"DoH"[1], this 3-letters acronym is a buzzword on the Internet in 2019! It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro & con about encrypting DNS requests in HTTPS but it's not the goal of this diary to restart the debate. In a previous diary, he explained how to prevent DoH to be used by Firefox[2] but, this time, I'll play on the other side and explain to you how to implement it in a way to keep control of your DNS traffic (read: how to keep an eye on DNS request performed by users and systems). For a while, I had the idea to test a DoH configuration but I had some requirements:
This weekend, I decided to reconfigure my network. Here is my current setup: Endpoints (laptops, tablets, phones, visitors, etc) are using a PiHole instance (provided via DHCP) from their VLAN. Servers are using the normal Bind instance. PiHole forwards the allowed DNS requests to Bind. It is master and can resolve RFC1918 addresses from local zones (ex: *.lab.domain.tld). If the FQDN is unknown, it is forwarded to a local cloudflared[4] daemon via UDP/5353 that used DoH to resolve public names. To keep an eye on DNS requests, PiHole and Bind send their logs to my SIEM for further processing and reporting/alerting. From a setup point of view, everything is running in Docker containers and, to increase my detection capabilities, my MISP instance is feeding PiHole and Bind with a daily export of malicious domains[5]. Let's see how it works in the coming days... [1] https://en.wikipedia.org/wiki/DNS_over_HTTPS Xavier Mertens (@xme) |
Xme 579 Posts ISC Handler Nov 25th 2019 |
Thread locked Subscribe |
Nov 25th 2019 1 year ago |
"From a setup point of view, everything is running in Docker containers and, to increase my detection capabilities..."
Are you running Docker on Raspberry Pi to run PiHole or just the other services? |
Anonymous |
Quote |
Nov 25th 2019 1 year ago |
Nothing on a Pi. I'm using a regular Docker instance...
|
Xme 579 Posts ISC Handler |
Quote |
Nov 25th 2019 1 year ago |
Thank you for the post.
A question, please. Why or how does the endpoint that is running DoH (ie DNS over HTTPS) send its DNS questions (requests) to PiHole. Will it not directly contact the DoH servers on the internet on destination port 443/tcp? |
Danny 4 Posts |
Quote |
Nov 27th 2019 1 year ago |
In this scenario, I consider that endpoint does NOT use DoH but it could happen indeed. In this situation, the goal is to disable DoH at endpoint level (see my previous diary about DoH).
|
Xme 579 Posts ISC Handler |
Quote |
Nov 29th 2019 1 year ago |
Thanks for sharing good information
|
Anonymous |
Quote |
Dec 14th 2019 1 year ago |
Thanks for sharing good information
|
Anonymous |
Quote |
Dec 14th 2019 1 year ago |
Sign Up for Free or Log In to start participating in the conversation!