Infrastructure Series -- Recursive DNS and Adblocking DNS over TLS w/NGINX

As novasty pointed out I do run arch and Manjaro arm.

It’s rock solid stable just like anything else. The thing it doesn’t have is a security policy

You have to write one. There’s a lot of none sense out there about unsupported distros etc. Truth is it’s linux and Linux is linux. Pedigreeism about distros is annoying.

The reason I ran it is to always be on the latest upstream and because it was lightweight. That was my reason haha

Unbound has been stupidly stable this entire time. Some pihole issues cropped up and the need for some optimizations but that’s it

1 Like

Now this you can fuck off on until all distros decide to finally agree on a unified filesystem structure. I can’t freely just hop over from RHEL to Deb/buntu without relearning a few things here and there because someone had the bright idea of having a completely different philosophy in user experience.

1 Like

They realistically will never do that Debian has its way in Red hat has its way.

Arch seems to come very close to the Red hat way

Suse follows the red hat way

In a lot of ways Debian and Ubuntu are the special snowflakes. But they are the big globby ones you can’t ignore

I like the file structure of Red hat and because Arch does kind of do a similar structure I’m fine on Arch

Then use what you want? All I’m saying is that pedigreeism in choosing one because we think one is better than the other is false

You weigh the pros and cons of what the distro has. Does it suit the purpose you wanted to It’s not going to be better

Almost all posix tools you’ll use function exactly the same way. And a newer kernel functions pretty much the same way.

your terminal is going to function pretty much the same way we’re talking about file paths here.

And it’s frustrating I know I bitched about it too but it’s just like we got to look it up and then we are okay. Fedora in particular threw me off again but I actually started to like its organization’s game with nginx

1 Like

Manjaro was the closest I ever got to dabbling with Arch-family stuff, on my quest to find the perfect (for me) Linux desktop distro I made a quick detour with Manj ~17 maybe, but my preference remains to stick within Deb family stuff, although I don’t love the pure Debian desktop experience, especially if you have modern hardware. But it’s rock-solid, almost boringly stable. Great for set it and forget it appliances I tend to build and tinker with.

1 Like

Testing complete. No issues to report.

Optimizations have worked and are very nice

Memory usage increased 15% but its well within limitations

Additionally you can change all the servers of your pihole if you want to remove the bigger names and just want to use them.

To do so you edit the dns-servers.conf

In my case I want to leave opennic as a fallback. Preserved the accent mark in Québec :wink: (pour les incultes )

[[email protected] pihole]$ sudo cat dns-servers.conf 
UncensoredDNS (1: AnyCast 2:Unicast | DNSSEC | NOLOGS);91.239.100.100;89.233.43.71;2001:67c:28a4::;2a01:3a0:53:53::
FreeNom (DNSSEC | Anonymized);80.80.80.80;80.80.81.81;;
OpenNIC (NS5.CA | Toronto | DNSSEC | NOLOGS);142.93.148.79;;2604:a880:cad:d0::685d:e001;
OpenNIC (NS12.CA | Toronto | DNSSEC | NOLOGS);165.22.224.164;;2604:a880:cad:d0::d9a:f001;
OpenNIC (NS8.CA | Québec | DNSSEC | NOLOGS);198.50.135.212;;2607:5300:203:7f27:5054:ff:fe57:4a07;
OpenNIC (NS4.CA | Québec | DNSSEC | NOLOGS);66.70.228.164;;2607:5300:203:439c::102;
OpenNIC (NS4.GA.US | Atlanta | DNSSEC | NOLOGS);45.76.254.23;;2001:19f0:5401:2a4a:5400:03ff:fe2b:271f;
OpenNIC (NS4.NJ.US | Piscataway | DNSSEC | NOLOGS);192.3.165.37;;2001:470:1f07:ed6::;
OpenNIC (NS6.NY.US | New York City | DNSSEC | NOLOGS);162.243.19.47;;2604:a880:0:1010::b:4001;

FORMAT:
Name;DNS4_1;DNS4_2;DNS6_1;DNS6_2

Easy peazy

1 Like

boringly stable is a meme to me. I like rolling it simplifies my life haha

1 Like

ADDITIONAL NOTE

To harden your TLS sessions/sockets with the same level of encryption

you need to add this to your stream{} block configurations

    ssl_dhparam            <path>/dhparam.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers         !AES128:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    ssl_ecdh_curve secp521r1:secp384r1;
    ssl_trusted_certificate       <path>/fullchain.pem;
2 Likes

@PhaseLockedLoop still love you for this series. I’ve been reading through and looking things up as needed for my own understanding. Thank you for these again.

2 Likes

why not just add it to the beginning of the block and not have to add it to each config?

2 Likes

Because nginx won’t start

It tells me it doesn’t belong there

1 Like

No problem. I expand notes as I find little tweaks lol

I do go further than others about hardening though

2 Likes

That’s why I’m enjoying it so much… looking into a firewall pc atm.

2 Likes

Any basic system will do that’s post sandy bridge.

You just have to decide are you going to put multiple NICs in there or do a trunk? Lol

2 Likes

OK, I’m in over my head… I guess I need to start with Nginx? lol

1 Like

yes… where are you lost. 1 step at a time

2 Likes

Where should I try to have Nginx? Or should I start with the firewall first? Lol ug…boo… Im just too disorganized. I need to get sorted…

2 Likes

Clean slate

Do you have pihole running?

1 Like

Yes on my home machine. Not all systems use it as a DNS because wife would freak but my machines use it. Its not on any testing equipment. Its on a LXC container in the ryzen 2700 Fractal 804 Server.

2 Likes

Lets talk about groups

Assign static IPs both 6 and 4 to your home clients

Create groups… and use different block lists for each. On your wives do the basics… block malware and stuff… and on your block all you want and on guests… block malware and things you dont want them accessing

(I dont use the function but I hear its powerful)

3 Likes