Actions

Alternative DNS Resolver

From Whonix


Connect-20333640.jpg

Introduction[edit]

By Whonix ™ default, Tor is used for DNS resolution. If you suspect a Tor exit relay to tamper with DNS, you can get a second opinion from another non-Tor DNS server. This may also be useful, in special cases if you want to resolve types of DNS over Tor, which are unsupported by Tor itself, such as MX [1], SRV or DNSSEC.

It is recommended against to use non-Tor DNS resolvers for an extended amount of time. Although it is technically possible to completely replace DNS resolution (not using Tor for DNS resolution anymore), it is recommended against. That would add too much power to a single DNS server. Using a permanent DNS server is recommended against just as using a permanent Tor exit relay is recommended against.

Note, that even if you correctly set up all settings, it might happen that this won't work. Sometimes Tor or the DNS server causes a timeout. This gets even worse, when you additionally tunnel the DNS request through an additional proxy (for example: Tor → JonDonym → DNS server).

Read first: Stream Isolation.

Required knowledge:

  • Difference between encryption and authentication.
  • All traffic originating from Whonix-Workstation ™ and Whonix-Gateway ™ is routed over Tor. [2] [3] [4] [5] [6] [7] [8] (<-- read the footnotes)

Ambox warning pn.svg.png Note that most applications, such as Tor Browser, will not automatically profit from setting up an alternative DNS resolver.

  • This is because applications in Whonix ™ are configured to use SocksPort instead of Trans- or DnsPort, see Stream Isolation for details.
  • Another reason is, that most applications do not yet make use of authenticated DNS (DNSSEC).

However, you could use alternative DNS revolvers with these applications when deconfiguring socks proxy settings.

DNSCrypt[edit]

Introduction[edit]

DNSCrypt supports encryption and DNSSEC (authentication).

These instructions completely replace Tor's DNS resolver with a dnscrypt-enabled resolver for all users and the whole system. Not recommended for a longer amount of time, see warning above. Some hints are included how to do it only for a specific user account.

Installation[edit]

Apply all instructions inside your Whonix-Workstation ™.

1) Install the dnscrypt-proxy package.

Install dnscrypt-proxy.

1. Update the package lists. 

sudo apt update

2. Upgrade the system. 

sudo apt full-upgrade

3. Install the dnscrypt-proxy package.

Using apt command line parameter --no-install-recommends is in most cases optional. 

sudo apt install --no-install-recommends dnscrypt-proxy

4. Done.

The procedure of installing dnscrypt-proxy is complete.

2) Open file /etc/dnscrypt-proxy/dnscrypt-proxy.toml in an editor with root rights.

This box uses sudoedit for better security [archive]. This is an example and other tools can also achieve the same goal. If this example does not work for you or if you are not using Whonix ™, please refer to this link. 

sudoedit /etc/dnscrypt-proxy/dnscrypt-proxy.toml

Add the following text at the very top of the file. Note: The default server did not work for the author of this page. Therefore the following instructions advice to comment that server out and add a random alternative server was chosen which worked. [9] This is not an endorsement or non-endorsement of any server. Pick your own server. DNSCrypt publishes a list of servers here [archive]. 

force_tcp = true

#proxy = "socks5://127.0.0.1:9050"

server_names = ['arvind-io']

Comment out: 

server_names = ['cloudflare']

In other words, rewrite server_names = ['cloudflare'] to #server_names = ['cloudflare'] by adding a hash # in front of it. So it would look like this. 

#server_names = ['cloudflare']

Save.

Restart dnscrypt-proxy.service. 

sudo systemctl restart dnscrypt-proxy.service

Restart dnscrypt-proxy.socket. 

sudo systemctl restart dnscrypt-proxy.socket

3) Open file /etc/resolv.conf in an editor with root rights.

This box uses sudoedit for better security [archive]. This is an example and other tools can also achieve the same goal. If this example does not work for you or if you are not using Whonix ™, please refer to this link. 

sudoedit /etc/resolv.conf

4) Comment out everything and add [10] (It is not 127.0.0.1. It really is 127.0.2.1.): 

options use-vc
nameserver 127.0.2.1

Save.

Testing[edit]

Obstacles[edit]

  • Test websites might be dysfunctional, show false-positives.
  • Tor Browser does not use system DNS but uses Tor to resolv DNS.
  • Firefox might due to a bug disable DNSSEC.
  • Firefox might not use system DNS but use its own DNS.
  • Noscript disabling script will break test websites.
  • VirtualBox users: VBoxManage modifyvm "$VMNAME" --natdnsproxy1 on breaks DNS.

DNSCrypt In Use[edit]

Stop dnscrypt-proxy systemd socket. 

sudo systemctl stop dnscrypt-proxy.socket

Test again. Now it is expected to fail.

Restart dnscrypt-proxy systemd socket. 

sudo systemctl restart dnscrypt-proxy.socket

Test again. Now it is expected to work.

DNSSec[edit]

dig +multiline . DNSKEY

Expected output using Whonix ™ default (using Tor's SocksPort DNS resolver. 

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> +multiline . DNSKEY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOTIMP, id: 42982
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; WARNING: EDNS query returned status NOTIMP - retry with '+noedns'

;; QUESTION SECTION:
;.			IN DNSKEY

;; Query time: 0 msec
;; SERVER: 10.139.1.1#53(10.139.1.1)
;; WHEN: Wed Jul 17 17:41:33 UTC 2019
;; MSG SIZE  rcvd: 17

Expected output using DNSCrypt. 

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> +multiline . DNSKEY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63055
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1252
;; QUESTION SECTION:
;.			IN DNSKEY

;; ANSWER SECTION:
.			8461 IN	DNSKEY 256 3 8 (
				AwEAAcTQyaIe6nt3xSPOG2L/YfwBkOVTJN6mlnZ249O5
				Rtt3ZSRQHxQSW61AODYw6bvgxrrGq8eeOuenFjcSYgNA
				McBYoEYYmKDW6e9EryW4ZaT/MCq+8Am06oR40xAA3fCl
				OM6QjRcT85tP41Go946AicBGP8XOP/Aj1aI/oPRGzRnb
				oUPUok/AzTNnW5npBU69+BuiIwYE7mQOiNBFePyvjQBd
				oiuYbmuD3Py0IyjlBxzZUXbqLsRL9gYFkCqeTY29Ik7u
				suzMTa+JRSLz6KGS5RSJ7CTSMjZg8aNaUbN2dvGhakJP
				h92HnLvMA3TefFgbKJphFNPA3BWSKLZ02cRWXqM=
				) ; ZSK; alg = RSASHA256 ; key id = 59944
.			8461 IN	DNSKEY 257 3 8 (
				AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTO
				iW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN
				7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5
				LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8
				efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7
				pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLY
				A4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws
				9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
				) ; KSK; alg = RSASHA256 ; key id = 20326

;; Query time: 0 msec
;; SERVER: 127.0.2.1#53(127.0.2.1)
;; WHEN: Wed Jul 17 17:43:09 UTC 2019
;; MSG SIZE  rcvd: 578

Browser Tests[edit]

FAQ[edit]

Why not Use DNSCrypt by Default in Whonix ™?[edit]

DNSCrypt [archive] may have good use cases for clearnet activities. However, it is not useful in Whonix ™ and therefore should not be installed and activated by default for everyone. Although some users may have high expectations, DNSCrypt does not magically solve all DNS-related security issues, nor does it implement end-to-end DNS encryption to the destination server. [11] Most important of all, the server will still see all DNS requests in cleartext. [12]

There are several other reasons why DNSCrypt is not activated by default. Firstly, Tor distributes trust because the DNS server changes as circuits are rotated. For pre-installed applications, circuits are also stream-isolated and change every ten minutes by default. Notably, in early 2018 there are 78 open resolvers [archive] that support the protocol.

Public resolvers supporting DNSCrypt have not yet acted in a way to cause mistrust. However, even if the operators were absolutely trustworthy, complete confidence is also needed in their servers - it is unwise to let the DNS security for all Whonix ™ users depend on a few servers. Another consideration is load balancing. If Whonix ™ relied upon a DNSCrypt supporting server by default, DNS would break for all users if that server ever decided to forbid connections from the Tor network [13] or if the servers went down for maintenance.

Would result in a unique web fingerprint, i.e. visited websites can distinguish Whonix ™ users using DNSCrypt from other Tor users using Tor to resolve DNS.

For more detailed information about DNSCrypt, refer to these related forum [archive] posts [archive].

Can I Use DNSCrypt on the Host or Router for Clearnet?[edit]

This configuration is possible; read the next section before proceeding.

Does DNSCrypt on the Host or Router Harm Anonymity when Using Tor / Whonix ™?[edit]

The short answer to this question is no. The longer answer is DNSCrypt on the host or in the router only affects clearnet activities. Tor assumes in advance that a user's local network and ISP are completely unsafe and untrustworthy. Tor and Whonix ™ are unaffected by DNS settings that are made on the host or in the router.

It is debatable whether DNSCrypt is useful or not for clearnet activities since there are various pros and cons. It is useful when using foreign or untrusted Wi-Fi networks that are shared with others, since DNS requests could potentially be modified or read. That said, trust is just shifted from the ISP to a DNSCrypt-supporting DNS server, such as OpenDNS. If the DNS server supporting DNSCrypt leaks a user's network address and/or logs queries as part of their business model, then it might actually be worse than using the ISP! It is hard to mount an argument for which party is more trustworthy, the ISP or a third party provider.

Alternatives[edit]

DNS with DNSSEC over TCP using Unbound[edit]

Introduction[edit]

source for this chapter: CZ NIC LABS [archive]

The CZ.NIC Labs DNS resolver has been chosen as an example. Feel free to use and other DNS resolver at your own choice.

These instructions have not been tested for years. There might be no reasons to use these instructions. Above DNSCrypt might do everything that is required.

Installation[edit]

Everything inside your Whonix-Workstation ™.

Install unbound [archive] and socat [archive]. 

sudo apt install unbound socat

Open /etc/unbound/unbound.conf. 

sudoedit /etc/unbound/unbound.conf

Add the following lines. 

#tcp-upstream goes under "server:" section
    tcp-upstream: yes

#put forward-zone somewhere at the end of file
forward-zone:
    name: "."
    forward-addr: 0.0.0.0@5353

Starting[edit]

Open a terminal and start socat. 

socat TCP4-LISTEN:5353,bind=localhost,reuseaddr,fork SOCKS4A:10.152.152.10:217.31.204.130:53,socksport=9150

Open another terminal tab and restart unbound. 

sudo service unbound restart

Using[edit]

Test with dig. 

dig +dnssec nic.cz @localhost

Please refer to upstream documentation on how to interpret the DNSSEC test results.

httpsdnsd by JonDos[edit]

Introduction[edit]

Source: anonymous-proxy-servers.net [archive] and also use it as a more verbose tutorial, but keep in mind that their tutorial is JonDonym specific, while this tutorial is Tor specific.

These instructions have not been tested for years. There might be no reasons to use these instructions. Above DNSCrypt might do everything that is required.

Installation[edit]

Everything inside your Whonix-Workstation ™.

Install dependencies. 

sudo apt install libnet-ssleay-perl libnet-server-perl libnet-dns-perl libxml-simple-perl liblog-log4perl-perl

Download httpsdnsd. (See source above in case download link changed.) 

scurl --remote-name https://anonymous-proxy-servers.net/downloads/httpsdnsd.tar.bz2

Or manually run curl with these parameters. [14] 

curl --tlsv1.3 --proto =https --remote-name https://anonymous-proxy-servers.net/downloads/httpsdnsd.tar.bz2


Unpack. 

.

Go into the httpsdnsd folder. 

cd httpsdnsd

Install httpsdnsd. [15] 

sudo install.sh

Add a new user for httpsdnsd. 

sudo adduser --system --disabled-password --group httpsdns_daemon

Editing /etc/resolv.conf is not required. (You still could out comment everything against DNS leaks.)

Create a firewall script. 

nano dns-fw.sh

Insert these firewall rules. 

# Flush old rules
iptables -F
iptables -t nat -F
iptables -X

# Redirect DNS traffic to httpdnsd.
iptables -t nat -A OUTPUT -p udp -m owner --uid-owner anonuser --dport 53 -j REDIRECT --to-ports 4053

# Accept connections to the httpdnsd.
iptables -t filter -A OUTPUT -p udp -m owner --uid-owner anonuser --dport 4053 -j ACCEPT

# Reject all other traffic for anonuser.
iptables -t filter -A OUTPUT ! -o lo -m owner --uid-owner anonuser -j REJECT

Install Privoxy. [16] 

sudo apt install privoxy

Open the privoxy configuration file. 

nano /etc/privoxy/config

Add the following to your privoxy configuration file. 

# Theoretically you can tunnel through any
# http or socks proxy. Local or remote proxy.
# Inside Whonix-Workstation ™, due to design,
# everything will be tunneled through Tor first.

# Using Tor's socks5 proxy, running on Whonix-Gateway ™. 
# Change the port, see above...
forward-socks5 / 10.152.152.10:9112 .

# Another example using a http proxy.
# (In this case, JonDo running on localhost.)
# forward / 127.0.0.1:4001

Restart privoxy to enable the changes. 

sudo /etc/init.d/privoxy restart

Privoxy is now listening on 127.0.0.1:8118. [17]

Starting[edit]

Run httpsdnsd. [18] [19] [20] [21] 

sudo httpsdnsd --https_proxy_port=8118 --runasdaemon

Activate the firewall. Shouldn't show any errors. 

sudo ./dns-fw.sh

Using[edit]

Open a console and switch to anonuser. 

su anonuser

Resolve DNS. 

nslookup check.torproject.org

Footnotes[edit]

  1. ↑ Required for some Mixmaster servers over Tor
  2. ↑ Since Whonix ™ version 0.2.1 Whonix-Gateway ™ traffic is also routed over Tor. In this way, use of Whonix ™ is hidden from persons or systems observing the network.
  3. ↑ To preserve the anonymity of a user's Whonix-Workstation ™ activities, it is not necessary to torify Whonix-Gateway ™ own traffic.
  4. ↑ For reader interest: If DNS settings on Whonix-Gateway ™ are changed in /etc/resolv.conf, this only affects Whonix-Gateway ™ own DNS requests issued by applications using the system's default DNS resolver. By default, no applications issuing network traffic on Whonix-Gateway ™ use the system's default DNS resolver. All applications installed by default on Whonix-Gateway ™ that issue network traffic (apt, systemcheck, sdwdate) are explicitly configured, or forced by uwt wrappers, to use their own Tor SocksPort (see Stream Isolation).
  5. ↑ Whonix-Workstation ™ default applications are configured to use separate Tor SocksPorts (see Stream Isolation), thereby not using the system's default DNS resolver. Any applications in Whonix-Workstation ™ that are not configured for stream isolation - for example nslookup - will use the default DNS server configured in Whonix-Workstation ™ (via /etc/network/interfaces), which is the Whonix-Gateway ™. Those DNS requests are redirected to Tor's DnsPort by Whonix-Gateway ™ firewall. Whonix-Gateway ™ /etc/resolv.conf does not affect Whonix-Workstation ™ DNS requests.
  6. ↑ Traffic generated by the Tor process itself which runs by Debian default under user debian-tor originating from Whonix-Gateway ™ can use the internet normally. This is because user debian-tor is exempted in Whonix-Gateway ™ Firewall, allowed to use the "normal" internet.
  7. ↑ The Tor software (as of 0.4.5.6) (and no changed were announced at time of writing) almost exclusively uses TCP traffic. See also Tor wiki page, chapter UDP. For DNS, see next footnote.
  8. ↑ Tor does not require, use functional (system) DNS for most functionality. IP addresses of Tor directory authorities are hardcoded in the Tor software as per Tor upstream default. Exceptions include:
    • proxy settings using proxies with host names rather than IP addresses
    • the Tor pluggable transport meek lite to resolve domains used in setting url=, front= to IP addresses.
  9. ↑ Test was done using: 
    dig +dnssec google.com
  10. ↑ options use-vc is optional as in it also works without it.
  11. ↑ Conceptually, end-end DNS encryption is illogical. If the IP address of the destination server was known in advance, then DNS would not be required in the first place.
  12. ↑ https://security.stackexchange.com/questions/162601/what-are-the-privacy-advantages-of-a-dns-encryption-service-such-as-dnscrypt [archive]
  13. ↑ Due to the Tor network abuse such as DDOS attacks on their servers.
  14. ↑ This has the same effect as the scurl command above.
  15. ↑ It contains also a uninstall.sh, if you want to uninstall it later.
  16. ↑ torproject.org Wiki Version 95 [archive] of this site contains a working example using Polipo. Changed later to Privoxy, because Privoxy can be useful for other tasks as well. (Incoming: TransPort, http proxy; forwarding: http and socks.)
  17. ↑ For debugging you can enter this IP/port into Tor Browser as http proxy and try if you can still reach check.torproject.org. Deactivate after testing.
  18. ↑ For debugging, kill httpsdnsd and drop the --runasdaemon.
  19. ↑ Run httpsdnsd --help or man httpsdnsd for help.
  20. ↑ Httpsdnsd will by default listen on localhost port 4053 for DNS queries.
  21. ↑ --https_proxy_port=8118 will redirect traffic to port 8118, where Privoxy is listening. This is necessary because Tor offers a socks proxy and httpsdnsd requires a http proxy. Privoxy translates from http to socks.
Fosshost is sponsors Kicksecure ™ stage server 100px
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: Discourse logo.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contribute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png link=mailto:?subject=Alternative DNS Resolver&body=./Alternative_DNS_Resolver link=https://reddit.com/submit?url=./Alternative_DNS_Resolver&title=Alternative DNS Resolver link=https://news.ycombinator.com/submitlink?u=./Alternative_DNS_Resolver&t=Alternative DNS Resolver link=https://mastodon.technology/share?message=Alternative DNS Resolver%20./Alternative_DNS_Resolver&t=Alternative DNS Resolver

Interested in becoming an author for the Whonix ™ News Blog or writing about anonymity, privacy and security? Please get in touch!

https link onion link Priority Support | Investors | Professional Support

Whonix ™ | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Retrieved from "https://www.whonix.org/w/index.php?title=Alternative_DNS_Resolver&oldid=70174"
By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.
More information