145
Linux DNS settings is a total mess (self.linux)
submitted 1 year ago by mfat to c/linux@lemmy.ml
68 comments fedilink hide all child comments

I recently tried to enable system-wide DNS over https on Fedora. To do so I had to to some research and found out how comfusing it is for the average user (and even experienced users) to change the settings. In fact there are multiple backends messing with system DNS at the same time.

Most major Linux distributions use systemd-resolved for DNS but there is no utility for changing its configuration.

The average user would still try to change DNS settings by editing /etc/relov.conf (which is overwritten and will not survive reboots) or changing settings in Network Manager.

Based on documentation of systemd-resolved, the standard way of adding custom DNS servers is putting so-called 'drop-in' files in /etc/systemd/resolved.conf.d directory, especially when you want to use DNS-over-TLS or DNS-over-https.

Modern browsers use their buit-in DNS settings which adds to the confusion.

I think this is one area that Linux needs more work and more standardization.

How do you think it should be fixed?

you are viewing a single comment's thread
view the rest of the comments
[-] samsy@feddit.de 19 points 1 year ago

I don't touch my fedora DNS settings because my openwrt router handles DoT for the entire network.

[-] redd@discuss.tchncs.de 13 points 1 year ago

That doesn't help outside of home. When we are in an untrusted network then the DNS mess makes us vulnerable for spoofing attacks.

[-] krolden@lemmy.ml 10 points 1 year ago

Wireguard to home or a vps running a pihole. Block all dns other than over wireguard.

[-] veronicaandrews@lemmy.world 2 points 1 year ago

Doesn’t this solution mess with captive portals?

[-] krolden@lemmy.ml 5 points 1 year ago

Ive never had an issue. You could always just disable it to load the captive portal then turn it back on after you're connected.

[-] samsy@feddit.de 6 points 1 year ago
  1. Wireguard
  2. I run my own DoT/DoH server and able to connect it from everywhere. This makes option 1 mostly obsolete.

PS. And yes, I fucking love to solve captchas. No, I am not a Robot.

[-] octatron@lmy.drundo.com.au 0 points 1 year ago

Could also look at tailscale, set it up on you home PCs and mobile devices, set the magic DNS to a home server or vps running pihole. If you don't like the aspect of tailscale being controlled by a third party you could self host that part using headscale on docker as well

[-] mojo@lemm.ee 8 points 1 year ago

DoT and DoH are really the most important when you're not at home.

[-] Frederic@beehaw.org 2 points 1 year ago

I enabled a OpenVPN server on my router and my laptop and phone are always connected to it

[-] mojo@lemm.ee 0 points 1 year ago

So do you just not leave the house then, I think you misread my comment or something

[-] LinuxSBC@lemm.ee 2 points 1 year ago

Do you know what a VPN is?

this post was submitted on 20 Oct 2023
145 points (89.6% liked)

Linux

48180 readers
878 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
nooter692@lemmy.ml
AgreeableLandscape@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz