An article "Securing Home Networks and PCs with DNSCrypt-Proxy"

[kkovaletp]

I'd like to share with you my new article about DNScrypt-proxy and ask you to provide your feedback (like, comment, and repost on the article's page if you like it will help to promote it in the platform algorithms).

This article contains a theoretical explanation of how the name resolution works and why/how you need to secure it. After which there is a guide to secure your systems and network from DNS leakage and related types of attacks, adding some DNS filtering as well.

https://www.linkedin.com/pulse/securing-home-networks-pcs-dnscrypt-proxy-kostiantyn-koval-jw1qf

Thanks in advance for your thoughts.

[jedisct1]

This is an excellent article, congrats! It probably took a long time to write.

The only thing that's really missing IMHO is Anonymized DNS, that dnscrypt-proxy has had support for a long time. Without relays, servers know every client's IP address and what queries they sent. Plain DNSCrypt or DoH only solves half of the problem.

[kkovaletp]

Thanks!

Setting this config on the mentioned 3 systems with trying different options and installation scenarios took ~ 2 weeks (not spending all my time doing that), writing an article and enhancing it then - 1 more week. But I was motivated to share my experience and by this add some value to the community.

I didn't use the Anonymized DNS functionality in my setup on purpose to not introduce additional complexity and increase latency. For my use case having DNS traffic encrypted and behaving as a regular HTTPS is enough, as I trust Cloudflare and Quad9 enough to not worry about logging my IP and queries.

An alternative scenario would require setting up a relay somewhere in a cloud (outside of my network so that its IP is completely unrelated to connected devices), paying for the hosting, maintaining it in addition to my existing systems, as well as optimizing networking between my home and the cloud to keep the latency impact as low as possible. And this is only the case for working from home. If I get my laptop to a cafe or my friend's home, the latency from that network to my relay cannot be predicted, as different ISPs have their own routes even if their clients are located within the same block.

You might propose setting the relay inside my home network or in a DMZ (logically outside of my home network, but connected to the same router and using the same Internet channel) - that doesn't make sense, as the relay's IP is still the same as my router's IP, so from DNS server nothing changes. Or you could propose connecting to some public relay - in this case, I have to trust the relay service provider instead of the DNS service provider. While both Cloudflare and Quad9 have their reputation actively maintained, I don't know anything about the relay service provider (and even can assume that some data collectors might host such relays, so that they can collect such DNS data from people, thinking that they are protected).

Anyway, I didn't dig deep in that direction, as I don't want to include additional intermediate actors into my sequence of DNS processing systems, increasing latency and adding potential points of failure.

Please let me know if my understanding of available options is wrong at some level and if I miss some gamechanger.

[jedisct1]

I was just referring to https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Anonymized-DNS

There's nothing to setup on your own, besides choosing relays in the configuration.

[kkovaletp]

Thanks for providing the wiki page with the description!
Based on it:

• I need to trust a relay to not log an IP. But it's great that a relay cannot decrypt packets and doesn't see queries and responses (I assume that the traffic from the DNS server back to my system is also routed through the same relay)
• I'm limited to DNScrypt protocol, which is easier to be separated and blocked by ISP
• It still adds some latency because a relay has to be located in some other network

However, there is an ODoH https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Oblivious-DoH

• still experimental
• again need to trust a relay
• also limited to ODoH-supporting servers
• and it adds a latency as well

I remember from somewhere that it is possible to deploy a personal relay, which covers the issue with trust, but as I described earlier, introduces a lot of new issues.

So, for me personally, It's not worth it.

However, as I mentioned in my article, you need to review and challenge my template to make your own configuration based on your needs and preferences.