Custom DNS over TLS

Technical Support for Routers VPN, DNS, Leaks
1

Hello!

I have an already set up adguard home public server, I would like then to use my custom DNS over TLS/https/quic but only today I noticed there are only nextdns and cloudflare as options, I find this unbelievable and there must be a way to choose the DNS servers I want
Sadly I didn’t manage to find this
Am I losing something? Thank you all

2

You’re not losing it. I raised that as a feature request some while ago. Until then, a symlink will do what you need:

root@GL-AXT1800:~# ll /etc/dnscrypt-proxy2/dnscrypt-proxy.toml
lrwxrwxrwx    1 root     root          40 Jul 13 12:41 /etc/dnscrypt-proxy2/dnscrypt-proxy.toml -> dnscrypt-proxy.myDohDnsProvider.usa.toml
1 Like
3

As first thank you for your input
I have to say I m not using dnscrypt and the only thing I have is the URL subdomain.domain.com
I also tried editing stabby but did not manage… how would I create this sym link not having any file? Thank you
And if I can I understood you use something else instead of adguard may I ask you what?

4

I use DeCloudUs via DOH (hence dnscrypt-proxy2). 12.00USD/year, non logging by default, unlimited devices, optional per-profile logging. Stubby, DNSCrypt-Proxy, DNSSEC supported. I’ve used Stubby for DOT until moving to DOH.

I can post a conf for you to template from if you wish.

1 Like
5

oh i’ll see thank you! But for now how can i write my url into a stubby conf :gl_emoji_confused:?

6

image
image535×820 14.4 KB

thats all i have in the stubby file on my router

7

agree this needs to be addressed, editing stubby is not a good solution.

see Slate AX custom DOH/DOT dns servers

1 Like
8

Thank you for this guide, I understood I have to see the ip from adguard guide but I have a localhost address and a 172.28.xx.xx I think this last one is a private one
Now maybe this happens because my Adghome is dockerized but on my android phone I managed just by putting the URL (no address, no ports), maybe I have to put the public IP address of the vps in stabby and not this one here? :sweat_smile:

Screenshot_20230808_164203_Samsung Internet
Screenshot_20230808_164203_Samsung Internet1080×1891 191 KB

Anyway to me is unbelievable this feature is not available nor in glinet Fw nor in luci

9

Well, it may not be much but here’s a copy of my stubby.yml when I was running DOT. I switched to DOH as it’s harder (if not near impossible) to block than DOT’s requirement of an open port 853 when it comes to hostile networks:

#NOTE: See '/etc/stubby/stubby.yml.default' for original config file and descriptions

resolution_type: GETDNS_RESOLUTION_STUB

dns_transport_list:
  - GETDNS_TRANSPORT_TLS

tls_authentication: GETDNS_AUTHENTICATION_REQUIRED

tls_query_padding_blocksize: 128

edns_client_subnet_private : 1

round_robin_upstreams: 0

idle_timeout: 60000

listen_addresses:
  - 127.0.0.1@53535
  -  0::1@53535

upstream_recursive_servers:

## DeCloudUs Custom DNS Locked IPv4 (USA)
  - address_data: 173.234.30.187
    tls_port: 853
    tls_auth_name: "[redacted].decloudus.com"

# ## DeCloudUs Custom DNS Locked IPv4 (Germany)
#  - address_data: 78.47.212.211
#    tls_port: 853
#    tls_auth_name: "[redacted].decloudus.com"

## DeCloudUs Custom DNS Locked IPv6 (Germany)
#  - address_data: 2a01:4f8:13a:250b::187
#    tls_port: 853
#    tls_auth_name: "[redacted].decloudus.com"

Perhaps you should ping @beniamin ; he seems to state having some experience w/ OpenWrt & dockerizing AdGuardHome:

1 Like
10

Wish I could help, but No real experience with TLS/https/quic.

My AGH was standard DNS. I kept it simple. Upstream was cloudflare.

1 Like
11

maybe the option would be having both tls and https since sadly android phones support only DoT

12

they also support DoH but only when google says so (currently only for google and cloudflare)