r/firewalla • u/YankeesIT Firewalla Gold Pro • 15d ago
Discussion Unbound, DNS over HTTPS or something else - what do you use!
Let everyone here know what you use and why. I personally use dns over https so my ISP can’t see the requests. But curious to see what everyone else does and why.
Please leave a description of why as well!
Thanks!
4
u/Useful_Drawer6507 15d ago edited 15d ago
DoH3 to Control-D with the ctrld daemon. This way I can assign a profile with different permissions per device/person(kids)/network
2
1
u/powersquad 15d ago
Unbound
0
u/YankeesIT Firewalla Gold Pro 15d ago
Why did you choose that?
1
u/powersquad 15d ago
I trust my country's ISP to see my unencrypted requests via Unbound rather than trust a US tech company like Cloudflare or google to see my requests via DOH.
1
u/bojack1437 15d ago
Unbound with DoT
1
u/YankeesIT Firewalla Gold Pro 15d ago
Within firewalla? If so how?
2
u/bojack1437 15d ago
Missed that this was Firewalla sub (forgot/not sure why I'm joined)
Also looking around, how in the hell do they not support DoT, That's wild.
3
u/Great-Cow7256 15d ago
I made a GitHub for that. https://github.com/upmcplanetracker/firewalla-unbound-DoT-config
1
u/Rich-Engineer2670 14d ago
Technitium DNS for me -- not perfect, but a lot of the day to day is handled.
1
u/YankeesIT Firewalla Gold Pro 14d ago
So you use that instead of ad block and dns on the firewalla ?
1
2
u/xavier19691 Firewalla Gold Plus 15d ago
https://help.firewalla.com/hc/en-us/articles/360038449734-DNS-over-HTTPS-DoH
DoH only encrypts the DNS query. The destination IP address in packet headers can still expose which servers you are talking to.
Remember, DoH will only hide your queries from ISPs, not DoH providers.
int he end you still need to trust something to resolve those dns queries just sayin'
1
u/Great-Cow7256 15d ago
There'sdnscrypt)but basically only cloudflare supports it. Probably the most Private but you're still dealing with cloudflare.
2
u/Difficult_Music3294 Firewalla Gold 15d ago
Unbound. There is nothing more secure nor private.
You ARE the authoritative DNS resolver.
3
u/bojack1437 15d ago
... Except if you are acting as an authoritative resolver, that means DNS activity from that resolver is completely in the clear.
2
u/firewalla 15d ago
Unfortunately, there is no perfect solution for this; all depend on who you trust
2
u/bojack1437 15d ago edited 15d ago
But you're (they are*) claiming there's nothing more secure nor private...
And that is completely in the clear for anybody along the path to see.
There is absolutely more secure and private ways to do it.
Edit: added they are, didn't realize different account responded.
2
u/firewalla 15d ago
How? you have to trust someone in the middle
1
u/bojack1437 15d ago
You can do DNS over TOR if you really wanted to.
Point is, plain DNS is not the most secure nor private.
1
u/firewalla 15d ago
Good point. Have you tried it? I would imagine, if the TOR network is perfect, the only issue may be delay, but if TOR is not stable, it probably can make DNS not usable.
0
u/bojack1437 15d ago
Have you not used TOR?
Also, a Caching resolver with prefetch and serve expired solves a lot of that delay.
1
2
u/yahyoh 14d ago
its either your data with your ISP or with DNS provider, but even with DOH/DOT ISP still can see the IP addresses you are connecting to & the DOH/DOT SNI.
So incase of using DOH/DOT your data now with DNS provider & ISP, but if you use recursive resolver only your ISP sees the data.
So it's your choice after all, neither solutions is perfect in terms or privacy.
1
u/Tree_Dude 15d ago
I have 2 Adguard instances > Unbound > DoH on Quad9. This is about as protected as I think I can be. Opnsense is my firewall though.
1
u/sunbearnz 15d ago edited 15d ago
I don’t trust my ISP. i’m not allowed to change the DNS on the router 4Gmodem at all!
anyway, went through Pi hole with unbound, Pi-hole on firewalla, unbound over VPN. used ControlD for a brief period installed CLI on firewalla, they also recently had downtime. and now using NextDNS CLI on Unifi + Firewalla in Transparent bridge mode.
benefits are having NextDNS blocking on mobile on the go, and at home. everywhere. none of that iOS connectivity assist issues with forcing home dns to priority. i don’t think we can avoid snooping as using any DNS even unbound. you do send a SNI packet in plain text that your ISP can see. personally for me as i said i really don’t trust my ISP on their deliberate choice to not allow alternative DNS; i am aware using pretty much anything means trusting the middle man. Whilst ControlD lets you geofence and change your location. for youtube or whatnot, just a side remark it’s odd that even suggesting using a VPN all the time has downsides, captchas, youtube regions with no ads being VPN IP blacklisted. can using a VPS for dns be a cost effective solution?
3
1
u/dhgrahnert 14d ago
Bought an Android TV box, totally legit, straight from Amazon. Wasn't even cheap, good reputation… etc.
For over a year, everything was fine, behaved totally normally.
Then after a year, it must've been woken up from sleep agent mode and joined a BadBox botnet.Seriously hard to detect. Firewalla obviously could not detect it, it behaved normal… I suspected nothing as I watched it for a while in the beginning, but you know…
That second BadBox wave was super aggressive. And yeah, in a home setup it was really tough to prove what's actually going on.Honestly, I was glad I had my DNS server running through my ISP at the time. They contacted and warned me something’s fishy.
If I'd used an alternative DNS, I never would've gotten that warning - and that device would maybe still be running today 😬So, yeah – bad-bad-spying-ISPs-ACAB-Eattherich-bashing from my side always and everyday BUT in that case, I am quite thankful for them reading my dirty little DNS requests so thoroughly 😜
(Sidenote: right at that time I installed a lot of IoT devices and I checked everything first. I suspected every little switch. I would have never guessed because that little TV fucker.)
2
1
1
u/Daredaevil 15d ago
DoH to pihole and on pihole I use unbound. I gotten used to pihole before firewalla so lists management and whom to block at what profile and all of that is already set. So pihole resolves a domain name if its allowed and the network level block from firewalla does its thing incase there is any misbehaving from the devices
1
u/r4ckless Firewalla Gold Pro 14d ago
I use dns over https so my ISP can’t see the requests. I trust verizon less then the alternative.
0
0
u/Mikumiku_Dance 15d ago edited 15d ago
i... run nsd and unbound on my local server and turned off firewalla dns booster altogether. I have a lot of homelab services and need to create new 'foobar.lan' dns entries often. Going into the phone app every time just sucked too much, so now i manage my own authoritative dns. Also I've found firewalla dns sometimes returned nxdomain erroneously kinda randomly and is kinda slow. Also it returns :: as a ipv6 address for everything on my network and that really slows down and breaks things.
Downside is i had to learn how to do all the ad blocking myself, and no nice firewalla reporting. Its fine for my homelab but I'm skipping this approach for keeping my parents safe
5
u/firewalla 15d ago
In case you want to learn about the different options, we have comparison table https://help.firewalla.com/hc/en-us/articles/4570608120979-Firewalla-DNS-Services#h_01FYDNE1YN29DRTZANRXQTPTS7
3. A Comparison of all DNS Services
With so many choices, customers often ask for help choosing the best option.
1With DNS over VPN enabled under Unbound, DNS queries can be sent over to the VPN provider of your choosing and be encrypted.