XPost: alt.windows7.general
Update on this:
It appears that few if any people are actually curious
about secure DNS, but in case anyone is....
I finally worked
out Unbound. It turns out the config file format is very
specific and the docs are virtually non-existent. So I
was reduced to collecting chats online and trying to
figure out which people knew what they were talking
about.
Someone in a programming group explained to me
that the file unbound-checkconf.exe could be used
at command line to check for errors in the config file.
That will at least tell you what line the error is on.
They also offered an example of their config.
Finally, after a lot of fiddling, I got a config that works.
I then confirmed with Smart Sniffer that I'm getting
DNS over TLS on port 853.
I must confess that I don't entirely understand all this,
but here are the details:
This, used as service.conf, will do the trick:
# Unbound configuration file on windows.
# See example.conf for more settings and syntax
server:
verbosity: 0
directory: "%EXECUTABLE%"
username: "unbound"
logfile: "unbound.log"
use-syslog: yes
# on Windows, this setting adds the certificates from the Windows
# Cert Store. For when you want to use forwarders with TLS.
tls-win-cert: yes
# listen interfaces and port
interface: 0.0.0.0
port: 53
# who can query the server
access-control: 127.0.0.0/8 allow
access-control: 192.168.0.0/16 allow
auto-trust-anchor-file: "root.key"
#
https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt
tls-cert-bundle: "ca-bundle.crt"
#
https://www.internic.net/domain/named.root
root-hints: "named.root"
prefetch: no
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
# security/privacy
aggressive-nsec: yes
cache-max-ttl: 14400
cache-min-ttl: 1200
hide-identity: yes
hide-version: yes
harden-glue: yes
harden-dnssec-stripped: yes
val-clean-additional: yes
rrset-roundrobin: yes
use-caps-for-id: yes
include: "hosts.conf"
#Adding DNS-Over-TLS support
forward-zone:
name: "."
forward-tls-upstream: yes
## Cloudflare DNS
forward-addr: 1.1.1.1@853
forward-addr: 1.0.0.1@853
# ---- end config file
It uses Cloudflare for DNS. The options are limited.
Cloudflare seems to be well rated. It's what Mozilla
uses. Other options: Google? Not on your life. A handful
of others. But you have to make sure the server you
want to use supports DNS over TLS.
Other notes: The two links to .root and .crt files
seem to be needed. Apparently they're part of the
process of confirming certificates. The line:
include: "hosts.conf"
refers to my HOSTS file, which I
converted to Unbound format using a VBScript. The
"include" is as in PHP. It directs Unbound to read in
that file and regard it as part of the main config file.
It's external only because it's big. All of these extra
files need to be in the program folder.
HOSTS format:
Unbound, unfortunately, doesn't recognize HOSTS
format. On the bright side, it does handle top level
domains. So you don't need to use:
forty-different-things.doubleclick.net
Just plain doubleclick.net works fine. It requires
two lines for each entry. The following is a sample
section of my hosts.conf file:
local-zone: "scorecardresearch.com" redirect
local-data: "scorecardresearch.com A 0.0.0.0"
local-zone: "1e100.com" redirect
local-data: "1e100.com A 0.0.0.0"
local-zone: "1e100.net" redirect
local-data: "1e100.net A 0.0.0.0"
local-zone: "doubleclick.net" redirect
local-data: "doubleclick.net A 0.0.0.0"
local-zone: "doubleclick.com" redirect
local-data: "doubleclick.com A 0.0.0.0"
local-zone: "googletagservices.com" redirect
local-data: "googletagservices.com A 0.0.0.0"
local-zone: "googletagmanager.com" redirect
local-data: "googletagmanager.com A 0.0.0.0"
local-zone: "google-analytics.com" redirect
local-data: "google-analytics.com A 0.0.0.0"
local-zone: "fonts.googleapis.com" redirect
local-data: "fonts.googleapis.com A 0.0.0.0"
# acts as a comment marker in these files. If
you edit services.conf then be conservative.
It turned out the main problem I was having was
that the include line was in the wrong section of
the config file. What wrong section? No one mentions
that! But the lines server: and forward-zone: above
actually define sections, something like an INI file.
Unfortuantely, the authors don't explain that anywhere
and didn't alter the format to mark a section header
recognizable.
Classic OSS. Works great... if only you can find
someone who knows how to use it. :) But Unbound
seems to be highly regarded, comes with most Linux
versions, and seems to be typical for security in
corporate settings. The idea is to prevent your ISP or
various third parties from knowing what sites you visit
and possibly even injecting alterations or serving those
pages from their own cache. With this method an
observer on the network sees a call that they know is
DNS because it's on port 853, but they can't read the
content.
DNS over HTTPS (DoH) seems to be slightly more
desirable because it runs over port 443, the same as
for https webpages. So even the fact of it being a
DNS call is hidden. But for now Unbound doesn't handle
DoH.
Once you have everything working (good idea to
run unbound-checkconf) then you need to activate
the service at startup and change your DNS target
in network settings. It should be 127.0.0.1. So any
software calling for DNS resolution will call Unbound,
which is listening on port 53, which then makes the
DNS call and returns the result.
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)