DNS Outside the House reddit / selfhosted ---------------------------------------------------------------------- trancekat · 2023-12-01 17:04 Hi all. I am a happy self hoster. I have 3 DNS in my home (redundancy) that block about 600k in ad/tracking/spam domains. When I am out of my home, I VPN back in to enjoy garbage free web browsing. Works great... Except not everyone in my house is technically savvy and don't understand vpn. Is the best solution to proving that ad blocking feature: buy a VPS and host a 4th DNS that can be accessed from anywhere? Are there other solutions to consider, please? Thank you. ---------------------------------------------------------------------- thekrautboy · 2023-12-01 17:29 > Is the best solution to proving that ad blocking feature: buy a VPS and host a 4th DNS that can be accessed from anywhere? Absolutely **do not** run a open DNS resolver. If you dont want to use clientside software like a VPN to connect to a private DNS, then consider less selfhoted solutions like NextDNS, OpenDNS, etc. ---------------------------------------------------------------------- trancekat · 2023-12-01 17:34 Thank you for the response. I am fine using vpn, but not everyone in my home is. I don't want to ruin an open DNS. I didnt want to assume that the VPS solution was the right one, but if it is, my next question was around restricting acres to the VPS DNS. Basically I want to ruin my own NextDNS just due my family. ---------------------------------------------------------------------- thekrautboy · 2023-12-01 18:09 > I am fine using vpn, but not everyone in my home is. Yes i understood that, thats why i mentioned clientside software. > I don't want to run an open DNS resolver either. I didnt want to assume that the VPS solution was the right one, but if it is, my next question was around restricting acres to the VPS DNS. Basically I want to run my own NextDNS in a VPS. Is that an option? NextDNS itself, not afaik. And im not aware of similar things. You could of course run a open DNS resolver **IF** you set it up correctly for that purpose. Small scale solutions like Pihole or Adguard Home typically lack these features. Maybe with Pihole you could do some tweaks since it uses dnsmasq underneath and that is quite capable. Try asking /r/Pihole if maybe someone has recommendations for such tweaks. Other software like [Technitium](https://github.com/TechnitiumSoftware/DnsServer) and [blocky](https://github.com/0xERR0R/blocky) and of course bigger things like PowerDNS etc. On top to "tuning" the DNS itself you probably also should set up the VPS itself correctly, add things like fail2ban, CrowdSec etc. Especially rate-limiting things etc. But the TL;DR and my recommendation is: Do not run any open resolver. If your friends and family want to make use of your Pihole for adblocking, either teach them to connect to it through a VPN, or use for example a Tailscale subnet router which permanently can router the DNS through the Tailscale VPN, without the users having to enable any VPN clientsoftware themselves. Basically, network-based VPN instead of software running on client devices. ---------------------------------------------------------------------- kumbaya_03802 · 2023-12-01 19:41 Why not use Cloudflare Zero Trust? You can create a network tunnel (no open port) & add your private network & DNS location to use an internal DNS resolver to connect to Cloudflare. If you have a network ad blocker (AGH or Pi-hole) you can use the private DNS as your upstream DNS server for your entire home network. You can use Cloudflare Zero Trust on mobile with the Cloudflare One app by creating a Zero Trust organization. Only clients with a certain domain email that you set for your organization can join your virtual network (one-time email activation). ---------------------------------------------------------------------- WiseCookie69 · 2023-12-01 20:02 I have my pihole exposed via DoH, which I'm using on my Apple devices via A custom profile. It doesn't support authentication, but the subdomain and the subpath are so cryptic, they're equally as good as basic auth. https://github.com/satishweb/docker-doh is the DNS Over HTTP Container Image in question. ---------------------------------------------------------------------- APIeverything · 2023-12-01 20:31 If you want to advertise internal services without opening yourself up to possible attacks without a vpn, I’d say you are in to a paid service. You are describing ZTNA to me. If you want a free option. You are going to need some sort of VPN. Tailscale is a good option. It allows for local DNS and exit nodes. ---------------------------------------------------------------------- thekrautboy · 2023-12-01 20:59 > but the subdomain and the subpath are so cryptic Excellent security! ---------------------------------------------------------------------- WiseCookie69 · 2023-12-01 21:02 Nobody will ever end up on nhjrytzgrq.example.com/k8tys3m7qa, especially since there's no A record pointing to it. So yeah. Perfectly valid. ---------------------------------------------------------------------- thekrautboy · 2023-12-01 21:04 Sure! ---------------------------------------------------------------------- Nuuki9 · 2023-12-01 21:18 I used to run Adguard Home, but wanted to address mobile devices. In the end I switched over to using NextDNS. It's been working well, and even allows me to map different VLANs to different profiles, so I can have different blocking rules for IoT devices (for example). ---------------------------------------------------------------------- hannsr · 2023-12-01 22:41 The bots will never find out. Never. 🤫 ---------------------------------------------------------------------- notlongnot · 2023-12-01 23:23 There’s also Nebula ---------------------------------------------------------------------- zakafx · 2023-12-01 23:30 this is the absolute \*shittiest\* logic. good luck! ---------------------------------------------------------------------- Outrageous_Plant_526 · 2023-12-02 01:21 I run dual pi-hole with NextDNS as my upstream. ---------------------------------------------------------------------- Tharunx · 2023-12-02 05:14 Wait, i heard cloudflare tunnels only transfer HTTP traffic (ssh , rdp too) but not DNS. Does DNS work this way by just 53 port on cloudflare tunnels ? ---------------------------------------------------------------------- kumbaya_03802 · 2023-12-02 06:38 Cloudflared tunnel is not the same as Cloudflared DoH that you install on Pi-hole. That one uses Cloudflare's public DNS resolver ([1.1.1.1](https://1.1.1.1), [1.0.0.1](https://1.0.0.1), etc.) on standard DNS port 53. Cloudflared tunnel runs through [port 7844](https://i.imgur.com/26I0bUJ.png) outbound connections only (so no need to forward port). You can connect an internal DNS resolver on this one. You can also set firewall policies & filtering rules via Cloudflare dashboard. I used them on my two Rasp. Pis running AdGuard Home without issues. The mobile connection on Cloudflare One VPN [is good](https://i.imgur.com/8iUTsvK.jpg) as well. The encryption penalty is not as bad as OpenVPN or Wireguard. Happened to run a VPN client on Asus RT-AC86U with Merlin before on those two. The encryption penalty esp. on OpenVPN even on routers with AES-NI is still high. Wireguard is slightly better but still not as fast as Cloud One Warp VPN. I'm sure those two VPNs are more secure but I'm fine with Cloudflare. I no longer use a centralized VPN at home so it's OK. ---------------------------------------------------------------------- Tecchie088 · 2023-12-02 14:45 You could use DoH (DNS over HTTPS), change DNS endpoint once in a while and monitor traffic for anything unusual. But if they aren't savvy enough to use VPN, that'll be even more complicated to set up, especially when changing endpoints. ---------------------------------------------------------------------- Tharunx · 2023-12-02 18:31 Thank you mate for the detailed info. This is helpful ---------------------------------------------------------------------- ProfessionalAd3026 · 2023-12-03 01:42 I run a WireGuard split tunnel that transparently connects if I’m not on my home network.