Hacker News Reader

Comment by yumraj | Hacker News Reader

> DNSCryptProxy -> Great for ensuring all DNS requests on the network via DNS over HTTPS. Kind of useful because frankly ISPs are sniffing DNS traffic. Also useful for bypassing DNS based ISP filters.

If you're using PiHole, you can just use cloudflared to do DoH. https://docs.pi-hole.net/guides/dns/cloudflared/

On a different note, biggest reason I've never installed a VPN at home is because I just prefer a deny-everything home network and worry I'll misconfigure something and cause a security issue.

View on HN

I use DNSCryptProxy because I can use it with Firefox as a local TRR server, supports additional filtering, supports DNSCrypt and ODoH caching and is open source.

It also picks from 140 or so anonymous DoH relays, with specifics for nologs and dnscrypt support.

Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140?

I also think the latter point is a bit overblown. So long as you keep your kernel updated and you only expose a single high UDP port, it should all be fine. I have ufw enabled on each pi, along with various logging mechanisms in place to see if things seem reasonable. That and 2fa for actual ssh access.

> Why would I go for just 1 arbitrary provider rather than the lowest latency choice out of 140?

Because a ISP that can compromise any one of those 140 different single points of failure can now make that one have the lowest latency and give you malicious DNS results just like you never secured anything.

This is the same problem as allowing 140 different CAs to issue certificates for subdomains of com, rather than forcing the fucking registry to do it when you get a domain name in the first place.

https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Configuratio...

>minisign_key is a public key, used to verify that the content is legitimate. Lists can thus be served from any location, even from an untrusted ISP: dnscrypt-proxy will immediately detect and reject something that has been tampered with.

>https://dnscrypt.info/stamps-specifications/ >https://dnscrypt.info/faq

An ISP will not be able to spoof the sources or these stamps. They wouldn't put the effort in. Even if they did, it is factored and thought about.

More harmful would be a malicious DoH relay but I trust the devs.That I think is fixed by mandating the use of DNSSec too for my relays.

YMMV but I’ve noticed that cloudflared has stability issues over time whereas dnscrypt has been rock solid for me (I run both on different systems). Probably going switch everything to dnscrypt esp since it supports odoh now.

cloudflared service itself has been running fine. If there were other issues, such as connectivity, then I don't know. Didn't experience any.

OTOH, I'm beginning to migrate to pfsense and pfblockerng at home. So, it is possible that I may retire my pi-hole at some point. Currently I'm running both as I transition and test.

I migrated away from cloudflared to dnscrypt-proxy because cloudflared didn't start up properly for me. On each reboot I had to manually stop and start it otherwise it was flooding the logs with failures. It was a bit weird and frustrating to diagnose.

Reply on news.ycombinator.com