New Cloudflare DNS -- Fastest and Most Secure

Community Tech Policy & News
21

Easy to configure pfsense to use DNS over TLS :point_down:

22

Better than some randoā€™s github binary release.

23

Yeah, and pfsense has pfblockerNG for pi-hole-like adblocking also. It certainly does offer a ton of flexibility.

@SgtAwesomesauce: If I wanted to download and compile my own source to install and upgrade random applications Iā€™d be running gentoo. Life is too short! I want a PPA with a nicely packaged application. Or even better, a snap package or docker container.

24

Agreed, but you donā€™t need to do that. pfsense can easily handle DNS over TLS for you. Not sure if itā€™s this easy on a vanilla unbound install, but shouldnā€™t take that much effort to set up.

25

Indeed, but I donā€™t have a pfsense box. My high end as of 4 years ago ASUS router with aftermarket firmware does a fine job and I donā€™t feel the need to spend a couple hundred bucks replacing it.

Setting up VLANs to isolate my IOT stuff would be much easier with pfsense and that could be worthwhile, but I already worked through that pain!

26

Well, give it time. Who knows. If you ask nicely, maybe Iā€™ll make a docker container. :stuck_out_tongue:

Edit: link me this guys implementation. Iā€™ll have a look and see what itā€™s going to take.

1 Like
27

I think you could spin up a pfsense vm and just use it as a local DNS server. Just ignore the routing stuff altogetherā€¦ I was thinking of doing this at home actually.

28

Itā€™s not a bad option.

Pi-Hole might be a preferential solution.

29

Actually after a bit more research, DNScrypt Proxy v2.0 supports DNS over HTTPS, and thatā€™s a mature solution.

2 Likes
30

Pfsense DNS Resolver with caching was easy. Adding Pfblockerng on top of that was not difficult either.

There may be other/better guides, but this worked for me - just did as they suggested:
https://www.linuxincluded.com/block-ads-malvertising-on-pfsense-using-pfblockerng-dnsbl/

My VPN doesnā€™t support DNSSec, which is unfortunate, butā€¦ If I canā€™t trust them with my DNS, then I canā€™t trust them with my VPN (same rule as an connecting to an ISP).

31

DNSSec provides security beyond whatā€™s within the control of the specific DNS server you chooseā€¦ but why does the VPN provider have any bearing on which DNS server you use?

32

Easy-button way to prevent leakage is use their servers and ā€œtrustā€ them to do as they promise and not log or leak this data outside your tunnel. Also theoretically provides the most direct path to DNS info through your tunnel (most immediate hop).

Certainly donā€™t have to and if their servers are clogged/high latency or topologically impaired you are gonna have a bad time (though Iā€™ve had no issue with a caching DNS pfsense setup using their servers).

1 Like
33

So far so good. I had some issues getting the Pi setup, which switching microSD cards resolved. Used 1.1.1.1 on the Pi-Hole for nowā€¦ although Iā€™d like to read up on all of the new stuff thatā€™s been posted in this thread. See if one of the others listed might be a better choice.

34

Just got this setup on my pfsense box at home.

2 Likes
35

Quad9 is more private and still has dnssec and LTS.

1 Like
36

I set this up on my pfSense router, its fast when it works but Iā€™ve intermittently had heavy slowdowns in DNS requests and there have been times when DNS cuts out entirely with it. Not sure whether it is an issue with my configuration or Cloudflares DNS yet but need to look into it more.

1 Like
38

Gonna have to flesh this out a bit more, this is a non topic right now.

2 Likes
39

please elaborate and expand on your post more. What do you want do you want out thoughts to be on?

1 Like
40

Hi HippyTree, you been enjoying the Hippy Trees a bit? :stuck_out_tongue:

cheech_and_chong

4 Likes
42

Oh, are you talking about DNS over SSL or DNS over HTTPS?