From 4475326bc6edfc0d018956b6a38d981f451c99c7 Mon Sep 17 00:00:00 2001 From: josiah Date: Fri, 2 Jul 2021 03:41:05 -0500 Subject: created doh-server.html --- doh-server.html | 123 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 doh-server.html diff --git a/doh-server.html b/doh-server.html new file mode 100644 index 0000000..2c065b2 --- /dev/null +++ b/doh-server.html @@ -0,0 +1,123 @@ + + + + Personal DNS over HTTPS server – LandChad.net + + + + + + + +

Run your own DNS over HTTPS server.

+ +
+

Encrypted DNS can be a great tool for your online privacy if it's hosted by a trustworthy entity, and who can you trust more with your data than yourself? +

+ +

Installing Unbound.

+ +

First of all, we need to install our DNS server, Unbound. Unbound is a validating, recursive and caching DNS server. +

+ 
apt install -y unbound
+ +

Now that Unbound is installed, we will configure it a bit. +

+

Using your favorite editor, edit the file /etc/unbound/unbound.conf and add the following values, if they don't exist already: + 

include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
+server:
+	log-queries: no
+	log-replies: no
+	aggressive-nsec: yes
+	ratelimit: 150
+	verbosity: 1	
+
+ +

Now restart Unbound to activate your new configuration: +

+ 
 systemctl restart unbound
+

To test to see if your DNS server is resolving, add nameserver 127.0.0.1 to your /etc/resolv.conf. If you are able to resolve domains, Unbound is working. +

+ +

Installing DNSS.

+ +

Now we need to install a program to convert HTTP requests to DNS queries. dnss accomplishes that goal very well. +

+

To install DNSS, run the following command: +

+ 
apt install -y dnss
+ +

Configuring DNSS.

+ +

DNSS comes with a bad default configuration, disable it using the following command: +

+ 
systemctl disable --now dnss dnss.socket
+ +

Now, using your favorite text editor, create a new file in /etc/systemd/system named doh.service. This will be the new DNSS configuration file. Add the following values to the file: +

+ 
[Unit]
+Description=DNSS DNS over HTTPS Proxy
+[Service]
+ExecStart=/usr/bin/dnss \
+	-enable_https_to_dns \
+	-https_server_addr 127.0.0.1:8080 \
+	-insecure_http_server \
+	-dns_upstream 127.0.0.1:53 
+
+Type=simple
+Restart=always
+User=dnss
+Group=dnss
+
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+ProtectSystem=full
+
+[Install]
+WantedBy=multi-user.target
+
+ +

Close the file and enable/start it using the command: +

+ 
systemctl enable --now doh.service
+ +

Setting up Nginx.

+ +

To set up Nginx with HTTPS, follow these guides. +

+

Once you've gotten all of that set up, we'll reverse proxy our HTTPS to DNS proxy. Open up your Nginx config file, and add the following values: +

+ 
location /dns-query {
+			proxy_pass http://127.0.0.1:8080/;
+		}
+

Now, your configuration should look something like this: +

+ 
server { 
+	listen 80;
+	server_name landchad.net;
+	return 301 https://$host$request_uri;
+}
+server {
+	listen 443 ssl http2;
+	server_name landchad.net;
+	root /var/www/landchad;
+	ssl_certificate /etc/letsencrypt/live/landchad.net/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/landchad.net/privkey.pem;
+	location /dns-query {
+		proxy_pass http://127.0.0.1:8080/;
+	}
+}
+ +

Finally, you can check your Nginx config using nginx -t, if the check passes, restart Nginx using the command: + 

systemctl restart nginx
+ +

Using your DNS over HTTPS server.

+ +

To use your new DNS over HTTPS server, go to your browser's settings and navigate to the "Network Settings" area. You should be able to set a custom secure DNS url. Once set, you can check to see if it's working by attempting to visit websites. +

+

Written by Josiah.

+
+ + + + + -- cgit v1.2.3 From 6361b7b2f612de3d5cbd43eb2325d02101689ab3 Mon Sep 17 00:00:00 2001 From: josiah Date: Fri, 2 Jul 2021 03:50:33 -0500 Subject: cleaned up --- doh-server.html | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/doh-server.html b/doh-server.html index 2c065b2..e3c2a6c 100644 --- a/doh-server.html +++ b/doh-server.html @@ -30,8 +30,7 @@ server: log-replies: no aggressive-nsec: yes ratelimit: 150 - verbosity: 1 - + verbosity: 1

Now restart Unbound to activate your new configuration:

@@ -73,8 +72,7 @@ CapabilityBoundingSet=CAP_NET_BIND_SERVICE ProtectSystem=full [Install] -WantedBy=multi-user.target - +WantedBy=multi-user.target

Close the file and enable/start it using the command:

-- cgit v1.2.3 From a0ac2b3ccee5184fb9cb9e2746e2a5f04e4dfd22 Mon Sep 17 00:00:00 2001 From: josiah Date: Fri, 2 Jul 2021 03:52:31 -0500 Subject: fixed bad tabs --- doh-server.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doh-server.html b/doh-server.html index e3c2a6c..7927e41 100644 --- a/doh-server.html +++ b/doh-server.html @@ -85,8 +85,8 @@ WantedBy=multi-user.target

Once you've gotten all of that set up, we'll reverse proxy our HTTPS to DNS proxy. Open up your Nginx config file, and add the following values: 

location /dns-query {
-			proxy_pass http://127.0.0.1:8080/;
-		}
+ proxy_pass http://127.0.0.1:8080/; +}

Now, your configuration should look something like this: 

server { 
-- 
cgit v1.2.3


From 0d9ba39dd0e73c9c19a6fae7aee97a5b05cb0358 Mon Sep 17 00:00:00 2001
From: josiah 
Date: Fri, 2 Jul 2021 03:56:23 -0500
Subject: cleaned up a bit more

---
 doh-server.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doh-server.html b/doh-server.html
index 7927e41..ca38e1d 100644
--- a/doh-server.html
+++ b/doh-server.html
@@ -110,9 +110,9 @@ server {
 
 		
Using your DNS over HTTPS server.

 
-		
To use your new DNS over HTTPS server, go to your browser's settings and navigate to the "Network Settings" area. You should be able to set a custom secure DNS url. Once set, you can check to see if it's working by attempting to visit websites. 
+		
To use your new DNS over HTTPS server, go to your browser's settings and navigate to the "Network Settings" area. You should be able to set a custom secure DNS url. Once set, you can check to see if it's working by attempting to resolve domains, and by testing your browser with whatismydnsserver.com.
 		

-		
Written by Josiah.

+		
Written by Josiah.

 	
 	
LandChad.net
Because Everyone should be an Internet LandChad.
  • chad
  • RSS
  • BTC
  • XMR
  • Github
    • 
 
-- 
cgit v1.2.3


From 3d0d763bc719fbd8f65276c78536e7b3528814b0 Mon Sep 17 00:00:00 2001
From: Luke Smith 
Date: Fri, 1 Jul 2022 20:16:22 -0400
Subject: dns over https draft in hugo

---
 content/dns-over-http.md | 148 +++++++++++++++++++++++++++++++++++++++++++++++
 doh-server.html          | 121 --------------------------------------
 2 files changed, 148 insertions(+), 121 deletions(-)
 create mode 100644 content/dns-over-http.md
 delete mode 100644 doh-server.html

diff --git a/content/dns-over-http.md b/content/dns-over-http.md
new file mode 100644
index 0000000..079439c
--- /dev/null
+++ b/content/dns-over-http.md
@@ -0,0 +1,148 @@
+---
+title: "Run your own DNS over HTTPS server."
+tags: ['service']
+draft: true
+---
+
+Encrypted DNS can be a great tool for your online privacy if it\'s
+hosted by a trustworthy entity, and who can you trust more with your
+data than yourself?
+
+## Installing Unbound.
+
+First of all, we need to install our DNS server, Unbound. Unbound is a
+validating, recursive and caching DNS server.
+
+```sh
+apt install -y unbound
+```
+
+### Now that Unbound is installed, we will configure it a bit.
+
+Using your favorite editor, edit the file `/etc/unbound/unbound.conf`
+and add the following values, if they don\'t exist already:
+
+```
+include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
+server:
+    log-queries: no
+    log-replies: no
+    aggressive-nsec: yes
+    ratelimit: 150
+    verbosity: 1
+    ```
+
+Now restart Unbound to activate your new configuration:
+
+ ```sh
+ systemctl restart unbound
+ ```
+
+To test to see if your DNS server is resolving, add
+`nameserver 127.0.0.1` to your `/etc/resolv.conf`. If you are able to
+resolve domains, Unbound is working.
+
+## Installing DNSS.
+
+Now we need to install a program to convert HTTP requests to DNS
+queries. `dnss` accomplishes that goal very well.
+
+To install DNSS, run the following command:
+
+```sh
+apt install -y dnss
+```
+
+### Configuring DNSS.
+
+DNSS comes with a bad default configuration, disable it using the
+following command:
+
+```sh
+systemctl disable --now dnss dnss.socket
+```
+
+Now, using your favorite text editor, create a new file in
+`/etc/systemd/system` named `doh.service`. This will be the new DNSS
+configuration file. Add the following values to the file:
+
+```systemd
+[Unit]
+Description=DNSS DNS over HTTPS Proxy
+[Service]
+ExecStart=/usr/bin/dnss \
+    -enable_https_to_dns \
+    -https_server_addr 127.0.0.1:8080 \
+    -insecure_http_server \
+    -dns_upstream 127.0.0.1:53
+
+Type=simple
+Restart=always
+User=dnss
+Group=dnss
+
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+ProtectSystem=full
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Close the file and enable/start it using the command:
+
+```sh
+systemctl enable --now doh.service
+```
+
+## Setting up Nginx.
+
+To set up Nginx with HTTPS, follow [these](/nginx) [guides](/certbot).
+
+Once you\'ve gotten all of that set up, we\'ll reverse proxy our HTTPS
+to DNS proxy. Open up your Nginx config file, and add the following
+values:
+
+```nginx
+location /dns-query {
+    proxy_pass http://127.0.0.1:8080/;
+}
+```
+
+Now, your configuration should look something like this:
+
+```nginx
+server {
+    listen 80;
+    server_name landchad.net;
+    return 301 https://$host$request_uri;
+}
+server {
+    listen 443 ssl http2;
+    server_name landchad.net;
+    root /var/www/landchad;
+    ssl_certificate /etc/letsencrypt/live/landchad.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/landchad.net/privkey.pem;
+    location /dns-query {
+        proxy_pass http://127.0.0.1:8080/;
+    }
+}
+```
+
+Finally, you can check your Nginx config using `nginx -t`, if the check
+passes, restart Nginx using the command:
+
+```sh
+systemctl restart nginx
+```
+
+## Using your DNS over HTTPS server.
+
+To use your new DNS over HTTPS server, go to your browser\'s settings
+and navigate to the \"Network Settings\" area. You should be able to set
+a custom secure DNS url. Once set, you can check to see if it\'s working
+by attempting to resolve domains, and by testing your browser with
+[whatismydnsserver.com](http://www.whatsmydnsserver.com/).
+
+## Contributor
+
+[Josiah.](https://ioens.is)
diff --git a/doh-server.html b/doh-server.html
deleted file mode 100644
index ca38e1d..0000000
--- a/doh-server.html
+++ /dev/null
@@ -1,121 +0,0 @@
-
-
-	
-		Personal DNS over HTTPS server – LandChad.net
-		
-		
-		
-		
-		
-	
-
-	
    Run your own DNS over HTTPS server.
    
-	
-	
    
-		
    Encrypted DNS can be a great tool for your online privacy if it's hosted by a trustworthy entity, and who can you trust more with your data than yourself?
-		
    
-		
-		
    Installing Unbound.
    
-
-		
    First of all, we need to install our DNS server, Unbound. Unbound is a validating, recursive and caching DNS server.
-		
    
-		
    apt install -y unbound
    
-		
-		
    Now that Unbound is installed, we will configure it a bit.
-		
    
-		
    Using your favorite editor, edit the file /etc/unbound/unbound.conf and add the following values, if they don't exist already:
-		
    include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
-server:
-	log-queries: no
-	log-replies: no
-	aggressive-nsec: yes
-	ratelimit: 150
-	verbosity: 1
    
-		
-		
    Now restart Unbound to activate your new configuration:
-		
    
-		
     systemctl restart unbound
    
-		
    To test to see if your DNS server is resolving, add nameserver 127.0.0.1 to your /etc/resolv.conf. If you are able to resolve domains, Unbound is working.
-		
    
-		
-		
    Installing DNSS.
    
-
-		
    Now we need to install a program to convert HTTP requests to DNS queries. dnss accomplishes that goal very well.
-		
    
-		
    To install DNSS, run the following command:
-		
    
-		
    apt install -y dnss
    
-
-		
    Configuring DNSS.
    
-
-		
    DNSS comes with a bad default configuration, disable it using the following command:
-		
    
-		
    systemctl disable --now dnss dnss.socket
    
-		
-		
    Now, using your favorite text editor, create a new file in /etc/systemd/system named doh.service. This will be the new DNSS configuration file. Add the following values to the file:
-		
    
-		
    [Unit]
-Description=DNSS DNS over HTTPS Proxy
-[Service]
-ExecStart=/usr/bin/dnss \
-	-enable_https_to_dns \
-	-https_server_addr 127.0.0.1:8080 \
-	-insecure_http_server \
-	-dns_upstream 127.0.0.1:53 
-
-Type=simple
-Restart=always
-User=dnss
-Group=dnss
-
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-ProtectSystem=full
-
-[Install]
-WantedBy=multi-user.target
    
-
-		
    Close the file and enable/start it using the command:
-		
    
-		
    systemctl enable --now doh.service
    
-
-		
    Setting up Nginx.
    
-
-		
    To set up Nginx with HTTPS, follow these guides.
-		
    
-		
    Once you've gotten all of that set up, we'll reverse proxy our HTTPS to DNS proxy. Open up your Nginx config file, and add the following values:
-		
    
-		
    location /dns-query {
-	proxy_pass http://127.0.0.1:8080/;
-}
    
-		
    Now, your configuration should look something like this:
-		
    
-		
    server { 
-	listen 80;
-	server_name landchad.net;
-	return 301 https://$host$request_uri;
-}
-server {
-	listen 443 ssl http2;
-	server_name landchad.net;
-	root /var/www/landchad;
-	ssl_certificate /etc/letsencrypt/live/landchad.net/fullchain.pem;
-	ssl_certificate_key /etc/letsencrypt/live/landchad.net/privkey.pem;
-	location /dns-query {
-		proxy_pass http://127.0.0.1:8080/;
-	}
-}
    
-		
-		
    Finally, you can check your Nginx config using nginx -t, if the check passes, restart Nginx using the command:
-		
    systemctl restart nginx
    
-
-		
    Using your DNS over HTTPS server.
    
-
-		
    To use your new DNS over HTTPS server, go to your browser's settings and navigate to the "Network Settings" area. You should be able to set a custom secure DNS url. Once set, you can check to see if it's working by attempting to resolve domains, and by testing your browser with whatismydnsserver.com.
-		
    
-		
    Written by Josiah.
    
-	
    
-	
-
-
-
-		
-- 
cgit v1.2.3