Adguardhome: Provide DNS-over-HTTPS and DNS-over-TLS

[ameshkov]

Subj

Details on the task: https://github.com/AdguardTeam/AdGuardHome/issues/285#issuecomment-456449852

[ashwarsadh]

Dns over TLS support should be more prioritized due to addition of Proavte DNS over TLS option inbuilt in Android 9 pie
This will allow native adblocking in Android and allow adblocking over Mobile Data, moreover it is more battery efficient approach than Adblock VPN

[ghost]

That's compelling.
So you point all your mobiles and laptops to your own DNS running on docker with Cloudland and you have privacy for DNS requests and no ADS.
Finally ..

[KrasnayaPloshchad]

DNSCrypt-proxy support DoH too, and the server can be accepted via sdns:// stamp.

[Bluscream]

Is DNSCrypt the same as sdns:// or tls:// ?

[ameshkov]

No, it's a protocol, while sdns is a form of recording DNS server address

[Bluscream]

Ah okay that means we need outgoing and icoming support for all three

[ibksturm]

news?

loud thinking (i‘ll better go to bed... maybe)

it would be nice if theres a maintained list of dnscrypt servers (maybe a copy or a reference of franks work with dnscrypt-proxy) , doh (see abouve) and dot (see dnsprivacy.com)

maybe users will be able to click their resolvers, i think theres easyer to endusers

[ashwarsadh]

Other service provider has this feature:
https://blahdns.com/

On Sat, Dec 8, 2018 at 1:56 AM Andreas Ziegler [e-mail]
wrote:

news?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/AdguardTeam/AdGuardHome/issues/285#issuecomment-445355407,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AXajzulpRx4ekR7mZXnF_7VsbQTHJed9ks5u2s71gaJpZM4UiklP
.

[ameshkov]

DOH support has been added to dnsproxy in v0.9.11: https://github.com/AdguardTeam/dnsproxy/releases/tag/v0.9.11

Here's what we need to do now:

1. Add new settings section, check the mockup: https://uploads.adguard.com/up04_54sep_Diagrams_-_AGHome_Encryption__Moqups.png
2. Use these new settings fields on both Web and DNS server initialization
3. If any certificate in the chain is about to expire (<30 days), show a non-dismissable warning topline with the following text: "Your SSL certificate is about to expire. Update Encryption settings."

Validation rules:

1. Check that the text entered to the "Certificates" field is a list of PEM-encoded certificates.
2. Check that the text entered to the "Private key" field is a PEM-encoded private key.
3. If server name is specified, check that it matches subaltnames of any of the specified certificates.
4. HTTPS and TLS ports are different positive integers in the range of 80-65535. Setting HTTPS or TLS to 0 disables DOH/DOT.

[ameshkov]

Done: https://github.com/AdguardTeam/AdGuardHome/pull/590