DNS servers that offer privacy and filtering • Hacker News Board

Re: DNS servers that offer privacy and filtering

#71

Post by blattimwind » Wed, Feb 06, 2019, 5:46 PM UTC

acranox wrote: post #56

krylon wrote: post #2

I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)

That's great and all, but you still need to pick an upstream DNS server. The conventional advice is to use one of these public services, or your ISP's resolvers, to avoid hitting the root servers constantly. A lot of services these days have very short TTLs, so running your own recursive resolver still causes a lot of requests to get forwarded. Also, as counterintuitive as it might seem, when I use namebench ( https:…

> That's great and all, but you still need to pick an upstream DNS server.

No, you don't, that's the whole point of a recursive resolver. I've been running against the root servers and neither query statistics nor observed performance match frequent issues due to short TTLs, or excessive number of external queries.

Re: DNS servers that offer privacy and filtering

#72

Post by ingenium » Wed, Feb 06, 2019, 5:52 PM UTC

skrause wrote: post #8

krylon wrote: post #2

I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)

I like to share the cache of the DNS resolver with as many people as possible because that's what gives you the best performance. A local resolver just for me can't really do that.

Google DNS (and likely others) doesn't really work that well for this unless it's a very popular domain because of the sheer number of servers that they run and the short TTLs on most records. Even on subsequent lookups, you're likely to hit a different backend server that doesn't have a record cached that you just looked up. Google's servers don't seem to share their cache between one another. Even reddit.com often has to do the full lookup.

For a full local resolver, you can configure it to use and serve expired records, with a 0 TTL. In the background it will then lookup all records used, so that it's refreshed for next time. Cloudflare does this. Likewise, you can configure it to prefetch frequently requested records before they expire.

Re: DNS servers that offer privacy and filtering

#73

Post by wahern » Wed, Feb 06, 2019, 6:00 PM UTC

palijer wrote: post #7

DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests. Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

Please, for the love of all that is holy, stop blocking ICMP! It's needed for things like Path MTU Discovery. With the increasing use of VPNs and tunnels (IPSec, Wireguard, GRE, etc) PMTUD is more important than ever.

At a minimum, any node on the internet routing or serving traffic needs to keep ICMP open. If you're running a DNS server, ICMP should be working.

Re: DNS servers that offer privacy and filtering

#74

Post by agumonkey » Wed, Feb 06, 2019, 6:15 PM UTC

krylon wrote: post #2

I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)

I use pdnsd as a local cache. It used to make browsing lightning fast. Although I might have messed up something since because dns resolution seems laggy. But in theory it is of great benefits.

Re: DNS servers that offer privacy and filtering

#75

Post by agumonkey » Wed, Feb 06, 2019, 6:17 PM UTC

palijer wrote: post #7

DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests. Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

are there known ICMP test servers ?

Re: DNS servers that offer privacy and filtering

#76

Post by Pheide1j » Wed, Feb 06, 2019, 6:22 PM UTC

palijer wrote: post #7

DNS servers should not be used as "internet connectivity tests" by pinging them. They are not maintained as ICMP test servers, and that is not their purpose. While many do not block ICMP packets, there are typically rate limiting systems in place, and other reasons why they would not respond to ping requests. Pinging DNS servers is a shitty inconclusive test for internet connectivity, or SLA measurements etc etc.

you can just set a lower TTL and get a response from a hop somewhere in your ISP's net.

Re: DNS servers that offer privacy and filtering

#77

Post by tinus_hn » Wed, Feb 06, 2019, 6:29 PM UTC

bluejekyll wrote: post #27

tinus_hn wrote: post #20

Earlier quoted context omitted.

You are better off using traceroute to one of these addresses, you should at least get some route outside of your own network.

Traceroute uses ICMP as well, and may send more packets then ping. It works by setting the TTL on the ICMP packet, which is the number of route hops to traverse before the packet is dropped. Routers are supposed to ( this can be disabled, and is why you get * * * sometimes) respond with a TTL expired. So it starts with a TTL of 1, and then increments by 1 after each hop is discovered (or no response in some timeout).

The important difference is that you can trust no host on the internet to actually respond to pings, especially not machines prone to receive DOS attacks, like public DNS resolvers. Traceroute is for testing connectivity, ping is an archaic test to see if a machine is running.

Re: DNS servers that offer privacy and filtering

#78

Post by klodolph » Wed, Feb 06, 2019, 7:09 PM UTC

kakarot wrote: post #68

klodolph wrote: post #61

Earlier quoted context omitted.

> It's not in my threat model per se, but it's something I give a lot of thought to because systems like this are expected to be used by political dissidents, whistleblowers and other persecuted individuals who are subject to such threat models. This is wrong, you should not expect political dissidents, whistleblowers, and other people in the same category to use similar techniques to protect themselves. If you are p…

> This is wrong, you should not expect political dissidents, whistleblowers, and other people in the same category to use similar techniques to protect themselves. I don't know how you can say I'm wrong when I was making the general conjecture that people in these categories use privacy-enhancing systems. I don't think you understood me well. I was not specifically referring to any particular set of techniques or sys…

> This system is not meant to be used when roaming? Or is this a use case?

kingo555 described a home network, but I don't think it matters. kingo555's threat model doesn't appear to consider traffic analysis, excluding it from the threat model, and that's a very reasonable choice. The system doesn't make any timing attacks easier.

> In this case, the answer is apparently "Well, your question isn't really relevant because this system is just meant for home use." One helpful sentence, no assumptions and no negativity.

I thought that was what I did here: https://news.ycombinator.com/item?id=19095304 But I was wrong, and sometimes it takes an entire conversation to discover the differences in assumptions and definitions.

Re: DNS servers that offer privacy and filtering

#79

Post by braddeicide » Wed, Feb 06, 2019, 7:18 PM UTC

kakarot wrote: post #24

kingo55 wrote: post #15

Earlier quoted context omitted.

More people should do this. I recently switched my home network DNS forwarder from Bind to DNS Crypt Proxy ( https://github.com/jedisct1/dnscrypt-proxy ). You can get ad/content filtering lists along with some little privacy enhancements like DNS Crypt and DNS over HTTPS support for encrypted DNS queries to supported services, like CloudFlare.

Even with DNS/HTTPS and such, wouldn't using a home DNS resolver with a VPN on both ends of the connection still make you a little more vulnerable to network analysis and timing attacks since your DNS requests are guaranteed to go through a specific IP which only serves you?

I have to go around my VPN provider for DNS because they intercept and alter DNS requests.

Re: DNS servers that offer privacy and filtering

#80

Post by tracker1 » Wed, Feb 06, 2019, 7:47 PM UTC

krylon wrote: post #2

I know this is not for everyone, but I strongly prefer to run my own recursive resolver at home. Performance is great, plus I get regular DNS for the machines on my home network. Also, it was a fun little project. :)

Most home routers already do this for you, it's a bit abstracted but there, just need to specify the network and have it in the list of networks to resolve for DHCP. Or you can DIY it on another box.

I find it's still best to defer to an upstream forward server vs. root resolution. Most of the providers mentioned have multiple points of presence and will likely be closer and resolve MUCH faster for most cases. DNS resolution time can be a huge factor in web responsiveness.