Jump to content

DNS: Difference between revisions

From 太極
← Older edit
Brb (talk | contribs)
42,905 edits
Brb (talk | contribs)
42,905 edits
 
(25 intermediate revisions by the same user not shown)
Line 35: Line 35:
* [https://www.howtogeek.com/devops/how-to-buy-a-domain-name-for-your-website/ How To Buy a Domain Name For Your Website]
* [https://www.howtogeek.com/devops/how-to-buy-a-domain-name-for-your-website/ How To Buy a Domain Name For Your Website]


== A record ==
== A record (address record): IPv4 ==
* A records are used to map a domain name to an IP address and CNAME records are used to map one domain name to another domain name.
* '''A records''' are used to map a domain name to an IP address
* For example, "domain.com" is an A record, and "www.domain.com" is CNAME record which maps it to "www.domain.com".
* For example, "domain.com" is an A record (Pointing your root domain to a serve). '''Its value/target is an IP address (e.g., 203.0.113.50).'''
** Cf. "www.domain.com" is CNAME record which maps it to "www.domain.com".
* Use cases: Pointing your root domain (mydomain.com) to a server.
* Performance: Requires one DNS lookup.
* Limitation: No major limitations.
* [https://serverfault.com/a/1101393 What does '''@''' mean when setting up A Records in your DNS settings?]  '''Apex records''', '''naked domain'''
* [https://serverfault.com/a/1101393 What does '''@''' mean when setting up A Records in your DNS settings?]  '''Apex records''', '''naked domain'''
** When creating a new A record, using the host as ''' @''' means that the record is for the root domain itself. In other words, if your domain is “example.com”, an A record with '''@''' as the host would point “example.com” to the specified IP address. This is often used to direct traffic for the bare domain (i.e., example.com without any subdomains like www) to a particular server.
** When creating a new A record, using the host as ''' @''' means that the record is for the root domain itself. In other words, if your domain is “example.com”, an A record with '''@''' as the host would point “example.com” to the specified IP address. This is often used to direct traffic for the bare domain (i.e., example.com without any subdomains like www) to a particular server.
* [https://servebolt.com/help/how-to-set-up-subdomains-with-cloudflare/ How to set up subdomains with Cloudflare], [https://youtu.be/Y02t6hzaUBM?si=10HEB2Hk0fwWEzMP&t=560 免费开源论坛程序推荐！含搭建教程，手把手教你安装].
* [https://servebolt.com/help/how-to-set-up-subdomains-with-cloudflare/ How to set up subdomains with Cloudflare], [https://youtu.be/Y02t6hzaUBM?si=10HEB2Hk0fwWEzMP&t=560 免费开源论坛程序推荐！含搭建教程，手把手教你安装].


== CNAME ==
== CNAME: Alias ==
* A CNAME record is used to map one domain name to another domain name. For example, a CNAME record for "www.example.com" might map to "example.com". This is useful when you want to point multiple domain names to the same server.
* A '''CNAME record''' is used to map one domain name to another domain name. '''Its value/target is a fully qualified domain name (e.g., my-blog-app.netlify.app).'''
* For example, a CNAME record for "www.example.com" might map to "example.com". This is useful when you want to point multiple domain names to the same server.
* Use cases: Creating aliases for subdomains (www.mydomain.com, blog.mydomain.com).
* Performance: Requires at least two DNS lookups (one for the CNAME, one for the final A record).
* Limitation: Cannot coexist with other records for the same hostname. For example, a subdomain with a CNAME record cannot have an MX record for email or a TXT record. For this reason, you can't use a CNAME record for your root domain (mydomain.com) if you also want to receive email.
*  A CNAME record is used '''in lieu of''' an A record when a domain or subdomain is an '''alias''' of another domain. '''All CNAME records must point to a domain, never to an IP address'''. See [https://www.cloudflare.com/learning/dns/dns-records/dns-cname-record/ What is a DNS CNAME record?] For example, www.example.com is an alias of example.com.
*  A CNAME record is used '''in lieu of''' an A record when a domain or subdomain is an '''alias''' of another domain. '''All CNAME records must point to a domain, never to an IP address'''. See [https://www.cloudflare.com/learning/dns/dns-records/dns-cname-record/ What is a DNS CNAME record?] For example, www.example.com is an alias of example.com.
** Useful if we like to use our own domain name instead of a given long domain name (use as an '''alias'''). All the operation is in the domain registrar.
** An example: [https://youtu.be/YCSCtXcjsoc?si=i0JTnyiR6K97QdxQ&t=346 真正永久免费的容器！4核 CPU、8G内存、10G网络，无需绑卡，速度极快！搭建网站、部署AI、代理节点等爽歪歪！]


= DNSCrypt =
= DNSCrypt =
Line 51: Line 61:
* [https://www.linuxuprising.com/2018/10/install-and-enable-dnscrypt-proxy-2-in.html Install and Enable DNSCrypt Proxy 2 in Ubuntu 18.04 Or 18.10 / Debian Unstable Or Testing]
* [https://www.linuxuprising.com/2018/10/install-and-enable-dnscrypt-proxy-2-in.html Install and Enable DNSCrypt Proxy 2 in Ubuntu 18.04 Or 18.10 / Debian Unstable Or Testing]


= Network commands =
= DNS commands/clients =
* [https://www.linuxlinks.com/useful-free-open-source-dns-clients/ 15 Useful Free and Open Source DNS Clients]
** dog
** doggo
** q
** ddclient
** GoDNS
** dig
** dnslookup
** dness
** wig
** dyndnsc
** dnsupdate
 
* ping  
* ping  
* curl - [https://stackoverflow.com/a/15959628 ping alternative]. It is useful if the server blocks ping requests
* curl - [https://stackoverflow.com/a/15959628 ping alternative]. It is useful if the server blocks ping requests
Line 68: Line 91:
* [https://opensource.com/article/17/4/introduction-domain-name-system-dns Introduction to the Domain Name System (DNS)]
* [https://opensource.com/article/17/4/introduction-domain-name-system-dns Introduction to the Domain Name System (DNS)]
* [https://linuxconfig.org/protecting-your-privacy-with-firefox-on-linux Protecting Your Privacy With Firefox on Linux]
* [https://linuxconfig.org/protecting-your-privacy-with-firefox-on-linux Protecting Your Privacy With Firefox on Linux]
* [https://www.howtogeek.com/block-ad-traffic-and-speed-up-your-browsing-with-these-3-free-open-source-dns-tools/ These open-source DNS tools block annoyances and speed up your browsing]
== Windows ==
[https://www.makeuseof.com/you-can-build-local-dns-in-afternoon-stop-isp-snooping/ You can build a local DNS in an afternoon and stop ISP snooping]


== Setup on Linux/Ubuntu ==
== Setup on Linux/Ubuntu ==
Line 90: Line 117:


== Pi-hole ==
== Pi-hole ==
* https://pi-hole.net/
** No username is needed. The password is defined in the '''compose.yml''' file.
** The default web interface port is 80, but we can modify it in the '''compose.yml''' file.
* Pi-hole's primary blocking mechanism is '''domain name-based''', not IP-based.
** If the domain is on a blocklist, Pi-hole immediately returns 0.0.0.0 (or its own IP address).
** If the domain is not blocked, Pi-hole forwards the request to your configured Upstream DNS Server (e.g., Cloudflare, Google DNS, or a recursive server like Unbound). The Upstream Server returns the public IP address. Pi-hole returns this IP to your device and stores it in its cache for faster future lookups.
* Will pihole slow internet speed: No
* Will pihole slow internet speed: No
* [https://www.howtogeek.com/pi-hole-v6-release/ Pi-Hole v6 Has Arrived: Here’s What’s New]
* [https://www.crosstalksolutions.com/the-worlds-greatest-pi-hole-and-unbound-tutorial-2023/ The World’s Greatest Pi-hole (and Unbound) Tutorial 2023]
* https://github.com/pi-hole/ and https://github.com/pi-hole/pi-hole
* http://pi.hole/admin
* [https://danielrampelt.com/blog/install-pihole-raspberry-pi-docker-ipv6/ Complete Guide to Setting up Pi-hole on a Raspberry Pi with IPv6 Support on Docker] including ''Using Pi-hole as Your DHCP Server'', ''Adding More Blocklists'', ''Unblocking Domains'' & '''Using DNS over HTTPS''' (all queries from Pi-hole will be encrypted and your ISP will not be able to see them).
* [http://lifehacker.com/create-a-network-wide-ad-blocker-with-a-raspberry-pi-1727295925 Create a Network-Wide Ad Blocker with a Raspberry Pi]
* [https://learn.adafruit.com/pi-hole-ad-blocker-with-pi-zero-w?view=all Pi Hole Ad Blocker with Pi Zero W] (and PiOLED)
* [https://www.jeffgeerling.com/blog/2017/setting-pi-hole-whole-home-adtracker-blocking Setting up a Pi Hole for whole-home ad/tracker blocking] (Raspbian)
* [http://www.androidbeat.com/2015/05/how-to-change-dns-server-android-phone-tablet/ How to change DNS server on your Android phone or tablet]
* [https://discourse.pi-hole.net/t/seven-things-you-may-not-know-about-pi-hole/3096 Pi hole prevent ads from appearing on Internet-connected devices that aren't a Web browser]. Pi-hole can be installed on hardware that's not a Raspberry Pi.
* [https://linuxincluded.com/install-pi-hole-on-ubuntu/ Installing pi-hole on ubuntu 18.04 LTS]
* [https://www.comparitech.com/blog/vpn-privacy/block-mobile-ads-raspberry-pi-pihole/ How to block mobile ads with Raspberry Pi and Pi-hole]
* [https://www.reddit.com/r/pihole/comments/tbtsxt/millions_of_hits_to_a_random_ip_lookup_from_my/ Millions of hits to a random IP lookup from my router at 3AM. Happened on both my PiHoles. Ideas?]
* [https://oisd.nl/ oisd blocklist]
* [https://github.com/hagezi/dns-blocklists#pro DNS-Blocklists] (15k stars)
* [https://www.reddit.com/r/pihole/comments/uuxai1/change_dns_in_android_11_12_to_use_with_pihole/ Change DNS in android 11 , 12 ... to use with pihole]
* [https://www.howtogeek.com/why-run-2-pi-hole-instances-and-how-to-keep-them-synced/ Why I Run 2 Pi-Hole Instances (and How I Keep Them Synced)]. One way to test it is to open the Android app 'Taiwan Radio' or 'FainTV'. You will see the ads cannot be loaded anymore. In fact, this also fixed the buffering problem when I use the 'Taiwan Radio' app.
* Run a local pihole instance in a Docker container
* Run a local pihole instance in a Docker container
** [https://jan-v.nl/post/2021/running-pihole-locally-using-docker/ Running Pi-hole locally using Docker]. After the container is booted, you can set up your DNS to 127.0.0.1.
** [https://jan-v.nl/post/2021/running-pihole-locally-using-docker/ Running Pi-hole locally using Docker]. After the container is booted, you can set up your DNS to 127.0.0.1.
* [[Raspberry#Pi-hole|Raspberry > Pi-hole]]
* [https://www.howtogeek.com/give-your-self-hosted-services-local-domain-names-with-this-pi-hole-trick/ Give Your Self-Hosted Services Local Domain Names With This Pi-hole Trick]
* [https://www.xda-developers.com/how-i-use-pi-hole-and-tailscale-for-whole-network-ad-blocking/ How I use Pi-hole and Tailscale for whole-network ad blocking]
 
==== Install by Docker ====
<ul>
<li>https://docs.pi-hole.net/docker/
<li>When I run '''docker logs -f pihole''', I see "ERROR: Failed to receive data from NTP server pool.ntp.org (x.x.x.x): Timeout". Gemini suggests to add 3 options in compose.yml or through web interface (All Settings - Network Time Sync. Deselect the checkbox next to the setting "Should FTL try to synchronize the system time with an upstream NTP server?")
<pre>
services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    # ... other settings like ports and volumes ...
   
    environment:
      # Critical for security: set your web interface password
      - WEBPASSWORD=YourSecurePassword
      # Set your Time Zone
      - TZ=America/New_York
     
      # Correct variable to disable the internal NTP sync client
      - FTLCONF_ntp_sync_active=false
 
      # Optional: Disable the NTP server functionality as well (Recommended in Docker)
      - FTLCONF_ntp_ipv4_active=false
      - FTLCONF_ntp_ipv6_active=false
     
    # ... rest of your compose file ...
</pre>
</ul>
 
==== Install on Pi ====
* No 'sudo'
* Uncheck to install '''lighttpd''' since I have '''apache''' installed already
:<syntaxhighlight lang='bash'>
curl -sSL https://install.pi-hole.net | bash
</syntaxhighlight>
* I am using wifi and it works fine
* New directories '''/var/www/html/admin''' (main directory) and '''/var/www/html/pihole''' (only 2 files) are created.
* At the end it will say the install log is in '''/etc/pihole'''
* The web interface is at http://pi.hole/admin or http://192.168.x.x/admin. The Admin Webpage login password will be shown on the text UI and the terminal too (remember to save it).
* [https://discourse.pi-hole.net/t/how-do-i-set-or-reset-the-web-interface-password/1328 The pi-hole admin password can be reset] by '''pihole -a -p'''
* Ports 53 and 80 need to be opened. '''sudo netstat -tulpn | grep LISTEN'''
* To change the interface from eth0 to wlan0, use ''' pihole -r''' to reconfigure. see [https://discourse.pi-hole.net/t/change-ip-adress/3837 Change ip adress]
* My current pi-hole version is v4.4 (2020-04), AdminLTE v4.3.3 and FTL v4.3.1. '''pihole -v'''  It also shows what is the latest versions.
* On my Dasung non-ereader tablet (Android 8.1.0) it does not have DNS option on WiFi network. I install DNSPipe. It seems to work. It does ask something related VPN, why?
 
==== Local DNS Record ====
* This allows you to map your own domains to your private network.
* [https://www.youtube.com/watch?v=kKsHo6r4_rc Using Pi-Hole for Local DNS - Fast, Simple, and Easy Guide]
 
==== Update ====
<pre>
$ pihole -up
</pre>
After I upgrade to 5.0, the stats on the dashboard is not working. A solution is [https://www.reddit.com/r/pihole/comments/ghceqw/no_stats_on_dashboard_after_upgrade/?utm_source=share&utm_medium=web2x here]. '''sudo apt install php7.0-sqlite''' and '''sudo service apache2 restart'''. Use '''php -v''' to check your PHP version before confirming the exact module name to install.
 
==== Uninstall ====
* [https://discourse.pi-hole.net/t/uninstall-pi-hole-on-raspberry-pi/30530/2 Unsupported OS]
<pre>
sudo rm -rf /etc/.pihole /etc/pihole /opt/pihole \
  /usr/bin/pihole-FTL /usr/local/bin/pihole \
  /var/www/html/pihole /var/www/html/admin
</pre>
* [https://discourse.pi-hole.net/t/can-i-disable-uninstall-pi-hole/844 Can I disable / uninstall Pi Hole?]
* [https://omgdebugging.com/2018/07/17/uninstalling-pi-hole-on-ubuntu-16-04-with-openvpn/ Uninstalling Pi-Hole on Ubuntu 16.04 with OpenVPN]
{{Pre}}
$ pihole uninstall
....
  [i] The following dependencies may have been added by the Pi-hole install:
    dhcpcd5 git iproute2 whiptail cron curl dnsutils iputils-ping lsof netcat psmisc sudo unzip wget idn2 sqlite3 libcap2-bin dns-root-data libcap2 lighttpd php7.0-common php7.0-cgi php7.0-sqlite3 php7.0-xml php-intl
  [?] Do you wish to go through each dependency for removal? (Choosing No will leave all dependencies installed) [Y/n] n
  [✓] Removed Web Interface
  [✓] Removed /etc/cron.d/pihole
  [✓] Removed lighttpd configs
  [✓] Removed config files
  [✓] Removed pihole-FTL
  [✓] Removed pihole man page
  [✓] Removed 'pihole' user
...
</pre>
 
==== Migrating Pi-Hole from lighttpd to apache ====
 
<pre>
sudo apt-get remove lighttpd
</pre>
 
==== Whitelist ====
 
* [https://docs.pi-hole.net/guides/misc/allowlist-denylist/ Allowlist and Denylist editing] from Pi-hole documentation (command line).
* To allow a domain (GUI):
** Go to '''Query Log''' on the left panel.
** At the bottom, enter the blocked URL (eg link.ted.com) in the '''Domain''' box
** It will return a list of Recent Queries.
** Click the '''Allow''' button on the right to any query we want to unblock.
** The allowed domain will appear under the "Domain management" page when you click the  '''Domain''' on left panel
* Use '''Domain''' on left panel
* Command line: '''pihole -w somedomain.com  anotherdomain.net'''  (add to whitelist)
* [https://github.com/anudeepND/whitelist Collection of commonly white listed domains for Pi-Hole®]
* [https://discourse.pi-hole.net/t/commonly-whitelisted-domains/212 Commonly Whitelisted Domains]
 
==== Use pi-hole as the only DNS ====
 
On my Android galaxy tab s6 lite, I set up two DNSs. Even pi-hole is the 1st DNS, for some reason, the 2nd DNS was used. So ads are not blocked.
 
I can try checking the Pi-hole logs to see if there are any issues or errors that could be causing delays in resolving queries. I can access the logs by logging in to the Pi-hole web interface and navigating to the '''“Tools”''' section and then selecting '''“Tail pihole.log”'''. This will show you a live view of the Pi-hole log file and you can see if there are any issues or errors that could be causing delays in resolving queries.
 
I can also try adjusting the '''[https://docs.pi-hole.net/ftldns/dns-cache/ cache size]''' in Pi-hole. Please note that increasing the cache size may improve performance, but it will also increase memory usage. You should choose a cache size that is appropriate for your system’s resources.
<syntaxhighlight lang='bash'>
sudo nano /etc/dnsmasq.d/01-pihole.conf
# Find the line that starts with cache-size and change the value
sudo service pihole-FTL restart
</syntaxhighlight>


== Unbound ==
== Unbound ==
Line 292: Line 457:


I try to change the DNS ip using either Network Connection GUI or modifying /etc/resolv.conf (& calling sudo /etc/init.d/networking restart). But it does not change anything??
I try to change the DNS ip using either Network Connection GUI or modifying /etc/resolv.conf (& calling sudo /etc/init.d/networking restart). But it does not change anything??
==  DNS-over-HTTPS (DoH) in Firefox ==
* [https://www.bleepingcomputer.com/news/software/mozilla-firefox-expands-dns-over-https-doh-test-to-release-channel/ Mozilla Firefox Expands DNS-over-HTTPS (DoH) Test to Release Channel].
* This does not affect the result of [https://www.dnsleaktest.com/ DNS leak test] and [http://dnsleak.com/ another test].
* [https://stealthbits.com/blog/dns-over-https/ What is DNS over HTTPS (DoH) & How to Enable in Windows 10]
* [https://www.howtogeek.com/660088/how-to-enable-dns-over-https-in-google-chrome/ How to Enable DNS Over HTTPS in Google Chrome], [https://www.howtogeek.com/660157/how-to-enable-dns-over-https-in-microsoft-edge/ How to Enable DNS Over HTTPS in Microsoft Edge]


== Query DNS server ==
== Query DNS server ==
Line 325: Line 484:


Another way is to use the R packages: [https://cran.r-project.org/web/packages/gdns/index.html gdns] and [https://github.com/hrbrmstr/dnsflare dnsflare]. [https://rud.is/b/2018/04/01/more-options-for-querying-dns-from-r-with-1-1-1-1/ More Options For Querying DNS From R with 1.1.1.1].
Another way is to use the R packages: [https://cran.r-project.org/web/packages/gdns/index.html gdns] and [https://github.com/hrbrmstr/dnsflare dnsflare]. [https://rud.is/b/2018/04/01/more-options-for-querying-dns-from-r-with-1-1-1-1/ More Options For Querying DNS From R with 1.1.1.1].
== How to Check DNS Server IP Address ==
[https://www.tecmint.com/find-my-dns-server-ip-address-in-linux/ How to Check DNS Server IP Address in Linux]


== 3 Ways to Check DNS Propagation Status ==
== 3 Ways to Check DNS Propagation Status ==
https://www.makeuseof.com/tag/check-dns-propagation-status/
https://www.makeuseof.com/tag/check-dns-propagation-status/
=  DNS-over-HTTPS (DoH) =
* [https://www.bleepingcomputer.com/news/software/mozilla-firefox-expands-dns-over-https-doh-test-to-release-channel/ Mozilla Firefox Expands DNS-over-HTTPS (DoH) Test to Release Channel].
* This does not affect the result of [https://www.dnsleaktest.com/ DNS leak test] and [http://dnsleak.com/ another test].
* [https://stealthbits.com/blog/dns-over-https/ What is DNS over HTTPS (DoH) & How to Enable in Windows 10]
* [https://www.howtogeek.com/660088/how-to-enable-dns-over-https-in-google-chrome/ How to Enable DNS Over HTTPS in Google Chrome], [https://www.howtogeek.com/660157/how-to-enable-dns-over-https-in-microsoft-edge/ How to Enable DNS Over HTTPS in Microsoft Edge]
* [https://www.makeuseof.com/what-the-heck-is-dns-over-https/ What the heck is DNS over HTTPS and why does everyone keep arguing about it?]


= DNS tricks =
= DNS tricks =
Line 399: Line 568:
* Use a Dynamic DNS IP updater bash script for Cloudflare API. [https://claudiu.psychlab.eu/post/homelab-2-tld-subdomains-ddns-cloudflare/ HomeLab 2: Web domain, subdomains and Dynamic DNS with Cloudflare API]. cron was used to check the update every 10 minutes. The bash script is from https://github.com/K0p1-Git/cloudflare-ddns-updater.
* Use a Dynamic DNS IP updater bash script for Cloudflare API. [https://claudiu.psychlab.eu/post/homelab-2-tld-subdomains-ddns-cloudflare/ HomeLab 2: Web domain, subdomains and Dynamic DNS with Cloudflare API]. cron was used to check the update every 10 minutes. The bash script is from https://github.com/K0p1-Git/cloudflare-ddns-updater.
<ul>
<ul>
<li>[https://www.davidschlachter.com/misc/cloudflare-ddclient Configure ddclient for Cloudflare Dynamic DNS]
<li>Cloudflare -> [https://developers.cloudflare.com/dns/manage-dns-records/how-to/managing-dynamic-ip-addresses Use dynamic IP addresses]
<li>Cloudflare -> [https://developers.cloudflare.com/dns/manage-dns-records/how-to/managing-dynamic-ip-addresses Use dynamic IP addresses]
* Cloudflare API. [https://bytefreaks.net/gnulinux/bash/cloudflare-api-dns-update Cloudflare API DNS Update], [https://iotechonline.com/cloudflare-dns-dynamic-ip-updater-script/ Cloudflare dns dynamic ip updater script], [https://github.com/TheGnarlyGonzo/cloudflare-ddns-script cloudflare-ddns-script].
* Cloudflare API. [https://bytefreaks.net/gnulinux/bash/cloudflare-api-dns-update Cloudflare API DNS Update], [https://iotechonline.com/cloudflare-dns-dynamic-ip-updater-script/ Cloudflare dns dynamic ip updater script], [https://github.com/TheGnarlyGonzo/cloudflare-ddns-script cloudflare-ddns-script].
* [https://youtu.be/CS72kN2c6hU?t=680 Cloudflare API + Docker] from oznu. A docker container that allows you to use CloudFlare as a DDNS / DynDNS Provider. [https://youtu.be/Nf7m3h11y-s A video] by DB Tech.
* [https://youtu.be/CS72kN2c6hU?t=680 Cloudflare API + Docker] from oznu. A docker container that allows you to use CloudFlare as a DDNS / DynDNS Provider. [https://youtu.be/Nf7m3h11y-s A video] by DB Tech.
* [https://www.null-byte.org/homelab/cloudflare-and-dynamic-dns-with-ddclient-and-docker/ Cloudflare and Dynamic DNS with ddclient and docker]
* ddclient
* ddclient
: <syntaxhighlight lang='bash'>
: <syntaxhighlight lang='bash'>
Line 465: Line 636:
* [https://hide-ip-proxy.com/configure-proxy-server-android/ How to Set up a Proxy Server on Android (Wi-Fi and Mobile)]. '''https://www.xmyip.com/''' can check the proxy server from your browser. Two types of proxy: HTTP and SOCKS.
* [https://hide-ip-proxy.com/configure-proxy-server-android/ How to Set up a Proxy Server on Android (Wi-Fi and Mobile)]. '''https://www.xmyip.com/''' can check the proxy server from your browser. Two types of proxy: HTTP and SOCKS.
* [https://twitgoo.com/check-if-proxy-is-working/ How to Check if Your Proxy is Working] '''http://showmyip.com/'''.
* [https://twitgoo.com/check-if-proxy-is-working/ How to Check if Your Proxy is Working] '''http://showmyip.com/'''.
* [https://www.howtogeek.com/what-is-a-proxy-server-and-should-you-use-one/ What Is a Proxy Server and Should You Use One?]


= Zero trust network access =
= Zero trust network access =
Line 471: Line 643:


== Cloudflare Tunnel ==
== Cloudflare Tunnel ==
* Cloudflare Tunnel is a service that allows you to securely connect your applications and infrastructure, wherever they are hosted, to the Cloudflare global network without exposing your origin server's IP address directly to the internet.
* Advantages:
* Advantages:
** No port forward
** No port forward
** No static IP or DDNS service
** No static IP or DDNS service
* [https://www.cloudflare.com/products/tunnel/ Cloudflare Tunnel]
* [https://www.cloudflare.com/products/tunnel/ Cloudflare Tunnel]
* [https://www.makeuseof.com/how-to-securely-remote-access-wifi-router/ How to Securely Access Your Wi-Fi Router From Anywhere]
* [https://www.makeuseof.com/how-to-securely-remote-access-wifi-router/ How to Securely Access Your Wi-Fi Router From Anywhere]
Line 488: Line 663:
*** Note in creating a policy, I choose Github authentication. In the '''Configure rules''', I choose '''Emails''' & my email associated with Github account.  
*** Note in creating a policy, I choose Github authentication. In the '''Configure rules''', I choose '''Emails''' & my email associated with Github account.  
** [https://youtu.be/ZvIdFs3M5ic You Need to Learn This! Cloudflare Tunnel Easy Tutorial]
** [https://youtu.be/ZvIdFs3M5ic You Need to Learn This! Cloudflare Tunnel Easy Tutorial]
** [https://www.youtube.com/watch?app=desktop&v=wyKkeb3w5lI How to Set Up CloudFlare Tunnels in 2025 | EP32 | How to Set Up a Homelab]


* SSH
* SSH
Line 495: Line 671:
** [https://dev.to/tylerlwsmith/ssh-into-a-server-behind-cloudflare-using-an-ssh-config-file-355j SSH into a server behind Cloudflare using an SSH config file]
** [https://dev.to/tylerlwsmith/ssh-into-a-server-behind-cloudflare-using-an-ssh-config-file-355j SSH into a server behind Cloudflare using an SSH config file]
** [https://youtu.be/xRlM71fCdbY Raspberry Pi remote access - SSH Remotely from your browser using Cloudflare tunnel for FREE !]
** [https://youtu.be/xRlM71fCdbY Raspberry Pi remote access - SSH Remotely from your browser using Cloudflare tunnel for FREE !]
=== DockFlare ===
* https://github.com/ChrispyBacon-dev/DockFlare
* [https://www.xda-developers.com/cloudflare-tunnels-easier-to-manage-free-open-source-self-hosted-tool/ My Cloudflare Tunnels are so much easier to manage with this free open-source self-hosted tool]


== tailscale ==
== tailscale ==
Line 505: Line 685:
[https://youtu.be/VCH8-XOikQc SelfHosted Gateway - WireGuard Tunnel for secure external access to all of your Self Hosted Apps] & [https://wiki.opensourceisawesome.com/books/selfhosted-gateway-reverse-proxy/page/selfhosted-gateway Notes]
[https://youtu.be/VCH8-XOikQc SelfHosted Gateway - WireGuard Tunnel for secure external access to all of your Self Hosted Apps] & [https://wiki.opensourceisawesome.com/books/selfhosted-gateway-reverse-proxy/page/selfhosted-gateway Notes]


== twingate ==
== Pangolin ==
* https://github.com/fosrl/pangolin. Tunneled Reverse Proxy Server with Access Control. Your own self-hosted zero trust tunnel
** [https://docs.fossorial.io/Getting%20Started/overview Fossorial Docs]
* [https://youtu.be/a-a-Xk1hXBQ?si=i6PjmnOz4WZ30qgf Pangolin: Your Own Self-Hosted Cloudflare Tunnel Alternative] (db tech)
* [https://noted.lol/pangolin-local/ Install and Run Pangolin Locally on your own Server]
* [https://www.youtube.com/watch?v=zEBaXAu8zE0 Pangolin final] and [https://wiki.opensourceisawesome.com/books/self-hosted-tunnels/page/install-and-configure-pangolin writing]
* [https://pimylifeup.com/pangolin-linux/ Self-Host a Tunneled Reverse Proxy with Pangolin] - Pi My Life Up


= IP spoofing =
= IP spoofing =
[https://www.makeuseof.com/what-is-ip-spoofing/ What Is IP Spoofing and What Is It Used For?]
[https://www.makeuseof.com/what-is-ip-spoofing/ What Is IP Spoofing and What Is It Used For?]

Latest revision as of 08:23, 23 November 2025

Resource

Block Ads

TTL

How to see Time-To-Live (TTL) for a DNS record

FQDN

URL

  • It seems we can append "?" and "#" after a valid URL.
  • What do "?" and "#" mean in a URL?
    • “?” in URL acts as separator
    • “#” was used as an anchor to jump to an element. However, nowadays it's usually used with AJAX-based pages since changing the hash can be detected using JavaScript and allows you to use the back/forward button without actually triggering a full page reload.
  • Which characters make a URL invalid?
  • Special character in URL ignored by browsers

Records

A record (address record): IPv4

  • A records are used to map a domain name to an IP address
  • For example, "domain.com" is an A record (Pointing your root domain to a serve). Its value/target is an IP address (e.g., 203.0.113.50).
    • Cf. "www.domain.com" is CNAME record which maps it to "www.domain.com".
  • Use cases: Pointing your root domain (mydomain.com) to a server.
  • Performance: Requires one DNS lookup.
  • Limitation: No major limitations.
  • What does @ mean when setting up A Records in your DNS settings? Apex records, naked domain
    • When creating a new A record, using the host as @ means that the record is for the root domain itself. In other words, if your domain is “example.com”, an A record with @ as the host would point “example.com” to the specified IP address. This is often used to direct traffic for the bare domain (i.e., example.com without any subdomains like www) to a particular server.
  • How to set up subdomains with Cloudflare, 免费开源论坛程序推荐！含搭建教程，手把手教你安装.

CNAME: Alias

  • A CNAME record is used to map one domain name to another domain name. Its value/target is a fully qualified domain name (e.g., my-blog-app.netlify.app).
  • For example, a CNAME record for "www.example.com" might map to "example.com". This is useful when you want to point multiple domain names to the same server.
  • Use cases: Creating aliases for subdomains (www.mydomain.com, blog.mydomain.com).
  • Performance: Requires at least two DNS lookups (one for the CNAME, one for the final A record).
  • Limitation: Cannot coexist with other records for the same hostname. For example, a subdomain with a CNAME record cannot have an MX record for email or a TXT record. For this reason, you can't use a CNAME record for your root domain (mydomain.com) if you also want to receive email.
  • A CNAME record is used in lieu of an A record when a domain or subdomain is an alias of another domain. All CNAME records must point to a domain, never to an IP address. See What is a DNS CNAME record? For example, www.example.com is an alias of example.com.

DNSCrypt

DNS commands/clients

DNS server

Windows

You can build a local DNS in an afternoon and stop ISP snooping

Setup on Linux/Ubuntu

sudo apt install bind9
sudo nano /etc/bind/named.conf.options
  # update 'forwarders' key to use 1,1,1,1; 8.8.8.8;
  # add 'forward only;'
sudo systemctl restart bind9
# open port 53, or let ufw to allow bind9

AdGuard Home

How to set up your own open source DNS server

Pi-hole

  • https://pi-hole.net/
    • No username is needed. The password is defined in the compose.yml file.
    • The default web interface port is 80, but we can modify it in the compose.yml file.
  • Pi-hole's primary blocking mechanism is domain name-based, not IP-based.
    • If the domain is on a blocklist, Pi-hole immediately returns 0.0.0.0 (or its own IP address).
    • If the domain is not blocked, Pi-hole forwards the request to your configured Upstream DNS Server (e.g., Cloudflare, Google DNS, or a recursive server like Unbound). The Upstream Server returns the public IP address. Pi-hole returns this IP to your device and stores it in its cache for faster future lookups.
  • Will pihole slow internet speed: No

Install by Docker

  • https://docs.pi-hole.net/docker/
  • When I run docker logs -f pihole, I see "ERROR: Failed to receive data from NTP server pool.ntp.org (x.x.x.x): Timeout". Gemini suggests to add 3 options in compose.yml or through web interface (All Settings - Network Time Sync. Deselect the checkbox next to the setting "Should FTL try to synchronize the system time with an upstream NTP server?") 
    services:
  pihole:
    image: pihole/pihole:latest
    container_name: pihole
    # ... other settings like ports and volumes ...
    
    environment:
      # Critical for security: set your web interface password
      - WEBPASSWORD=YourSecurePassword
      # Set your Time Zone
      - TZ=America/New_York
      
      # Correct variable to disable the internal NTP sync client
      - FTLCONF_ntp_sync_active=false 

      # Optional: Disable the NTP server functionality as well (Recommended in Docker)
      - FTLCONF_ntp_ipv4_active=false
      - FTLCONF_ntp_ipv6_active=false
      
    # ... rest of your compose file ...

Install on Pi

  • No 'sudo'
  • Uncheck to install lighttpd since I have apache installed already
curl -sSL https://install.pi-hole.net | bash
  • I am using wifi and it works fine
  • New directories /var/www/html/admin (main directory) and /var/www/html/pihole (only 2 files) are created.
  • At the end it will say the install log is in /etc/pihole
  • The web interface is at http://pi.hole/admin or http://192.168.x.x/admin. The Admin Webpage login password will be shown on the text UI and the terminal too (remember to save it).
  • The pi-hole admin password can be reset by pihole -a -p
  • Ports 53 and 80 need to be opened. sudo netstat -tulpn | grep LISTEN
  • To change the interface from eth0 to wlan0, use pihole -r to reconfigure. see Change ip adress
  • My current pi-hole version is v4.4 (2020-04), AdminLTE v4.3.3 and FTL v4.3.1. pihole -v It also shows what is the latest versions.
  • On my Dasung non-ereader tablet (Android 8.1.0) it does not have DNS option on WiFi network. I install DNSPipe. It seems to work. It does ask something related VPN, why?

Local DNS Record

Update

$ pihole -up

After I upgrade to 5.0, the stats on the dashboard is not working. A solution is here. sudo apt install php7.0-sqlite and sudo service apache2 restart. Use php -v to check your PHP version before confirming the exact module name to install.

Uninstall

sudo rm -rf /etc/.pihole /etc/pihole /opt/pihole \
  /usr/bin/pihole-FTL /usr/local/bin/pihole \
  /var/www/html/pihole /var/www/html/admin

$ pihole uninstall
....
  [i] The following dependencies may have been added by the Pi-hole install:
    dhcpcd5 git iproute2 whiptail cron curl dnsutils iputils-ping lsof netcat psmisc sudo unzip wget idn2 sqlite3 libcap2-bin dns-root-data libcap2 lighttpd php7.0-common php7.0-cgi php7.0-sqlite3 php7.0-xml php-intl 
  [?] Do you wish to go through each dependency for removal? (Choosing No will leave all dependencies installed) [Y/n] n
  [✓] Removed Web Interface
  [✓] Removed /etc/cron.d/pihole
  [✓] Removed lighttpd configs
  [✓] Removed config files
  [✓] Removed pihole-FTL
  [✓] Removed pihole man page
  [✓] Removed 'pihole' user
...

Migrating Pi-Hole from lighttpd to apache

sudo apt-get remove lighttpd

Whitelist

  • Allowlist and Denylist editing from Pi-hole documentation (command line).
  • To allow a domain (GUI):
    • Go to Query Log on the left panel.
    • At the bottom, enter the blocked URL (eg link.ted.com) in the Domain box
    • It will return a list of Recent Queries.
    • Click the Allow button on the right to any query we want to unblock.
    • The allowed domain will appear under the "Domain management" page when you click the Domain on left panel
  • Use Domain on left panel
  • Command line: pihole -w somedomain.com anotherdomain.net (add to whitelist)
  • Collection of commonly white listed domains for Pi-Hole®
  • Commonly Whitelisted Domains

Use pi-hole as the only DNS

On my Android galaxy tab s6 lite, I set up two DNSs. Even pi-hole is the 1st DNS, for some reason, the 2nd DNS was used. So ads are not blocked.

I can try checking the Pi-hole logs to see if there are any issues or errors that could be causing delays in resolving queries. I can access the logs by logging in to the Pi-hole web interface and navigating to the “Tools” section and then selecting “Tail pihole.log”. This will show you a live view of the Pi-hole log file and you can see if there are any issues or errors that could be causing delays in resolving queries.

I can also try adjusting the cache size in Pi-hole. Please note that increasing the cache size may improve performance, but it will also increase memory usage. You should choose a cache size that is appropriate for your system’s resources. 

sudo nano /etc/dnsmasq.d/01-pihole.conf
# Find the line that starts with cache-size and change the value
sudo service pihole-FTL restart

Unbound

How to Set Up Local DNS Resolver with Unbound on Ubuntu 22.04

Client part

  • Windows/Mac/Linux
dig @192.168.1.2  linkedin.com  # Suppose the DNS server ips is 192.168.1.2
Pay attention to the Query time result. If we run the same command again, the query time will be reduced to 0 because of the cache in the DNS server.

Client part 2: what is my DNS server /etc/resolv.conf or /etc/network/interfaces. Static IP

Use one of the following commands 

systemd-resolve  --status
resolvectl status
nmcli dev show | grep 'IP4.DNS'

PS. dig command can show my DNS server as part of its output.

On Ubuntu 18.04 and up, it uses netplan. PS. use space character instead tab in yml file.

Even I can change my DNS setting using the Network Manager (IPv4 -> disable Automatic -> Enter 8.8.8.8 -> Apply -> Toggle On/Off), the name solving does not work. Testing https://129.43.254.99 works but not https://brb.nci.nih.gov

To use the /etc/resolv.conf method, check out how to add DNS servers or Set permanent DNS nameservers on Ubuntu/Debian with resolv.conf (video).

On my home computer, it just shows one line nameserver 127.0.1.1. On work computer, it shows 

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.1.1
search XXX.XXX.gov

On the VM of my work computer, it shows 

nameserver 127.0.0.53
search XXX.XXX.gov

It seems the /etc/resolv.conf file changes with the file on the host.

After any change, we can restart the network by using sudo service networking restart.

Note:

  • nameserver Name-server-IP-address: Point out to your your own nameserver or to ISP’s name server. Up to 3 name servers may be listed.
  • search domain.com: The search list is normally determined from the local domain name; by default, it contains only the local domain name. So when you type nslookup www, it will be matched to www.cyberciti.biz

You can also use Public Name Servers 

nameserver 8.8.8.8
nameserver 8.8.4.4

dig Command Examples - check DNS server

dig (domain information groper) is a DNS lookup utility. 

$ sudo apt install dnsutils

$ dig techmint.com
...
;; Query time: 220 msec
;; SERVER: 100.100.100.100#53(100.100.100.100)
;; WHEN: Fri Aug 16 08:44:30 EDT 2024
;; MSG SIZE  rcvd: 57

$ dig @1.1.1.1 techmint.com
...
;; Query time: 68 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Fri Aug 16 08:47:02 EDT 2024
;; MSG SIZE  rcvd: 57

# List All DNS Records Using dig
$ dig google.com ANY

host command

Linux and Unix host Command Examples

DNSmasq (DNS + DHCP server)

Local forwarding server

dnsmasq program is running on my Ubuntu and Linux/Mint machines.

See nameserver 127.0.1.1 in resolv.conf won't go away! 

$ ps -ef | grep -i dnsmasq

$ sudo netstat -anp | grep -i dnsmasq

DHCP server

  • Turn Raspi into a wireless hotspot / access point
  • ChatGPT. Remember to replace eth0 with the interface name connected to your home router and adjust IP ranges and settings according to your needs.
    • Install the DHCP Server
    sudo apt install isc-dhcp-server
sudo nano /etc/default/isc-dhcp-server
INTERFACES="eth0 eth1"
    • Configure the DHCP Server
    subnet 10.50.50.0 netmask 255.255.255.0 {
  range 10.50.50.10 10.50.50.100;
  option routers 10.50.50.1;
  option subnet-mask 255.255.255.0;
  option broadcast-address 10.50.50.255;
  option domain-name-servers 8.8.8.8, 8.8.4.4;
  default-lease-time 600;
  max-lease-time 7200;
}
    • Assign Static IP to the Second NIC
    • Enable IP Forwarding: Enable IP forwarding to allow internet access to the devices on the new network.
    echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
    • Set Up NAT: Use iptables to set up NAT (Network Address Translation) so that devices on the new network can access the internet.
    sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables-save > /etc/iptables.rules

DNS providers

Benchmark, bottleneck

How to determine bottleneck in page load time? Use a plugin or if you have Chrome, use its built-in inspector. Google Chrome: Right-click on anything and click "Inspect element" and click "Network" tab on the new box that appears. Navigate to your site, you will now see in real-time how the browser is receiving the information

Change DNS setting

Command line

How to Find and Change Your DNS Server on Linux. 

resolvectl status

resolvectl dns <interface> <dns address 1> <dns address2>

Domain Setup & SSL Certificates, HTTPS - NGINX & Docker Compose

Shiny Production with AWS Book

Flush DNS cache

How To Set Permanent DNS Nameservers

How To Set Permanent DNS Nameservers in Ubuntu and Debian

Test if you are using OpenDNS

https://welcome.opendns.com/

I try to change the DNS ip using either Network Connection GUI or modifying /etc/resolv.conf (& calling sudo /etc/init.d/networking restart). But it does not change anything??

Query DNS server

DNS leak test

To list the current DNS servers used by my system,

Method 1: 

# Ubuntu >= 15
$ nmcli dev show | grep 'IP4.DNS'
$ nmcli device show <interfacename> | grep IP4.DNS
# Ubuntu <= 14
$ nmcli dev list iface <interfacename> | grep IP4

Method 2: 

$ cat /etc/resolv.conf

Method 3 (macOS): 

scutil --dns | grep nameserver
# cat /etc/resolv.conf

Another way is to use the R packages: gdns and dnsflare. More Options For Querying DNS From R with 1.1.1.1.

How to Check DNS Server IP Address

How to Check DNS Server IP Address in Linux

3 Ways to Check DNS Propagation Status

https://www.makeuseof.com/tag/check-dns-propagation-status/

DNS-over-HTTPS (DoH)

DNS tricks

5 DNS Servers Guaranteed to Improve Your Online Safety

http://www.makeuseof.com/tag/best-dns-providers-security/

5 Nifty Ways to Use DNS to Your Advantage

http://www.makeuseof.com/tag/nifty-ways-use-dns-advantage/

Discover subdomains

5 Powerful Linux Tools to Discover Subdomains as an Ethical Hacker

DNStracer

http://www.ubuntugeek.com/dnstracer-trace-dns-queries-to-the-source.html

Reverse DNS

Reverse DNS (rDNS) is a process that resolves an IP address back to a domain name, the opposite of a forward DNS query. What Is Reverse DNS and How Does It Work?

Dyndns and ddclient

According to a comment in this video, Cloudflare tunnel completely replaces the need for reverse proxy like Traefik/Nginx Proxy Manager.

Resources

nano /etc/ddclient.conf on Debian 12. Use ddclient --help | grep version to find the installed version. See my 'ddclient' google doc.

Note that the specification should depend on the domain name registrar (eg namecheap). For namecheap, the login/password is NOT your actual credential from your domain name registrar. The password should be obtained from the domain name registrar website. The last line is about the host. If I am setting it up for a subdomain, I should enter the subdomain name (and skip the domain name part). The ssl=yes is to ensure the connection is made over https instead of http.

And run sudo ddclient -daemon=0 -debug -verbose -noquiet to verify ddclient is working. You shall get a long return with the last line looks like 

SUCCESS:  updating YOURSUBDOMAIN: good: IP address set to XX.XXX.XXX.XXX

No matter which method we use, we can go to our DNS account (in namecheap, go to Dashboard -> MANAGE button -> Domains -> Advanced DNS) and temporarily change the global IP address to another one, run the update script and then check if the global IP address has been updated to the correct one. 

sudo systemctl restart ddclient.service
# sudo /etc/init.d/ddclient restart

sudo service ddclient status

namecheap

Cloudflare

Mail

CDN

Why You Should Use a CDN to Improve Your Website’s User Experience

DuckDNS

no-ip

Mail

  • Allow only one MX record for each host for free no-ip account.
  • Click Host/Redirects > Manage Hosts > Modify.

DNS attack

What Are DNS Attacks and How Do You Prevent Them?

Proxy server

Zero trust network access

Cloudflare Tunnel

  • Cloudflare Tunnel is a service that allows you to securely connect your applications and infrastructure, wherever they are hosted, to the Cloudflare global network without exposing your origin server's IP address directly to the internet.
  • Advantages:
    • No port forward
    • No static IP or DDNS service

DockFlare

tailscale

  • Tailscale is an alternative to cloudflare tunnel
  • https://tailscale.com/kb/use-cases/. Some of the most common ones include deploying internal apps anywhere without changing firewall settings, replacing site-to-site VPNs with WireGuard, transparently interconnecting microservices between data centers and pods, and VPN from the couch to the office and HQ. Tailscale also allows remote access to computer resources and applications from any location.
  • How NAT traversal works by tailscale
  • How I use tailscale

Wireguard tunnel

SelfHosted Gateway - WireGuard Tunnel for secure external access to all of your Self Hosted Apps & Notes

Pangolin

IP spoofing

What Is IP Spoofing and What Is It Used For?

Retrieved from "https://wiki.taichimd.us/index.php?title=DNS&oldid=42922"