Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: My Little DoH Setup SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
My Little DoH Setup

"DoH"[1], this 3-letters acronym is a buzzword on the Internet in 2019! It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro & con about encrypting DNS requests in  HTTPS but it's not the goal of this diary to restart the debate. In a previous diary, he explained how to prevent DoH to be used by Firefox[2] but, this time, I'll play on the other side and explain to you how to implement it in a way to keep control of your DNS traffic (read: how to keep an eye on DNS request performed by users and systems). For a while, I had the idea to test a DoH configuration but I had some requirements:

  • It must be transparent for users
  • DNS requests must be logged (who resolved which domain and when)
  • Local DNS zones like 'lab.domain.tld' or 'iot.domain.tld' must be supported (resolved via a local bind instance)
  • Users are protected via a PiHole[3] (against advertisements & malicious domains)
  • Integration with 3rd party tools

This weekend, I decided to reconfigure my network. Here is my current setup:

Endpoints (laptops, tablets, phones, visitors, etc) are using a PiHole instance (provided via DHCP) from their VLAN. Servers are using the normal Bind instance. PiHole forwards the allowed DNS requests to Bind. It is master and can resolve RFC1918 addresses from local zones (ex: *.lab.domain.tld). If the FQDN is unknown, it is forwarded to a local cloudflared[4] daemon via UDP/5353 that used DoH to resolve public names. To keep an eye on DNS requests, PiHole and Bind send their logs to my SIEM for further processing and reporting/alerting.

From a setup point of view, everything is running in Docker containers and, to increase my detection capabilities, my MISP instance is feeding PiHole and Bind with a daily export of malicious domains[5]. Let's see how it works in the coming days...

[1] https://en.wikipedia.org/wiki/DNS_over_HTTPS
[2] https://isc.sans.edu/forums/diary/Blocking+Firefox+DoH+with+Bind/25316
[3] https://pi-hole.net/
[4] https://github.com/cloudflare/cloudflared
[5] https://isc.sans.edu/forums/diary/DNS+Firewalling+with+MISP/24556

Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

Xme

491 Posts
ISC Handler
"From a setup point of view, everything is running in Docker containers and, to increase my detection capabilities..."

Are you running Docker on Raspberry Pi to run PiHole or just the other services?
Anonymous
Nothing on a Pi. I'm using a regular Docker instance...
Xme

491 Posts
ISC Handler
Thank you for the post.

A question, please. Why or how does the endpoint that is running DoH (ie DNS over HTTPS) send its DNS questions (requests) to PiHole. Will it not directly contact the DoH servers on the internet on destination port 443/tcp?
Danny

4 Posts
In this scenario, I consider that endpoint does NOT use DoH but it could happen indeed. In this situation, the goal is to disable DoH at endpoint level (see my previous diary about DoH).
Xme

491 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!