4 ms·

For 10$/year I am running a VPS server in Amsterdam with strongswan ([1] VPN server) and dnscrypt-proxy 2.0 ([2] DNS server which is dispersing queries to multi

by chewz 8y ago

For 10$/year I am running a VPS server in Amsterdam with strongswan ([1] VPN server) and dnscrypt-proxy 2.0 ([2] DNS server which is dispersing queries to multiple DNSCrypt servers and also blocking various ads and bad agents) on it. I also keep nginx to avoid pinging Apple or Google for checking if internet works (captive.apple.com, http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 are re-routed to my own server). Finally it is incredibly simple to use nginx to serve DNS-over-TLS from your own machine (so from my dnscypt-proxy) for using on Android Pie. Works on mobile as well. [3] [1] https://strongswan.org/ https://strongswan.org/ [2] https://github.com/jedisct1/dnscrypt-proxy https://github.com/jedisct1/dnscrypt-proxy [3] https://github.com/jedisct1/dnscrypt-proxy/wiki/Connecting-to-a-remote-dnscrypt-proxy-client-from-Android-Pie-using-DNS-over-TLS https://github.com/jedisct1/dnscrypt-proxy/wiki/Connecting-t...

AdamGibbins 8y ago
The problem I have with this setup is when using networks that require you click through a captive portal. Often external DNS servers can't resolve their portals -- so you can't click through to open up to the wider internet and have to screw around flipping the DNS temp. After wondering what on earth is going on for a minute or two, as you've forgotten, again.
- ignoramous 8y ago
  Just curious: Wouldn't visiting sites like http://neverssl.com http://neverssl.com work? If it doesn't, then it's a good opportunity for someone to put a static-ip behind something like http://neverssl.com http://neverssl.com
  - AdamGibbins 8y ago
    No because often they redirect you to a DNS address that only exists in their internal DNS. And that internal DNS is often to an internal only IP, so you can't VPN all your traffic. e.g. you'll go to http://neverssl.com http://neverssl.com then get bounced to http://some.internal.net http://some.internal.net which resolves to 10.10.1.1 which finally serves the portal you have to click through.

by chewz 8y ago

AdamGibbins 8y ago

The problem I have with this setup is when using networks that require you click through a captive portal. Often external DNS servers can't resolve their portals -- so you can't click through to open up to the wider internet and have to screw around flipping the DNS temp. After wondering what on earth is going on for a minute or two, as you've forgotten, again.

ignoramous 8y ago
Just curious: Wouldn't visiting sites like http://neverssl.com http://neverssl.com work? If it doesn't, then it's a good opportunity for someone to put a static-ip behind something like http://neverssl.com http://neverssl.com
- AdamGibbins 8y ago
  No because often they redirect you to a DNS address that only exists in their internal DNS. And that internal DNS is often to an internal only IP, so you can't VPN all your traffic. e.g. you'll go to http://neverssl.com http://neverssl.com then get bounced to http://some.internal.net http://some.internal.net which resolves to 10.10.1.1 which finally serves the portal you have to click through.