Selfhosted AdGuardHome DoT public server? How to reduce risk of being abused? reddit / selfhosted ---------------------------------------------------------------------- LifeReboot___ · 2023-12-05 21:35 Picked up some cheap VPS during black friday, and decided to use one of them to run a DoT/DoH with AdGuardHome so that I can enjoy adblock wherever I go with my laptop and android phone. I've turned off port 53 and only intended to use 853 for DoT with my android (since it only accept DoT for private DNS), DoH is also only accessible via Cloudflare, with that being said are port 853 likely to be abused for ddos stuff like that? I recognize people might do port scan on 53 for insecure dns server, but not sure if DoT is fine, since they probably need to know the hostname as well isn't it? (I've also set rate limit within adguardhome settings) (Btw i dont want to use VPN) ---------------------------------------------------------------------- adamshand · 2023-12-05 21:59 My understanding is that any publicly accessible, recursive DNS server can be abused for amplification attacks. So yes, what are you doing could be exploited. I haven't done this, and I'm not sure if you can do it with AdGuard, but I belive it's possible to put DoH servers at a custom URL (eg. `/mysecretdns`). So long as your URL is unguessable and you don't publish it anywhere, that should be safe. ---------------------------------------------------------------------- Simplixt · 2023-12-05 22:06 Yes, you can setup an device identifier with AdGuard Home. Then create an Nginx Rule that only this custom URL with the random cryptic identifier can be opened. Still, I wouldn't do it. But at least a simple scanner will not find it. ---------------------------------------------------------------------- jusepal · 2023-12-05 22:21 Yep came to mention this. They've got a guide for that and I'm using it on my adguardhome setup. https://github.com/AdguardTeam/AdGuardHome/wiki/Clients ---------------------------------------------------------------------- thekrautboy · 2023-12-06 00:15 Do **not** run a open resolver. The end. ---------------------------------------------------------------------- berahi · 2023-12-06 00:21 >need to know the hostname as well By default it's still trivial to see the offered cert for domain `curl -v --silent https://1.2.3.4:853 2>&1 | grep subject:` replace 1.2.3.4 with your IP and it will still show your domain. >abused for ddos They can't abuse DoT for DDoS because * TCP packet verifies the sender. Unencrypted DNS is abused because, in UDP, the sender isn't verified before sending the reply. TCP doesn't do that * The response for TCP queries isn't exponentially larger than the request anyway. People might *still* scan for your IP and use it for their personal purpose, you can just blacklist their IP range. ---------------------------------------------------------------------- Financial_Astronaut · 2023-12-06 01:11 DNS amplification attacks only work over UDP (because you could spoof an IP). That’s not something that can be abused when using DoH. Not sure about other attack vectors. ---------------------------------------------------------------------- washapoo · 2023-12-06 01:30 Here you go. [https://adguard.com/en/blog/adguard-home-on-public- server.html](https://adguard.com/en/blog/adguard-home-on-public- server.html) ---------------------------------------------------------------------- WiseCookie69 · 2023-12-06 06:26 >I haven't done this, and I'm not sure if you can do it with AdGuard, but I belive it's possible to put DoH servers at a custom URL (eg. `/mysecretdns`). So long as your URL is unguessable and you don't publish it anywhere, that should be safe. Don't say that too loud. Just last weekend I got reamed and downvoted to hell for suggesting the same thing when it came to accessing a pihole instance from external.