FreeBSD 14
Sponsored Link

BIND : DNS over HTTPS Client Settings : FreeBSD2023/12/20
 

Configure FreeBSD Client to refer to your DNS over HTTPS Server.

[1]

Install dnscrypt-proxy.
Before it, make sure the DNS Stamp on the following site, it needs on dnscrypt-proxy settings.

⇒ https://dnscrypt.info/stamps/

Select or Input like follows. Then note the value [sdns://***] on [Stamp] section.

* Protocol : DNS-over-HTTPS (DoH)
* IP Address : your DNS-over-HTTPS server's IP address
* Host Name : your DNS-over-HTTPS server's hostname
* Path : the value for [endpoints] that you set on your DNS-over-HTTPS server settings
[2] Configure FreeBSD Client to refer to your DoH server.
root@node01:~ #
pkg install -y dnscrypt-proxy2
root@node01:~ #
mv /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml.org

root@node01:~ #
vi /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml
# create new

listen_addresses = ['127.0.0.1:53']
ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = false
doh_servers = true
odoh_servers = false
require_dnssec = false
max_clients = 250
keepalive = 30
use_syslog = true
log_files_max_size = 10
log_files_max_age = 7
log_files_max_backups = 1
reject_ttl = 10
cache = true
cache_size = 4096
cache_min_ttl = 2400
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600

# your DoH server
server_names = ['dlp.srv.world']

[query_log]
  file = '/var/log/dnscrypt-proxy/query.log'

[nx_log]
  file = '/var/log/dnscrypt-proxy/nx.log'

# set the Stamp value on [stamp] section that you made sure on [1]
[static]
  [static.'dlp.srv.world']
  stamp = 'sdns://AgcAAAAAAAAACTEwLjAuMC4zMAANZGxwLnNydi53b3JsZAovZG5zLXF1ZXJ5'
root@node01:~ #
mkdir /var/log/dnscrypt-proxy

root@node01:~ #
sysrc dnscrypt_proxy_uid="root"

dnscrypt_proxy_uid: -> root
root@node01:~ #
service dnscrypt-proxy enable

dnscrypt_proxy enabled in /etc/rc.conf
root@node01:~ #
service dnscrypt-proxy start

Starting dnscrypt_proxy.
root@node01:~ #
vi /etc/resolv.conf
# change DNS to the IP address that dnscrypt-proxy listens

search srv.world
nameserver 127.0.0.1
# verify resolution

root@node01:~ #
dig www.srv.world. 


; <<>> DiG 9.20.13 <<>> www.srv.world.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51069
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.srv.world.                 IN      A

;; ANSWER SECTION:
www.srv.world.          85474   IN      A       10.0.0.31

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Thu Oct 16 15:36:53 JST 2025
;; MSG SIZE  rcvd: 58

BIND : DNS over HTTPS Client Settings : Windows
 

Configure Windows Client to refer to your DNS over HTTPS Server. This example is based on Windows 11.

[3] Open the Network setting and click the [Edit] button on [DNS server assignment] section. Next, Input your DoH Server address on the [Preferred DNS] section. For [DNS over HTTPS] section, select [On (manual template)] and For [DNS over HTTPS template] section, input the value of [endpoints] in named.conf you set.
[4] After setting your DoH server, verify Name and Address Resolution.
Matched Content