How does DNS over https work?

a month ago by printf("%s", name); to c/techsupport

I have two routers. One of them encrypts everything with a wireguard interface and routes all traffic through my VPN provider. The other one is "plain", unencrypted, and it is used for services that need a public IP. If all these services need is a public IP address that leads to the router's wan port, I can still encrypt my DNS traffic, I thought, so I set up DNS over https (DoH), using my VPN provider's servers. To do this on OpenWRT, which is my router's operating system, I needed to download any one package that provides this functionality. I couldn't just configure ports, firewall rules, NAT or whatever and be happy... Of the settings that this DoH package came with lets you choose a "bootstrap DNS". It was configured to Google's and Cloudflare's servers by default, but I changed it to Quad9's. Everything works fine. My VPN provider confirms that I am using their DNS servers and that my DNS traffic is encrypted.

What is going on under the hood? What is this "bootstrap DNS"? Why isn't it as easy as exchanging public keys, as with regular traffic that goes through my VPN router's wireguard port?

slazer2au 7 points a month ago

Doh uses domain names for name servers as opposed to IP addresses, but as a freshly booted PC doesn't know what IP your doh provider uses how does it craft a packet with a destination IP?

That is where your bootstrap DNS comes in. You do one clear text DNS request for your doh provider, then all other DNS requests are encrypted.

The public keys are stored brween reboots so no new exchange is needed.

save

path: 0 25616599, hotness: undefined, score: 7, children: 8

akunohana 3 points a month ago

I guessed as much. But, as I wrote to the commenter, I wonder why I couldn't just provide the DNS server's IP address in the router's configuration and thus avoiding that initial plain text bootstrapping step. I guess my other question - why there needs to be a separate package to set this up as opposed to "simply" configuring the router - is more about the specific OS than networking.

Thanks for sharing your insights! 😊

save

path: 0 25616599 25619290, hotness: undefined, score: 3, children: 5

slazer2au 2 points a month ago

There will generally be some form of load balancer in front of a HTTPS server even one that provides DoH services, and those load balancer won't know where to send the random https packet destined for it's own IP without a routing url.

save

path: 0 25616599 25619290 25619330, hotness: undefined, score: 2, children: 4

akunohana 1 point a month ago

Right, but my VPN provider provides both IPs and URLs to their servers, so I'm still wondering why I need a separate package on OpenWRT to be running in the background for this, i.e, why I can't just point all the DNS queries that comes to the router in question to that IP and URL. Again, maybe it's a really OpenWRT specific question... Sorry 😅

save

path: 0 25616599 25619290 25619330 25619413, hotness: undefined, score: 1, children: 3

tal 2 points a month ago

why I couldn’t just provide the DNS server’s IP address in the router’s configuration and thus avoiding that initial plain text bootstrapping step.

my VPN provider provides both IPs

If they don't identify their DoH server by name, but rather by IP address, I'd imagine that it would work. Have you tried?

searches

https://forum.openwrt.org/...

If your upstream servers don't need name resolutions (by using raw IP addresses), you don't need bootstrap servers.

EDIT: I personally wouldn't be too fussed about using an ISP's server to do that DNS resolution, unless one is concerned about your configuration still working even if the ISP's DNS server is broken.

From a privacy standpoint, the ISP is, well, your ISP. It can see traffic and can probably figure out that you're using DoH to a given provider anyway, and that's all the information it gets from a single query for the DoH server.
From a security standpoint, DoH should be authenticated via TLS, so the best an evil bootstrap DNS server can do is to produce a denial-of-service situation by pointing you somewhere that doesn't provide valid DoH responses, not cause you to trust some bogus DoH server.

save

path: 0 25616599 25619290 25619330 25619413 25619825, hotness: undefined, score: 2, children: 1

slazer2au 1 point a month ago

The IPs could be DoT servers.

save

path: 0 25616599 25619290 25619330 25619413 25619538, hotness: undefined, score: 1, children: 0

boredsquirrel 1 point a month ago

That just sounds like DoT but worse?

save

path: 0 25616599 25619092, hotness: undefined, score: 1, children: 1

slazer2au 2 points a month ago

The benefit DoH has over DoT is https is pretty much always allowed while you can rather effectively block 53 to everything except the name servers you want people to use.

save

path: 0 25616599 25619092 25619296, hotness: undefined, score: 2, children: 0

lime 3 points a month ago

you need the bootstrap dns server to find the doh provider.

save

path: 0 25616589, hotness: undefined, score: 3, children: 2

akunohana 2 points a month ago

I see. I just wonder why I couldn't set the IP address for my DNS provider in the router's configuration, since my VPN provider - whose DNS I'm using - provide the IP addresses and domain names on their website. 🤔

save

path: 0 25616589 25616639, hotness: undefined, score: 2, children: 1

lime 3 points a month ago

good question. looks like there isn't a actually a standard way to initiate doh, because it's still just a proposal.

also i guess it's helpful for getting through captive portals.

save

path: 0 25616589 25616639 25620354, hotness: undefined, score: 3, children: 0