techsupport

3211 readers

4 users here now

The Lemmy community will help you with your tech problems and questions about anything here. Do not be shy, we will try to help you.

If something works or if you find a solution to your problem let us know it will be greatly apreciated.

Rules: instance rules + stay on topic

Partnered communities:

You Should Know

Software gore

Recommendations

founded 3 years ago

MODERATORS

GatoB@lemmy.world

How does DNS over https work? (piefed.blahaj.zone)

submitted 2 weeks ago by akunohana@piefed.blahaj.zone to c/techsupport@lemmy.world

12 comments fedilink hide all child comments

I have two routers. One of them encrypts everything with a wireguard interface and routes all traffic through my VPN provider. The other one is "plain", unencrypted, and it is used for services that need a public IP. If all these services need is a public IP address that leads to the router's wan port, I can still encrypt my DNS traffic, I thought, so I set up DNS over https (DoH), using my VPN provider's servers. To do this on OpenWRT, which is my router's operating system, I needed to download any one package that provides this functionality. I couldn't just configure ports, firewall rules, NAT or whatever and be happy... Of the settings that this DoH package came with lets you choose a "bootstrap DNS". It was configured to Google's and Cloudflare's servers by default, but I changed it to Quad9's. Everything works fine. My VPN provider confirms that I am using their DNS servers and that my DNS traffic is encrypted.

What is going on under the hood? What is this "bootstrap DNS"? Why isn't it as easy as exchanging public keys, as with regular traffic that goes through my VPN router's wireguard port?

you are viewing a single comment's thread
view the rest of the comments

[–] akunohana@piefed.blahaj.zone 2 points 2 weeks ago (1 children)

I see. I just wonder why I couldn't set the IP address for my DNS provider in the router's configuration, since my VPN provider - whose DNS I'm using - provide the IP addresses and domain names on their website. 🤔

[–] lime@feddit.nu 3 points 2 weeks ago

good question. looks like there isn't a actually a standard way to initiate doh, because it's still just a proposal.

also i guess it's helpful for getting through captive portals.