Etherarp
Etherarp

Networking, Security, Linux

Share


Using CloudFlare 1.1.1.1 with TLS

Released in April 2018 by Cloudflare, 1.1.1.1 is a very attractive choice for resolving your DNS queries. It claims to be the fastest although it depends on you…

Rohan MolloyRohan Molloy

Released in April 2018 by Cloudflare, 1.1.1.1 is a very attractive choice for resolving your DNS queries. It claims to be the fastest although it depends on your location. It gets top marks for privacy by holding logs for a max of 24 hour and it offers an encrypted link with TLS.

Here is how to use the encrypted TLS version of their service (on a Linux box)

Install Unbound

sudo apt-get install unbound

Configure Unbound

cp /etc/unbound/unbound.conf /etc/unbound/unbound.conf.original
cat > /etc/unbound.conf
server:
    verbosity: 1
    do-tcp: yes
    do-udp:yes
    interface:192.168.1.1
    interface:127.0.0.1
    num-threads: 1
    root-hints:/etc/unbound/root.hints
    outgoing-port-permit: 32768-60999
    outgoing-port-avoid: 0-32767
    log-time-ascii: yes
    access-control:  127.0.0.0/8 allow
    access-control:  192.168.1.0/24 allow
    username: "unbound"
    forward-zone:
        name: "."
        forward-addr:1.1.1.1@853
        forward-ssl-upstream: yes 

Start Unbound

sudo systemctl start unbound
echo "nameserver 127.0.0.1" >/etc/resolv.conf

Test Unbound

[root@desktop ~]# dig example.com 

; <<>> DiG 9.11.2-P1-RedHat-9.11.2-1.P1.fc27 <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32326
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;example.com.			IN	A

;; ANSWER SECTION:
example.com.		3468	IN	A	93.184.216.34

;; Query time: 0 msec
;; SERVER: 127.0.53.53#53(127.0.0.1)
;; WHEN: Tue Apr 03 22:38:37 NZST 2018
;; MSG SIZE  rcvd: 56

Notice the query time of 0, because I queried it earlier, it got cached. The first query took about 150ms because TLS adds overhead

Full unbound tutorial

Running your own DNS with Unbound (and block ads)

Author

Rohan Molloy

View Comments