My Little DoH Setup
"DoH"[1], this 3-letters acronym is a buzzword on the Internet in 2019! It has been implemented in Firefox, Microsoft announced that Windows will support it soon. They are pro & con about encrypting DNS requests in HTTPS but it's not the goal of this diary to restart the debate. In a previous diary, he explained how to prevent DoH to be used by Firefox[2] but, this time, I'll play on the other side and explain to you how to implement it in a way to keep control of your DNS traffic (read: how to keep an eye on DNS request performed by users and systems). For a while, I had the idea to test a DoH configuration but I had some requirements:
- It must be transparent for users
- DNS requests must be logged (who resolved which domain and when)
- Local DNS zones like 'lab.domain.tld' or 'iot.domain.tld' must be supported (resolved via a local bind instance)
- Users are protected via a PiHole[3] (against advertisements & malicious domains)
- Integration with 3rd party tools
This weekend, I decided to reconfigure my network. Here is my current setup:
Endpoints (laptops, tablets, phones, visitors, etc) are using a PiHole instance (provided via DHCP) from their VLAN. Servers are using the normal Bind instance. PiHole forwards the allowed DNS requests to Bind. It is master and can resolve RFC1918 addresses from local zones (ex: *.lab.domain.tld). If the FQDN is unknown, it is forwarded to a local cloudflared[4] daemon via UDP/5353 that used DoH to resolve public names. To keep an eye on DNS requests, PiHole and Bind send their logs to my SIEM for further processing and reporting/alerting.
From a setup point of view, everything is running in Docker containers and, to increase my detection capabilities, my MISP instance is feeding PiHole and Bind with a daily export of malicious domains[5]. Let's see how it works in the coming days...
[1] https://en.wikipedia.org/wiki/DNS_over_HTTPS
[2] https://isc.sans.edu/forums/diary/Blocking+Firefox+DoH+with+Bind/25316
[3] https://pi-hole.net/
[4] https://github.com/cloudflare/cloudflared
[5] https://isc.sans.edu/forums/diary/DNS+Firewalling+with+MISP/24556
Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key
Reverse-Engineering Malware: Malware Analysis Tools and Techniques | Amsterdam | Jan 20th - Jan 25th 2025 |
Comments
Are you running Docker on Raspberry Pi to run PiHole or just the other services?
Anonymous
Nov 25th 2019
5 years ago
Anonymous
Nov 25th 2019
5 years ago
A question, please. Why or how does the endpoint that is running DoH (ie DNS over HTTPS) send its DNS questions (requests) to PiHole. Will it not directly contact the DoH servers on the internet on destination port 443/tcp?
Anonymous
Nov 27th 2019
5 years ago
Anonymous
Nov 29th 2019
5 years ago
Anonymous
Dec 14th 2019
4 years ago
Anonymous
Dec 14th 2019
4 years ago