://openwrt.org/docs/guide-user/base-system/dhcp.dnsmasq>

Re: You can run a DNS server (2025)

#57

Post by tzury »

jcgl wrote: post #43
tzury wrote: post #37

Just remember, if you run your own DNS, and you do so for a mission critical platform, the platform is exposed to a udp DDoS that will be hard to detect let alone prevent. Unless of course you will invest 5-6 figures worth of US dollars worth of equipment, which by then you can look back and ask yourself, was I better off with Google Cloud DNS, AWS Route 53 and the likes.

Not that I disagree with the fact that these risks exist, but how is that different than running any other service for a mission critical platform? The main thing I can think of is DNS amplification attacks, but that's more your DNS server being used as part of a DDoS attack rather than being targeted for one. Also (afaik) resolvers are more common targets for DNS amplification than authoritative.

Large scale dns vendors have a multi million dollars worth of network layer traffic filtering equipment pipelined in front of their DNS servers (or in house solutions such as Google).

Re: You can run a DNS server (2025)

#58

Post by megous »

dwedge wrote: post #28

I've been tempted by this because I self host everything else, but "adding an entry to postgres instead of using namecheap gui" is overkill, just use a DNS with an API. Last few days I've been migrating everything to luadns format, stored in github and then I have github actions triggering a script to convert it to octodns and apply it. I could have just used either, but I like the luadns format but didn't want to be…

DNS servers are manageable via standard utilities/protocol, with tools like nsupdate, if you enable it.

Re: You can run a DNS server (2025)

#59

Post by catlifeonmars »

DaSHacka wrote: post #6
adiabatichottub wrote: post #4

Earlier quoted context omitted.

I'm a fan of uACME: https://github.com/ndilieto/uacme Tiny, simple, reliable. What more can you ask?

Neat, I've used lego ( https://github.com/go-acme/lego ) but will certainly have to give uacme a look, love me a simple ACME client. acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.

Lego is solid. I use it with Route53 to do automatic renewal of LE certs for various endpoints before the certs expire.

Re: You can run a DNS server (2025)

#60

Post by megous »

tzury wrote: post #57
jcgl wrote: post #43

Earlier quoted context omitted.

Not that I disagree with the fact that these risks exist, but how is that different than running any other service for a mission critical platform? The main thing I can think of is DNS amplification attacks, but that's more your DNS server being used as part of a DDoS attack rather than being targeted for one. Also (afaik) resolvers are more common targets for DNS amplification than authoritative.

Large scale dns vendors have a multi million dollars worth of network layer traffic filtering equipment pipelined in front of their DNS servers (or in house solutions such as Google).

Virtual private cloud services where you host the DNS server may also include DDoS protection.
Post reply on HN