Android doesn't use my self-hosted dns-server in the private network reddit / selfhosted ---------------------------------------------------------------------- xTH13M0x · 2023-10-29 16:48 Hi, I'm hosting an own dns-server in my home-network, so that I can access my server in my private network with a domain without buying that domain. It works fine on my computer, but when I'm typing in the domain of my server on my smartphone, the browser doesn't resolve to the local ip of my webserver. I already tried to change the dns-entry in the settings manually, but it doesn't worked. Do anybody of you faced the same problem or has a good solution for my problem? ---------------------------------------------------------------------- vrgpy · 2023-10-29 17:01 Your DHCP server should give your dns server to the devices in your lan. It would also help if you block external dns querys (blocking port 53 connections exiting your lan). Also, block known DoH IPs because most browsers now have support for DNS over http. ---------------------------------------------------------------------- thekrautboy · 2023-10-29 17:06 > but it doesn't worked So many details. Android is well known of often sneaking in the Google DNS servers (8.8.8.8 and 8.8.4.4 for IPv4) if you only enter one DNS server in the network options of your WLAN. Place your own DNS into both fields. Some Android ROMs complain then that they are identical, in that case try to enter 127.0.0.1 for example as one, if that also doesnt work then just make up another IP that fits your network. It will send requests into nowhere but since the other one is working, it doesnt matter much. A lot of Android ROMs also have "Private DNS" enabled by default. Disable that, it might be the reason its bypassing your local DNS (Pihole, Adguard Home, whatever). /r/Android and /r/HomeNetworking can help. ---------------------------------------------------------------------- TheBrones · 2023-10-29 17:10 Is it a Google pixel device? https://support.google.com/pixelphone/thread/139593141/local-dns- resolution-suddenly-stopped-working?hl=en On my pixel 7 pro it is also not working yet, the only solution is to use an existing tld. ---------------------------------------------------------------------- vrgpy · 2023-10-29 17:14 Your DHCP server should give your dns server to the devices in your lan. It would also help if you block external dns querys (blocking port 53 connections exiting your lan). Also, block known DoH IPs because most browsers now have support for DNS over http. So, don't let your devices have a choice about this setting. ---------------------------------------------------------------------- lilolalu · 2023-10-29 17:24 I have the same issue with my xiaomi 12x, before with a OnePlus 5t, but I gave up on it. It's not a Google Pixel issue but in my observation a Google Chrome Issue. Firefox uses the DNS that DHCP defined for the devices, chrome ignores them and uses googles DNS. I don't know if that's "on purpose" or a bug, I find it pretty annoying - but what can you do... ---------------------------------------------------------------------- tech2but1 · 2023-10-29 17:57 Phones are a nightmare, like printers but more prevalent and more complicated! Several browsers I have used override default settings in the name of security/privacy/safety and the phones OS makes overriding this almost impossible to override manually. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-29 18:35 > chrome ignores them and uses googles DNS. I don't know if that's "on purpose" or a bug It's on purpose. DoH + certificate pinning basically means you can't use IP-hole ad-blocking. ---------------------------------------------------------------------- RydRychards · 2023-10-29 19:13 Did you disable secure dns in your browser? ---------------------------------------------------------------------- xTH13M0x · 2023-10-29 19:15 Ok thank you, do I need to use specific settings in firefox, because its still not working even with firefox ---------------------------------------------------------------------- lilolalu · 2023-10-29 19:18 I haven't done anything special with firefox. Did you check with dig or nslookup if your device is actually using your local DNS? ---------------------------------------------------------------------- watchdog_timer · 2023-10-29 19:19 It doesn't on my Android 10 phone. ---------------------------------------------------------------------- xTH13M0x · 2023-10-29 19:25 It works with the samsung browser, idk why firefox dont work ---------------------------------------------------------------------- homemediajunky · 2023-10-29 19:47 A work around which we should not have to do is using a DNS changer. [this DNS changing app for android](https://play.google.com/store/apps /details?id=com.frostnerd.dnschanger) It basically sets an VPN session with yourself and uses whatever DNS you set it to use. Complete source is available as well. ---------------------------------------------------------------------- Ikebook89 · 2023-10-29 20:22 No. With a proper firewall you can also block outgoing traffic to UDP port 53. and block known DoH servers. At least that’s what I do. For IPv4 and IPv6. You can also redirect all that traffic to your own dns server. ---------------------------------------------------------------------- gold_rush_doom · 2023-10-29 21:40 It's most likely that Private DNS is enabled. I don't have this issue with my Pixel. ---------------------------------------------------------------------- ButCaptainThatsMYRum · 2023-10-30 00:25 I went through all the troubleshooting steps for this a while back. The only thing that was successful was to set up a NAT rule to direct ALL UDP 53 traffic to the server (pfSense). After that it's been great, but otherwise my phone simply would not give two darns about my DHCP's dns settings. ---------------------------------------------------------------------- ButCaptainThatsMYRum · 2023-10-30 00:27 Commented with my fix; in pfSense I have all port 53 traffic redirected with a NAT rule. Works great and catches any devices with hardcoded DNS. ---------------------------------------------------------------------- bobd607 · 2023-10-30 02:04 That doesn't completely work - you need to block port 853 udp (dns- tls) and some well known dns-over-http to completely avoid the workarounds apps do. ---------------------------------------------------------------------- ButCaptainThatsMYRum · 2023-10-30 02:06 Yeah there's more to it than just 53, but that's the vast majority of traffic. ---------------------------------------------------------------------- ExoWire · 2023-10-30 07:31 I had a similar problem. Solution was to deactivate IPv6 support in the routing device. ---------------------------------------------------------------------- Unable-University-90 · 2023-10-30 18:02 This doesn't do it for all Android devices, though it may have just been a Chrome on Android issue. I had a guest bring a phone into the house which completely ignored the DNS servers it got in DHCP, even though access to external DNS servers was blocked. ---------------------------------------------------------------------- vrgpy · 2023-10-30 18:23 Any device configured for dhcp should follow the advertised configuration. But you can manually override the dns setting in the connection configuration if you want. A recent issue is that new versions of the browsers are coming with DoH support, and they can try to use it depending on how it's configured. This happens with some applications as well. So, to avoid this, I block known DoH servers to force browsers and applications to use the local dns server. ---------------------------------------------------------------------- redditor111222333 · 2023-11-08 23:26 How do you get a valid let's encrypt cert with a private tld? ---------------------------------------------------------------------- thekrautboy · 2023-11-08 23:38 You cannot. > And finally, you should not use real domains in your home network in that way, like example.com. Use specifically assigned TLDs for that, such as example.private example.home example.lan etc. **And if you want to use valid SSL certs from Lets Encrypt for example, you also dont need to buy any domain for that, you can use them with a free subdomain from the likes of www.duckdns.org www.dedyn.io nic.eu.org etc.**