3 ms·

> Most operating systems and programs will never use DoH even if the user does want it. Let Mozilla publish their DNS server addresses then. Let Mozilla (or an

> Most operating systems and programs will never use DoH even if the user does want it. Let Mozilla publish their DNS server addresses then. Let Mozilla (or anyone, it's open source) write a DoH module for pihole. Problem ~~solved~~ deferred.

jeroenhd 5y ago
I'm running https://crates.io/crates/doh-proxy https://crates.io/crates/doh-proxy on my Pihole for DoH access (with an nginx frontend for TLS, though that's not necessary of course). You can just plug it into Firefox and it'll work. With nginx in front you can put a stream {} block to proxy pi.hole:853/tcp to pi.hole:53 to enable DoT at the same time: stream { server { listen 853 ssl; proxy_pass pi.hole:53; ssl_[...] } } This setup worked great for me with Android, though it doesn't log the requesting device separately anymore (which is why I switched to a DNS server over a WireGuard VPN instead).
- josephcsible 5y ago
  Doesn't this only give you DoH and DoT on the local half of the connection? Don't you need to also using cloudflared or unbound to send the remote half over DoH (which is where basically all of the security and privacy benefit comes from) as well?
  - jeroenhd 5y ago
    You're right, but I made the assumption that people want to play around with DNS resolution. For even better privacy, you'll need something like dnscrypt or enable DoH in your local bind/unbound/knot/powerdns server. Preferably ODoH to have complete privacy, but I don't know how commonly that's implemented yet.
    - josephcsible 5y ago
      Can't you still play around with the DNS resolution on the Pi-hole itself even if it is using DoH on the far end?
josephcsible 5y ago
> Let Mozilla publish their DNS server addresses then. You mean a list of the servers they use by default? They already do that; it's currently Cloudflare and Quad9. > Let Mozilla (or anyone, it's open source) write a DoH module for pihole. We already have that: https://docs.pi-hole.net/guides/dns/cloudflared/ https://docs.pi-hole.net/guides/dns/cloudflared/ > Problem ~~solved~~ deferred. I don't see how.

jeroenhd 5y ago

I'm running https://crates.io/crates/doh-proxy https://crates.io/crates/doh-proxy on my Pihole for DoH access (with an nginx frontend for TLS, though that's not necessary of course). You can just plug it into Firefox and it'll work. With nginx in front you can put a stream {} block to proxy pi.hole:853/tcp to pi.hole:53 to enable DoT at the same time: stream { server { listen 853 ssl; proxy_pass pi.hole:53; ssl_[...] } } This setup worked great for me with Android, though it doesn't log the requesting device separately anymore (which is why I switched to a DNS server over a WireGuard VPN instead).

josephcsible 5y ago
Doesn't this only give you DoH and DoT on the local half of the connection? Don't you need to also using cloudflared or unbound to send the remote half over DoH (which is where basically all of the security and privacy benefit comes from) as well?
- jeroenhd 5y ago
  You're right, but I made the assumption that people want to play around with DNS resolution. For even better privacy, you'll need something like dnscrypt or enable DoH in your local bind/unbound/knot/powerdns server. Preferably ODoH to have complete privacy, but I don't know how commonly that's implemented yet.
  - josephcsible 5y ago
    Can't you still play around with the DNS resolution on the Pi-hole itself even if it is using DoH on the far end?

josephcsible 5y ago

> Let Mozilla publish their DNS server addresses then. You mean a list of the servers they use by default? They already do that; it's currently Cloudflare and Quad9. > Let Mozilla (or anyone, it's open source) write a DoH module for pihole. We already have that: https://docs.pi-hole.net/guides/dns/cloudflared/ https://docs.pi-hole.net/guides/dns/cloudflared/ > Problem ~~solved~~ deferred. I don't see how.