My network setup that prioritizes privacy reddit / selfhosted ---------------------------------------------------------------------- [deleted] · 2023-11-06 14:40 [removed] ---------------------------------------------------------------------- zfa · 2023-11-06 14:46 I'm gonna have to ask what you're modelling against with so much duplication and services kinda-sorta doing the same stuff. ---------------------------------------------------------------------- EndlessHiway · 2023-11-06 14:49 lol ---------------------------------------------------------------------- ElevenNotes · 2023-11-06 14:51 It seems like all of this could have been avoided by simply using your own resolvers. ---------------------------------------------------------------------- MisterSlippers · 2023-11-06 15:01 Seems super convoluted without additional context. ---------------------------------------------------------------------- the_naysayer · 2023-11-06 15:03 Yeah, but why? ---------------------------------------------------------------------- CrAzYmEtAlHeAd1 · 2023-11-06 15:17 Ok but where’s the dns? ---------------------------------------------------------------------- avocadorancher · 2023-11-06 15:30 Which brand of cameras did you go with to complement the privacy goals? ---------------------------------------------------------------------- Mr_Brightstar · 2023-11-06 16:05 Explain it to me like if I was a Boca Juniors fan. ---------------------------------------------------------------------- ElevenNotes · 2023-11-06 16:16 UVC G3 Flex ---------------------------------------------------------------------- mrmclabber · 2023-11-06 16:19 [But why?](https://media.giphy.com/media/s239QJIh56sRW/giphy.gif) ---------------------------------------------------------------------- Individual_Pin2948 · 2023-11-06 16:27 What a waste of time. LMFAO ---------------------------------------------------------------------- OkOk-Go · 2023-11-06 16:34 Not very private of you to post your setup ---------------------------------------------------------------------- Wixely · 2023-11-06 16:36 My notes based on no context: VPS3 seems pointless as it's described since it all goes to Mullvad. In DNS Stack, using google / cloudflare for DNS doesn't seem very privacy oriented. This whole setup looks like it creates more problems then it solves. ---------------------------------------------------------------------- OppositeFisherman89 · 2023-11-06 16:49 Google Nest cams ---------------------------------------------------------------------- AnApexBread · 2023-11-06 16:56 So basically you're just routing your network over a VPN and using encrypted DNS? Just in a super convoluted way. ---------------------------------------------------------------------- kitanokikori · 2023-11-06 17:01 DNS-by-mail would probably resolve faster ---------------------------------------------------------------------- poop_magoo · 2023-11-06 17:07 I'm willing to bet that it is super convoluted, even with context. I think this is a case where a design was created to implement a bunch of different things, instead of a design being created to solve the problem. ---------------------------------------------------------------------- VexingRaven · 2023-11-06 17:13 Trying to mix logical and physical, network and DNS, all together in one diagram will tend to do that. ---------------------------------------------------------------------- Starmina · 2023-11-06 17:31 Guessing that if you have problem it MIGHT be with DNS ---------------------------------------------------------------------- FallenFromTheLadder · 2023-11-06 17:34 >VPS3 seems pointless as it's described since it all goes to Mullvad. It sends all the traffic from the home network and the mobile devices to Mullvad protecting every device at the same time. It's not pointless per se. Obviously OP switched from letting their ISPs (land and mobile) to see their traffic to let Mullvad do it. Once OP knows it it's fine. ---------------------------------------------------------------------- scytob · 2023-11-06 17:35 Fun, project, nicely documented! VLANs are mostly pointless (yes I know this is a controversial opinion) if there is any form of connectivity between VLANs. Great boundary of control though (but not security), I hadn’t considered using VLANs as a way to have different controls for your kids - I think I like that idea in this case. IoT vlans mostly pointless (due to need to punch holes between vlans). One exception there - RJ45 ports outside your house for things like POE camera, in that case vlan makes total sense, infact highly recommend making its own physical segment where devices physically can only connect to an NVR. ---------------------------------------------------------------------- Daniel15 · 2023-11-06 17:41 Any camera that supports RTSP and ONVIF should be fine, since they can run entirely locally and you can block them from accessing the internet. Run a software NVR (Blue Iris, Frigate, etc) to record them. VPN into Home to see the cameras while away from home. I have a setup like that and also send notifications when someone is detected at the front of my house, using Home Assistant for the notification, using a persistent connection from my phone to my Home Assistant server so that the notifications aren't relayed via Google. ---------------------------------------------------------------------- vini55505 · 2023-11-06 17:43 Just... Why? ---------------------------------------------------------------------- reubenbubu · 2023-11-06 17:44 i have 2 piholes ---------------------------------------------------------------------- reubenbubu · 2023-11-06 17:47 DNS-by-bird, might we call it, PiGeonHole ? ---------------------------------------------------------------------- sampleCoin · 2023-11-06 17:47 lol ---------------------------------------------------------------------- Daniel15 · 2023-11-06 17:49 > IoT vlans mostly pointless (due to need to punch holes between vlans) I have all my security cameras on a VLAN and have it configured to allow connections from my regular VLAN into the camera VLAN, but don't allow connections out. I do that so the cameras are isolated but I can still connect to them from my desktop PC to configure them. That doesn't seem pointless to me. An IoT VLAN could be configured similarly. Allow connections in, but no connections out. ---------------------------------------------------------------------- scytob · 2023-11-06 17:56 This is the school of security I come from, it’s trivial for malicious apps to retag or intercept traffic. https://security.stackexchange.com/questions/1551/why-do-people-tell- me-not-to-use-vlans-for-security ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-06 17:56 Lol yeah honestly it would be Forward everything onto a DoT provider and point all your stuff at your DNS servers ---------------------------------------------------------------------- ImTheMarsMan · 2023-11-06 18:03 Wait, so all it does is proxy DNS? ---------------------------------------------------------------------- Frometon · 2023-11-06 18:09 That's a lot of efforts to just go through google & cloudflare ---------------------------------------------------------------------- scytob · 2023-11-06 18:21 To add to the link. It really depends on what level of threats one is trying to protect against. What most people post here and on homelab is no better than what can be achieved with pure subnetting on the same wire. For example in the case you presented - packets still flow from the camera to the PC - so \*if\* you are trying to protect against a malicious camera you just gave it a way to attack your PC and jump to the rest of the network. If one wants to stop the camera from getting to the internet - that can be done on a single subnet no vlan config equally as well - configure outbound firewall rules (yes there are ways for malicious apps to get around this, just like they can get around VLANs). Can a VLAN stop traffic storms and other non-malicious issues - absolutely, but only if one also remembers to have rate controls / bandwidth allocation on every switch for every vlan - otherwise a bad device can still consume all the bandwidth on the wire. If i have a device i can't trust i would never put it on a physical segment that had access to my production firewall. Way too much chance of a misconfiguration giving that device access. And in my case i don't actually want to protect against the camera, i want to protect against people plugging a device into the external RJ45 ports... My point is most home vlan configs are a fun plaything (and that's a good enough reason to implement them, who doesn't like playing and learning) and they provide traffic control and segmentation that can make understanding issues easier. They are not a boundary of security. Most people are confusing control with security. As i said in my OP, a controversial opinion, and its that, an opinion - because there is no such thing as secure - only 'secure enough' for a given set of expected threats, for most home users a single LAN with good firewall rules, IPS/IDS and AV on all end points is 'secure enough'. tl;dr all VLANs share the same physical medium with only a simple packet tag as a mechanism to separate traffic. ---------------------------------------------------------------------- mrmclabber · 2023-11-06 18:21 Even if you negate "security" of VLANs, it still keeps non-malicious shit off your network. Things like multicast traffic which would otherwise broadcast to other devices needlessly. Then it also keeps most people off that VLAN so they can't just stumble upon something they shouldn't see. It's a layer of the onion, you can debate how much "security" is there, but it's another layer that someone has to get through, it's definitely better than *not* having it. ---------------------------------------------------------------------- mrmclabber · 2023-11-06 18:25 This just tells me you don't understand the conditions required for retag attacks to occur. With most peoples labs at home most of the traffic should be on untagged ports. Most situations where people hop VLANs are misconfigured switches\routers, outdated firmware, or physical access to the switch. The very stackexchange article you posted goes over how a lot of the fear mongering over the points you mentioned are overblown. I feel like you just googled your position and grabbed the first article you saw and didn't actually read it. ---------------------------------------------------------------------- scytob · 2023-11-06 18:30 Multicast can also be controlled with other mechanisms. As i said i come from a different school of thought - an onion model is only as good as its final critical control in the critical path. Too much of defense in depth has become 'security through obscurity - this is not an effective control. Having many layers doesn't actually imply good security and more layers doesn't imply more secure. I will bow out at this point, i am not here to convince you. ---------------------------------------------------------------------- scytob · 2023-11-06 18:31 oh i read it, many times, over many years ---------------------------------------------------------------------- ElevenNotes · 2023-11-06 18:41 You can resolve anything yourself, no need for any provider. ---------------------------------------------------------------------- mrmclabber · 2023-11-06 18:41 >Multicast can also be controlled with other mechanisms. So you are an advocate for putting random IoT and DMZ devices on the same network as trusted devices? >As i said i come from a different school of thought - an onion model is only as good as its final critical control in the critical path. That's not how the onion model works. If you have 5 layers of security, and everything falls apart if they can get to everything at layer 3, that isn't an onion, now is it? In my example, for someone to get in to my shit first they need to get through my firewall, then they need to get past my IPS, then they need to compromise my VM, then they need to either compromise my firewall itself or HOP vlans from either the DMZ or IoT vlan (over an untagged port) before they can get to any of my other personal devices. Tell me how i'm more secure if I just put all my devices on the same network? There's other pieces in there, but I tried to keep it simple for you. >Too much of defense in depth has become 'security through obscurity VLANs are not that. Fun fact, PCI compliance allows for VLANs to segregate terminal traffic from the rest of the network. >this is not an effective control. In and of itself. No, and literally no one preaches that. >Having many layers doesn't actually imply good security and more layers doesn't imply more secure. Never claimed it did. I'm saying VLANs are something that offer tangible, non-security benefits, as well as security benefits. Your "controversial opinion" isn't controversial, it's just flat-out wrong. >I will bow out at this point, i am not here to convince you. You haven't given a single argument for it, other than "VLANs can be hopped" and pointing to an article that refutes that very point. lol ---------------------------------------------------------------------- mrmclabber · 2023-11-06 18:43 So, you're telling me you can't read? Or is your entire "school of security" based on a random stackexchange article, and then you interpreted it completely wrong "many times, over many years?" lol ---------------------------------------------------------------------- mrmclabber · 2023-11-06 18:47 I was going to pick apart your post bit by bit, but your last statement summed it up beautifully. >tl;dr all VLANs share the same physical medium with only a simple packet tag as a mechanism to separate traffic. Tell me you don't know how VLANs work without telling me you don't know how VLANs work. 99% of my devices have ZERO knowledge they are on VLANs. ---------------------------------------------------------------------- gh057k33p3r · 2023-11-06 18:59 What did u use to create the diagram? ---------------------------------------------------------------------- Wixely · 2023-11-06 19:01 So why does he have a VPN to VPS3 first instead of directly to Mullavad? See VPN0 on the router. Even if the router can't do it, he can put Mullavad VPN on the phone separately. ---------------------------------------------------------------------- volthunter · 2023-11-06 19:07 This is a true schitzo hours post ---------------------------------------------------------------------- Nagraume · 2023-11-06 19:16 My guy's ping: Infinity ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-11-06 19:17 Privacy? You are using services run by Google and Cloudflare. Lol. ---------------------------------------------------------------------- dylangutt · 2023-11-06 19:24 Yeah I fail to see the point in this ---------------------------------------------------------------------- scytob · 2023-11-06 19:28 I posted it because it is a good exploration of the issue and perspectives. I am able to understand there are different perspectives. You seem unable to do that but hey revel in your over confidence. As for the school of security I was trained by GCHQ. Maybe that’s why US govt networks keep getting breached and UK ones don’t…. ---------------------------------------------------------------------- FallenFromTheLadder · 2023-11-06 19:32 Because in that case they would not have the internal DNS served to the mobile devices. They cannot use the Mullvad client on the phone directly. ---------------------------------------------------------------------- scytob · 2023-11-06 19:35 I never said what your devices do or don’t know. If a malicious device is on a port that receives multiple vlans then that malicious device can see all vlans if it wants to. You over confidence in your knowledge is amusing. Have fun. ---------------------------------------------------------------------- at_physicaltherapy · 2023-11-06 19:37 How do you do that? ---------------------------------------------------------------------- min_effort_420 · 2023-11-06 19:56 So, rather than continue to discuss it, you make a comment, then block me so you try to come off superior? What a snowflake. https://imgur.com/a/2C4EBNK >I posted it because it is a good exploration of the issue and perspectives. And nearly all of them agree, VLAN hopping is overblown and that newer switch software mitigates many attack vectors. The point was proper switch config mitigates much of the risk. It's also worth noting that the post is 11 years old, and I'm sure a security guru like yourself can understand that basing security posture on where the world was 11 years ago is error prone. >I am able to understand there are different perspectives. Only you can't. You're WHOLE basis of VLANs aren't secure is because you think everyone is running around providing trunk ports to all their clients. lol >You seem unable to do that but hey revel in your over confidence. My confidence is earned, unlike yours. I'm using facts, you are propping up your argument with strawmen. >As for the school of security I was trained by GCHQ. LOLOL. I'm going to call bullshit on that, and even if you were, that doesn't mean jack shit if you're point is wrong. It's just an appeal to authority. Did "GCHQ" teach you how to "own redditors" by responding to them, calling them out, then blocking them so they can't respond too? >Maybe that’s why US govt networks keep getting breached and UK ones don’t…. LOLOLOLOL, just when I thought your credibility couldn't be lower. Yea, the UK has never been hacked. https://www.reuters.com/world/uk/uk-electoral-commission-says-it-was- targeted-by-hostile-actors-cyberattack-2023-08-08/ https://therecord.media/britain-gchq-2003-hack-espionage-revealed https://www.cshub.com/attacks/news/uk-government-ministers-vulnerable- to-cyber-attacks https://www.theguardian.com/technology/2023/jun/18/whitehall-wide- open-to-cyber-attack https://sputnikglobe.com/20230812/uk-government-concealed-hacks-of- servers-in-2021-due-to-embarrassment--reports-1112554173.html ---------------------------------------------------------------------- min_effort_420 · 2023-11-06 19:56 So, rather than continue to discuss it, you make a comment, then block me so you try to come off superior? What a snowflake. https://imgur.com/a/2C4EBNK >I never said what your devices do or don’t know. That's important, because it means it's an *untagged* port. Passing tags wouldn't do anything. >If a malicious device is on a port that receives multiple vlans then that malicious device can see all vlans if it wants to. No shit. So you're saying that VLANs "aren't secure" because you think everyone is providing trunk ports to all of their devices? On what planet would you provide a TRUNK port to an IoT device? This isn't common, EVEN amonst VLAN "newbies." The vast majority of people are using untagged ports. You are literally taking the WORST practice on the planet and using that as a prop to say "VLANs aren't secure." It just makes my point, and the point of others on that stack exchange, that *improper config* can make them insecure, but VLANs DO provide a level of security. Should they be your only security? Fuck no. Thanks for making it even more abundantly clear that you know jack shit about proper VLAN configurations. ---------------------------------------------------------------------- Sohex · 2023-11-06 20:13 This is it. Real life has finally exceeded the potential of the shitpost and the circlejerk. We're all trapped in a hell wherein this person's network is real and we all have to live with that. ---------------------------------------------------------------------- paradoxally · 2023-11-06 20:14 No setup is private if you have Google. ---------------------------------------------------------------------- nibbl0r · 2023-11-06 20:15 >For example in the case you presented - packets still flow from the camera to the PC - so \*if\* you are trying to protect against a malicious camera you just gave it a way to attack your PC and jump to the rest of the network. This is to ridiculous. You are absolutely right that there are attack vectors that would enable this attack. Yet, by putting the cam in a VLAN OP eliminated like 99.9% of the possible attack vectors, which is a huge win. Security is never black and white. It's about possibilities and managing those. Just because you can't reach 100% does not mean you stop at 0. I was about to comment on your silly exchange with u/min_effort_420, but the nonsense you spill here is even funnier :D ---------------------------------------------------------------------- nibbl0r · 2023-11-06 20:16 >To add to the link. > >It really depends on what level of threats one is trying to protect against. What most people post here and on homelab is no better than what can be achieved with pure subnetting on the same wire. > >For example in the case you presented - packets still flow from the camera to the PC - so \*if\* you are trying to protect against a malicious camera you just gave it a way to attack your PC and jump to the rest of the network. > >If one wants to stop the camera from getting to the internet - that can be done on a single subnet no vlan config equally as well - configure outbound firewall rules (yes there are ways for malicious apps to get around this, just like they can get around VLANs). > >Can a VLAN stop traffic storms and other non-malicious issues - absolutely, but only if one also remembers to have rate controls / bandwidth allocation on every switch for every vlan - otherwise a bad device can still consume all the bandwidth on the wire. > >If i have a device i can't trust i would never put it on a physical segment that had access to my production firewall. Way too much chance of a misconfiguration giving that device access. And in my case i don't actually want to protect against the camera, i want to protect against people plugging a device into the external RJ45 ports... > >My point is most home vlan configs are a fun plaything (and that's a good enough reason to implement them, who doesn't like playing and learning) and they provide traffic control and segmentation that can make understanding issues easier. They are not a boundary of security. Most people are confusing control with security. > >As i said in my OP, a controversial opinion, and its that, an opinion - because there is no such thing as secure - only 'secure enough' for a given set of expected threats, for most home users a single LAN with good firewall rules, IPS/IDS and AV on all end points is 'secure enough' as when one adds complexity one add failure points of easy mis-configuration, which is usually at the root of most secuity breaches. > >tl;dr all VLANs share the same physical medium with only a simple packet tag as a mechanism to separate traffic. u/scytob ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-06 20:26 Point straight at the root name servers I guess ---------------------------------------------------------------------- liotier · 2023-11-06 20:47 Especially as Unbound is already in the picture. ---------------------------------------------------------------------- NerdyNThick · 2023-11-06 20:50 > Maybe that’s why US govt networks keep getting breached and UK ones don’t…. You would be better off doing a bit of research before posting [easily debunkable lies.](https://www.gov.uk/government/statistics/cyber- security-breaches-survey-2023/cyber-security-breaches-survey-2023) > As for the school of security I was trained by GCHQ. No you weren't. ---------------------------------------------------------------------- Adeel_ · 2023-11-06 21:11 Wtf is this… ---------------------------------------------------------------------- stappersg · 2023-11-06 21:17 /u/elusiveporcupine when you have time _What tool did you use to create the diagram?_ ---------------------------------------------------------------------- TinoOG · 2023-11-06 21:43 did not even elaborate, OP you’re a chad ---------------------------------------------------------------------- ElevenNotes · 2023-11-06 21:46 Run BIND in resolver mode. ---------------------------------------------------------------------- Edianultra · 2023-11-06 21:52 Unbound is a good one. It’s the default resolver with pfsense(by default I mean, when you enable dns resolver) PiHole + unbound is also very common. ---------------------------------------------------------------------- at_physicaltherapy · 2023-11-06 21:52 I've ran bind so that I could resolve my own custom TLD and any other addresses I maintained. But, for public dns, I still had to have it forward or recursively resolve using a public name server (eg a root name server, or some public resolver like Google). How do have bind resolve public addresses without any use of any public name servers? ---------------------------------------------------------------------- 107269088 · 2023-11-06 21:55 Looks like an over engineered hot mess ---------------------------------------------------------------------- ElevenNotes · 2023-11-06 21:56 By not using forwarders but setting the "." zone to the internet root servers. You can check [my BIND image](https://hub.docker.com/r/11notes/bind) on how to do that. ---------------------------------------------------------------------- speedbrown · 2023-11-06 22:01 Brag about it whydontcha **/s ---------------------------------------------------------------------- evilgold · 2023-11-06 22:07 I really want to know who you're worried is spying on you and where those VPS are hosted. Really you've just widened your attack surface here because instead of having to target one well configured server there are now at least 3. Hopefully you're hosting the VPS in a country with good privacy laws. ---------------------------------------------------------------------- Wixely · 2023-11-06 22:12 Their router must not support VPN hosting, that would allow them to use their private DNS internal. I find that hard to believe because it's vlan aware so it's at least prosumer grade. ---------------------------------------------------------------------- FallenFromTheLadder · 2023-11-06 22:16 They can also be behind CGNAT. ---------------------------------------------------------------------- MisterSlippers · 2023-11-06 22:19 It seems you're writing off VLANs entirely by ignoring the conditions required for these attacks. A malicious app can go promiscuous and intercept traffic on the same broadcast domain. You would you limit the broadcast domain by properly setting access port modes and using VLANs or dedicated hardware. A malicious app can double tag traffic. How do you mitigate? Follow best practices from at least 15 years ago - e.g. set access port modes to access and disable DTP so attackers can't abuse DTP to spoof as a switch; make sure your trunk native VLAN is one not used by access ports, and force native vlan tagging to prevent double tagging. ---------------------------------------------------------------------- at_physicaltherapy · 2023-11-06 22:19 I think I misunderstood what you meant originally then. I thought when you said that you can resolve it all yourself "without any provider" you meant you could resolve it all locally without having to reach out to any 3rd party at all (ie not using root name servers either). I've set things up this way as well but didn't find it to be as secure or private as I wanted. I was hoping you had a better solution than what I ultimately came up with. ---------------------------------------------------------------------- Daniel15 · 2023-11-06 22:35 > packets still flow from the camera to the PC Only for established connections. > tl;dr all VLANs share the same physical medium with only a simple packet tag as a mechanism to separate traffic. I have a PoE switch just for my cameras, and most ports on the switch are configured to use the camera VLAN for untagged data, with no other VLANs enabled for those ports. There's no way for the cameras to connect to reach a different VLAN. ---------------------------------------------------------------------- Wixely · 2023-11-06 22:46 That's a good point, I think unlikely in this scenario though ---------------------------------------------------------------------- drpepper · 2023-11-06 22:51 all that to hide some horse porn ---------------------------------------------------------------------- Salt_MasterX · 2023-11-06 22:51 That’s the difference between someone who homelabs for function (like installing plex and never touching it again) and homelabs for learning (like someone looking to become a sysadmin) ---------------------------------------------------------------------- poop_magoo · 2023-11-06 23:00 Nah bro, Google and Cloudflare are the good guys. They run free DNS services out of the goodness of their hearts. They would never log all of these DNS queries and tie them back to me in order to profile my internet usage habits. ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-11-06 23:03 It reminds me of a time when I got my first internet connection almost 20 years ago when I was pretty young and decided to install 6 different antiviruses, 2 anti spyware, 1 anti rootkit, 3 firewalls to be safe. I had to nuke my windows installation afterwards as I was barely able to log in and move the cursor. ---------------------------------------------------------------------- white_swan · 2023-11-06 23:08 Isn’t this too complex ---------------------------------------------------------------------- CAP_NET_ADMIN · 2023-11-06 23:08 OP can see the dong loading in real time. ---------------------------------------------------------------------- poop_magoo · 2023-11-06 23:08 I really don't understand why you don't just route all of your traffic through a VPN at the router level. This is an insane Rube Goldberg network. ---------------------------------------------------------------------- CoLuxey · 2023-11-06 23:21 No no they will never do that. No no 😂😂😂 ---------------------------------------------------------------------- UnrealisticOcelot · 2023-11-07 00:33 No, this is someone who is very paranoid and has a lot of free time. As a sysad if I had to deal with a DNS setup like this I'd be job searching. ---------------------------------------------------------------------- Adach · 2023-11-07 00:38 What is flamethrower? ---------------------------------------------------------------------- Adach · 2023-11-07 00:45 Everyone in the house complaining that the Internet doesn't work. ---------------------------------------------------------------------- iavael · 2023-11-07 01:08 Any recursive dns server does that. ---------------------------------------------------------------------- Sculptor_of_man · 2023-11-07 01:15 I mean 9 times out of 10 it's DNS anyways. ---------------------------------------------------------------------- iavael · 2023-11-07 01:16 All recursive name server does is querying authoritative name servers recursively (root -> tld -> 2nd level etc). You can setup you own recursive server or use public recursors like google/cloudflare that do same thing for you. Not querying root servers is impossible if you want to resolve names in ICANN TLDs. But recursive nameservers only ask root servers for TLD-serving authoritative nameservers. Latter ones are authoritative servers for root zone are not equivalent to public recursive servers. ---------------------------------------------------------------------- Salt_MasterX · 2023-11-07 01:18 Yes, thus my point, this isn’t done for function, it’s done for learning ---------------------------------------------------------------------- at_physicaltherapy · 2023-11-07 01:19 Thank you for that background; it's already well understood. As I stated in another post already, it appeared to me as if OP was claiming to be able to resolve domains without querying any external source and thus my question. ---------------------------------------------------------------------- ElevenNotes · 2023-11-07 02:18 DNS does not work without the root servers, you have to ask someone who is in charge of .com. ---------------------------------------------------------------------- kataflokc · 2023-11-07 02:36 Is this parody? ---------------------------------------------------------------------- mrmclabber · 2023-11-07 02:44 Leaning what? To do convoluted shit that is needlessly complex and can be done far simpler? There are much better ways to learn other than building convoluted things that are needlessly complex and will likely cause you headaches down the road. ---------------------------------------------------------------------- ryaqkup · 2023-11-07 03:36 Who's to necessarily say that this is convoluted and needlessly complex, other than you, twice apparently? What if everything here works perfectly and accomplishes what OP wants to get done? ---------------------------------------------------------------------- km_ikl · 2023-11-07 03:43 All I'm seeing is high-latency DNS requests. ---------------------------------------------------------------------- MisterSlippers · 2023-11-07 04:09 I could concede this argument to a degree, but there's a reason why KISS is a mantra. Unless you're labbing out some merger/acquisition where you're trying to wrap your head around something organically grown you can't just rip and replace, you're only learning bad habits by over engineering something like this. Again, context could insert my foot in my mouth, but throwing privacy and Google in the same sentence is kind of a tell ---------------------------------------------------------------------- mrmclabber · 2023-11-07 04:23 Just because something works, doesn’t mean it’s not overly complex or doesn’t meet “requirements.” KISS. https://xkcd.com/974/ ---------------------------------------------------------------------- Middle_Bike_5424 · 2023-11-07 05:22 What did you use to create that diagram? ---------------------------------------------------------------------- WgnZilla · 2023-11-07 06:33 >What did you use to create that diagram? I whoooole load of cocaine, I assume. ---------------------------------------------------------------------- PolicyArtistic8545 · 2023-11-07 07:55 Glad you enjoy DNS but a lot of this seems unnecessary. ---------------------------------------------------------------------- MrSliff84 · 2023-11-07 08:19 To name to prioritize privacy and use Google dns servers - even it's Dot - is a bit weird In my opinion. There are many good non-logging dns Servers out there which support Dot or Doh. ---------------------------------------------------------------------- mrkesu · 2023-11-07 08:49 Could you explain a little bit about which specific problems you were trying to solve? Or did you create it mostly for fun? I actually assume *fun* was the main goal here, but if it was not I would like to know a little bit more about the motive for some of this 😊 Also, with all these layers of security what made you go with google and cloudflare DNS servers in the end? I kind of miss doing "just for fun" projects. I remember when I was younger I would create overly complicated systems like this at home just for fun, while now I just want things to work 😅 ---------------------------------------------------------------------- mitchellcrazyeye · 2023-11-07 08:54 My information is protected by world-class security!!! ---------------------------------------------------------------------- lilolalu · 2023-11-07 08:56 This is very DNS obsessed. You don't have to use classical DNS at all, depending on your use case. There are p2p and Blockchain based name Resolution projects. I.e. https://github.com/mwarning/KadNode ---------------------------------------------------------------------- mitchellcrazyeye · 2023-11-07 08:57 Reposting OP's original explanation that was removed: The main objective of this is to anonymize as much traffic as possible, and where necessary, prevent the ability to differentiate between real and faked information. Every 600 seconds, Mullvad endpoints are randomly rotated by VPN1. Wirefan offers a rotating socks5 proxy that utilizes multi-hop proxies provided by Mullvad. Two DNS resolvers are available when connected to the VPN: Unfiltered or Adblocking. Unbound has the ability to resolve standard, OPENNIC and onion TLDs. In addition, supplying personalized domain names for the services hosted on the Nebula subnet. Accessing the VPN on a restricted network can be done using Wireguard over Websockets via CloudFlare. Noisy and Flamethrower are used to generate fake DNS/HTTP traffic. Unbound: https://github.com/NLnetLabs/unbound NSD: https://github.com/NLnetLabs/nsd Flamethrower: https://github.com/DNS- OARC/flamethrower Blocky: https://github.com/0xERROR/blocky DNSproxy: https: //github.com/Adguard Team/dnsproxy DNSCrypt-proxy: https://github.com/DNSCrypt/dnscrypt-proxy Anonymized DNS: https://github.com/DNSCrypt/dnscrypt-proxy/wiki /Anonymized-DNS Wirefan: https://codeberg.org/peterzam /wirefan Noisy: https://github.com/fireneat/Noisy Nebula: https://github.com/slackhq/nebula Wireguard: https://github.com/WireGuard WireGuard over Websockets: https://kirill888.github.io/notes/wireguard-via-websocket ---------------------------------------------------------------------- lilolalu · 2023-11-07 09:11 Besides cocaine, [draw.io](https://draw.io) is pretty good fot these types of diagrams, there is also a nextcloud plugin for [draw.io](https://draw.io). https://github.com/jgraph/drawio ---------------------------------------------------------------------- XChikuX · 2023-11-07 09:57 Love the wireguard fallback if cloudflare websockets fails. Have you considered using a different mechanism as a fallback instead? Especially since you don't have one on the VPS side. Eg. Twingate or Tailscale? ---------------------------------------------------------------------- Nondv · 2023-11-07 10:04 i swear some people here really do go all in haha ---------------------------------------------------------------------- SirLagz · 2023-11-07 10:10 Having an untrusted device on my single subnet means that it could potentially scan my subnet and attempt to compromise other devices with potential weak security. Put the untrusted device on it's own VLAN and block access to my subnet and that is now impossible. So tell me again, how is having VLANs not extra security? ---------------------------------------------------------------------- PhilipLGriffiths88 · 2023-11-07 10:58 If you are this security/privacy conscious, you should check out OpenZiti too - [https://github.com/openziti](https://github.com/openziti). It's a zero trust overlay network which can explicitly not 'listen' on the underlay across WAN, LAN, and even host OS network. This includes strong identity (x509), authenticate-before-connect, least-privilege, micro segmentation, deny-by-default, outbound-only connections, double encryption, obfuscating traffic through encrypting metadata, and more. I work on the project. ---------------------------------------------------------------------- CryptoGunNut · 2023-11-07 12:13 This is confusing to me and I’m supposed to be a networking guy, is there anywhere I can go to be a better understanding of these diagrams ---------------------------------------------------------------------- iggdawg · 2023-11-07 12:37 Been doing this for years. Stand up a local resolver, point it straight at the root servers. It's as self-hosted as you can get for DNS. ---------------------------------------------------------------------- enigmatic_bread · 2023-11-07 13:20 Kek and I thought my DNS over HTTPS (cloudflared with pi-hole) and VPN setup with Wireguard is complex enough xD ---------------------------------------------------------------------- jimheim · 2023-11-07 14:40 Sorry, they shut down the asylums. ---------------------------------------------------------------------- d_maes · 2023-11-07 14:45 Bro does all this effort, but can't be bothered to change 2 lines in unbound to do it's own resolving instead of relying on google and cloudflare. ---------------------------------------------------------------------- [deleted] · 2023-11-07 14:48 [removed] ---------------------------------------------------------------------- Deses · 2023-11-07 16:27 Are you OK? Do you need someone to talk to? ---------------------------------------------------------------------- account286 · 2023-11-07 18:23 Setting unbound to do its own resolving won’t change anything. It will still need to query the records. I guess you could send for example a hundred queries upstream per 1 request so your actual queries get lost in the noise. An actual good solution would be to use oblivious dns over https, where an encrypted dns query is sent to a proxy, which sends it to the dns server all over https. This way the proxy doesn’t know the dns query content and the dns server doesn’t know where the query came from. ---------------------------------------------------------------------- d_maes · 2023-11-07 18:40 It changes a whole lot, you are no longer sending your queries to cloud providers that are all about collecting data. ---------------------------------------------------------------------- artificialidentity3 · 2023-11-07 21:05 Two piholes is great. When one of mine crashed, I saw zero internet outage. ---------------------------------------------------------------------- Apart_Ad_5993 · 2023-11-07 23:37 I mean, do you hate your family? ---------------------------------------------------------------------- xVortex93 · 2023-11-08 03:09 What program/software are you using to draw that diagram? ---------------------------------------------------------------------- mendo1024 · 2023-11-08 06:03 Thank you for sharing this What a relieve I am not among the creaziest. ---------------------------------------------------------------------- OnceWeekDev · 2023-11-08 09:53 /u/elusiveporcupine: To make such diagrams I sometimes work with Google Draw, which I would like to avoid. Besides Google Draw misses this nice "bridging" of lines.. So please, let us know!! ---------------------------------------------------------------------- elusiveporcupine · 2023-11-08 12:22 It's mostly out of fun: learning new systems and ways to optimize them - after some minimal tweaking of the caches, the average processing time for DNS on the AdguardHome instances is 2ms. On the VPN side, it's attempting to replicate something similar to Cryptostorm's [deepDNS] (https://github.com/cryptostorm/cstorm_deepDNS) that interconnects multiple services in a transparent manner to the end-user. It also acts as my bastion host, which gives me access to my internal network and a private VPN which I can route multiple devices through bypassing Mullvad's five device restriction. On the Home vlan, Google and Cloudflare are not used for the main resolver. Unbound only uses them for specific domains: * Google is used for domains that benefit from EDNS, such as CDN providers; * For development reasons, CloudFlare is used with personal sites I'm hosting behind them. * The rest is transmitted to VPS(1 and 2) via Wireguard and then to DNSCrypt servers. * To minimize any tracking fingerprint, Flamethrower is used to poison traffic to Google and CloudFlare. Some users presume that the WireGuard connections tunnel everything, but they are mistaken. They are split. WAN0 continues to transmit the majority of traffic, with specific IPs being routed through VPN0. Again, to minimize any tracking fingerprint, Noisy is used to poison HTTP(s) traffic on WAN0. ---------------------------------------------------------------------- elusiveporcupine · 2023-11-08 12:39 For last resort redundancy, I have TOR hidden services bound to SSH. They don't require any opened ports, only the TOR daemon running. ---------------------------------------------------------------------- szatan-norakurczaka · 2023-11-08 12:58 Got a headache just looking at it. Some parts seem redundant. ---------------------------------------------------------------------- mrkesu · 2023-11-08 13:53 Thanks! It was a lot easier to read the diagram with this context added, cheers! ---------------------------------------------------------------------- [deleted] · 2023-11-08 18:45 [removed] ---------------------------------------------------------------------- francisapple · 2023-11-09 11:59 OP is diagnosed schizo ---------------------------------------------------------------------- poop_magoo · 2023-11-09 19:09 I guess if you just want to learn stuff, without any goal other than learning about the different pieces, then it is valid in that sense. If you are trying to learn how to implement systems in a reliable and maintainable way, this is the opposite of that. Assuming this is something that is actually being run in lab environment, that is actually used and relied upon, I guarantee this breaks fairly regularly. ---------------------------------------------------------------------- stappersg · 2023-11-12 09:09 What tool / program was used to create the diagram? ---------------------------------------------------------------------- falcorns_balls · 2023-11-12 15:13 LOL ---------------------------------------------------------------------- Competitive-Driver88 · 2023-12-18 12:45 He probably posted this while wearing a tin foil hat 🤣 His network latency is probably a joke 🤣 ---------------------------------------------------------------------- aggravatinghoden · 2023-12-30 18:40 This is definitely \*not\* private as long as you're using cloudflare. You might as well call an iPhone private, as long as you're not interested if Apple is listening in on you. Let alone google as DNS. That's real privacy, indeed!