3 ms·

does anybody know how to properly secure the the DNS server from replay attacks with iptables. i have a pihone running on a cheap vps on internet, but i connec

does anybody know how to properly secure the the DNS server from replay attacks with iptables. i have a pihone running on a cheap vps on internet, but i connect to it with a vpn and that's draining my smartphone battery. i want to be able to change only the dns settings and point to my pi-hole. but at that time the recommendation was to not run the dns part on the internet because it could be used for dns replay attacks. i found some iptables rules on the net at time but was not sure are they ok. i did not want the ip address blacklisted because i was running some other services on that server.

surround 6y ago
The official documentation includes a tutorial on how to use pi-hole with OpenVPN. This section describes how to use the VPN for only DNS requests: https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ A Wireguard setup would probably be even less resource intensive if you know how to set it up (there’s no official tutorial for Wireguard). Do not open your pi to the internet, I doubt the iptables rules would be sufficient to protect it.
- ignoramous 6y ago
  > ...there’s no official tutorial for Wireguard To run a split wireguard-tunnel to a DNS server, add its IP to the allowed-IPs list: https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tunnel_for_only_dns_possible/ https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun... If you're on an Android phone, apps like Blokada (plain old DNS), Nebulo (DoH and DoT), Intra (DoH) can split tunnel traffic to a DNS server of your choice. Note that, Android 9+ supports DoT, out of the box. Look for the Private DNS setting.
neurostimulant 6y ago
I have migrated wireguard since several months ago and the battery life improvements is tremendous compared to openvpn. Previously I can't enable vpn 24/7 as my phone's battery will be drained before the end of the day, but now with wireguard I can enable it all day without draining the battery too much.

surround 6y ago

The official documentation includes a tutorial on how to use pi-hole with OpenVPN. This section describes how to use the VPN for only DNS requests: https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ https://docs.pi-hole.net/guides/vpn/only-dns-via-vpn/ A Wireguard setup would probably be even less resource intensive if you know how to set it up (there’s no official tutorial for Wireguard). Do not open your pi to the internet, I doubt the iptables rules would be sufficient to protect it.

ignoramous 6y ago
> ...there’s no official tutorial for Wireguard To run a split wireguard-tunnel to a DNS server, add its IP to the allowed-IPs list: https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tunnel_for_only_dns_possible/ https://www.reddit.com/r/WireGuard/comments/bqccdz/split_tun... If you're on an Android phone, apps like Blokada (plain old DNS), Nebulo (DoH and DoT), Intra (DoH) can split tunnel traffic to a DNS server of your choice. Note that, Android 9+ supports DoT, out of the box. Look for the Private DNS setting.

neurostimulant 6y ago

I have migrated wireguard since several months ago and the battery life improvements is tremendous compared to openvpn. Previously I can't enable vpn 24/7 as my phone's battery will be drained before the end of the day, but now with wireguard I can enable it all day without draining the battery too much.