Infrastructure Series -- Recursive DNS and Adblocking DNS over TLS w/NGINX

Wikis & How-to Guides
, ,
19

As novasty pointed out I do run arch and Manjaro arm.

It’s rock solid stable just like anything else. The thing it doesn’t have is a security policy

You have to write one. There’s a lot of none sense out there about unsupported distros etc. Truth is it’s linux and Linux is linux. Pedigreeism about distros is annoying.

The reason I ran it is to always be on the latest upstream and because it was lightweight. That was my reason haha

Unbound has been stupidly stable this entire time. Some pihole issues cropped up and the need for some optimizations but that’s it

1 Like
20

Now this you can fuck off on until all distros decide to finally agree on a unified filesystem structure. I can’t freely just hop over from RHEL to Deb/buntu without relearning a few things here and there because someone had the bright idea of having a completely different philosophy in user experience.

1 Like
21

They realistically will never do that Debian has its way in Red hat has its way.

Arch seems to come very close to the Red hat way

Suse follows the red hat way

In a lot of ways Debian and Ubuntu are the special snowflakes. But they are the big globby ones you can’t ignore

I like the file structure of Red hat and because Arch does kind of do a similar structure I’m fine on Arch

Then use what you want? All I’m saying is that pedigreeism in choosing one because we think one is better than the other is false

You weigh the pros and cons of what the distro has. Does it suit the purpose you wanted to It’s not going to be better

Almost all posix tools you’ll use function exactly the same way. And a newer kernel functions pretty much the same way.

your terminal is going to function pretty much the same way we’re talking about file paths here.

And it’s frustrating I know I bitched about it too but it’s just like we got to look it up and then we are okay. Fedora in particular threw me off again but I actually started to like its organization’s game with nginx

1 Like
22

Manjaro was the closest I ever got to dabbling with Arch-family stuff, on my quest to find the perfect (for me) Linux desktop distro I made a quick detour with Manj ~17 maybe, but my preference remains to stick within Deb family stuff, although I don’t love the pure Debian desktop experience, especially if you have modern hardware. But it’s rock-solid, almost boringly stable. Great for set it and forget it appliances I tend to build and tinker with.

1 Like
23

Testing complete. No issues to report.

Optimizations have worked and are very nice

Memory usage increased 15% but its well within limitations

24

Additionally you can change all the servers of your pihole if you want to remove the bigger names and just want to use them.

image
image530×863 104 KB

To do so you edit the dns-servers.conf

In my case I want to leave opennic as a fallback. Preserved the accent mark in Québec :wink: (pour les incultes )

[eric@baldr pihole]$ sudo cat dns-servers.conf 
UncensoredDNS (1: AnyCast 2:Unicast | DNSSEC | NOLOGS);91.239.100.100;89.233.43.71;2001:67c:28a4::;2a01:3a0:53:53::
FreeNom (DNSSEC | Anonymized);80.80.80.80;80.80.81.81;;
OpenNIC (NS5.CA | Toronto | DNSSEC | NOLOGS);142.93.148.79;;2604:a880:cad:d0::685d:e001;
OpenNIC (NS12.CA | Toronto | DNSSEC | NOLOGS);165.22.224.164;;2604:a880:cad:d0::d9a:f001;
OpenNIC (NS8.CA | Québec | DNSSEC | NOLOGS);198.50.135.212;;2607:5300:203:7f27:5054:ff:fe57:4a07;
OpenNIC (NS4.CA | Québec | DNSSEC | NOLOGS);66.70.228.164;;2607:5300:203:439c::102;
OpenNIC (NS4.GA.US | Atlanta | DNSSEC | NOLOGS);45.76.254.23;;2001:19f0:5401:2a4a:5400:03ff:fe2b:271f;
OpenNIC (NS4.NJ.US | Piscataway | DNSSEC | NOLOGS);192.3.165.37;;2001:470:1f07:ed6::;
OpenNIC (NS6.NY.US | New York City | DNSSEC | NOLOGS);162.243.19.47;;2604:a880:0:1010::b:4001;

FORMAT:
Name;DNS4_1;DNS4_2;DNS6_1;DNS6_2

Easy peazy

1 Like
25

boringly stable is a meme to me. I like rolling it simplifies my life haha

1 Like
26

ADDITIONAL NOTE

To harden your TLS sessions/sockets with the same level of encryption

you need to add this to your stream{} block configurations

    ssl_dhparam            <path>/dhparam.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers         !AES128:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    ssl_ecdh_curve secp521r1:secp384r1;
    ssl_trusted_certificate       <path>/fullchain.pem;
2 Likes
27

@PhaseLockedLoop still love you for this series. I’ve been reading through and looking things up as needed for my own understanding. Thank you for these again.

2 Likes
28

why not just add it to the beginning of the block and not have to add it to each config?

2 Likes
29

Because nginx won’t start

It tells me it doesn’t belong there

1 Like
30

No problem. I expand notes as I find little tweaks lol

I do go further than others about hardening though

2 Likes
31

That’s why I’m enjoying it so much… looking into a firewall pc atm.

2 Likes
32

Any basic system will do that’s post sandy bridge.

You just have to decide are you going to put multiple NICs in there or do a trunk? Lol

2 Likes
33

OK, I’m in over my head… I guess I need to start with Nginx? lol

1 Like
34

yes… where are you lost. 1 step at a time

2 Likes
35

Where should I try to have Nginx? Or should I start with the firewall first? Lol ug…boo… Im just too disorganized. I need to get sorted…

2 Likes
36

Clean slate

Do you have pihole running?

1 Like
37

Yes on my home machine. Not all systems use it as a DNS because wife would freak but my machines use it. Its not on any testing equipment. Its on a LXC container in the ryzen 2700 Fractal 804 Server.

2 Likes
38

Lets talk about groups

image
image1521×897 177 KB

Assign static IPs both 6 and 4 to your home clients

Create groups… and use different block lists for each. On your wives do the basics… block malware and stuff… and on your block all you want and on guests… block malware and things you dont want them accessing

(I dont use the function but I hear its powerful)

3 Likes