Skip to content

GitLab

libredns.gr
libredns.gr
Last edited by Konstantinos Stamou (Dinos)
Page history

Home

Various ways of using DoH or DoT

DNS over HTTPS

Firefox

Endpoint https://doh.libredns.gr/dns-query

DNS over HTTPS (DoH) is best to be configured and used on applications, namely browsers.

At the moment the only browser that has sufficient support is Firefox. To configure Firefox do the following steps:

  1. Open Firefox preferences and navigate to:
    General > Network Settings > Settings

  2. At the bottom of this dialog:
    Enable DNS over HTTPS.

  3. Change from the default setting to Custom and fill in:
    https://doh.libredns.gr/dns-query

    firefox-doh

Firefox on Mobile

  1. Download Firefox on Mobile from any store available

  2. Open Firefox and write on the address bar about:config

  3. Write in the search bar network.trr.uri and change the value to the URL of LibreDNS DoH endpoint: https://doh.libredns.gr/dns-query

    image

  4. Write in the search bar network.trr.mode and write 2 as a value if you want to use LibreDNS as default provider and your normal DNS as a fallback and 3 if you want to use only LibreDNS, for more options visit: https://wiki.mozilla.org/Trusted_Recursive_Resolver

    image

    • If you choose 3 in network.trr.mode you need to add also the following preference in about:config:
    • Search for network.trr.bootstrapAddress and change the value to 116.202.176.26 which is the IP address of LibreDNS

    mobile3

  5. Test the connection with https://dnsleaktest.com/ and should only get the following results:

    mobile4

DNS over HTTPS with Dnsmasq and https-dns-proxy in OpenWrt (DEPRACATED)

Enable split DNS mode to encrypt LAN client DNS traffic assuming that local system traffic does not involve private data.

  1. Use https-dns-proxy to encrypt DNS traffic.
  2. Configure Dnsmasq to forward DNS queries to https-dns-proxy.
  3. Enforce DNS encryption for LAN clients to avoid DNS leak.
# Install packages
opkg update
opkg install dnsmasq https_dns_proxy
 
# Enable DNS encryption
uci -q delete [email protected][0].server
DOHPROXY_ADDR="$(uci get [email protected]_dns_proxy[0].listen_addr)"
DOHPROXY_PORT="$(uci get [email protected]_dns_proxy[0].listen_port)"
DOHPROXY_SERV="${DOHPROXY_ADDR//[][]/}#${DOHPROXY_PORT}"
uci add_list [email protected][0].server="${DOHPROXY_SERV}"
 
# Enforce DNS encryption for LAN clients
uci set [email protected][0].noresolv="1"
uci commit dhcp
/etc/init.d/dnsmasq restart

DoH provider (DEPRACATED)

https-dns-proxy is configured with Google DNS by default. So you need to change it to LibreDNS:

# Configure DoH provider
while uci -q delete [email protected]_dns_proxy[0]; do :; done
uci set https_dns_proxy.dns="https_dns_proxy"
uci set https_dns_proxy.dns.listen_addr="127.0.0.1"
uci set https_dns_proxy.dns.listen_port="5053"
uci set https_dns_proxy.dns.user="nobody"
uci set https_dns_proxy.dns.group="nogroup"
uci set https_dns_proxy.dns.url_prefix="https://doh.libredns.gr/dns-query?"
uci commit https_dns_proxy
/etc/init.d/https_dns_proxy restart

For more information, visit the OpenWrt Documentation

DNS over TLS

Systemd

IP 116.202.176.26
Port 853
Domain dot.libredns.gr

DNS over TLS (DoT) is best to be configured globally for the entire operating system.

A few clients already support the protocol, and the easiest way is to configure systemd to use it:

  1. Open /etc/systemd/resolved.conf with you favorite editor and sudo rights.

  2. And make sure you have these options:

    [Resolve]
DNS=116.202.176.26
FallbackDNS=127.0.0.1 ::1
DNSOverTLS=yes

    If you are on systemd < 243, then use opportunistic, instead of yes.