With DNS over HTTPS (DoH), DNS queries and responses are encrypted and sent via the HTTP or HTTP\/2 protocols. DoH ensures that attackers cannot forge or alter DNS traffic. DoH uses port 443, which is the standard HTTPS traffic port, to wrap the DNS query in an HTTPS request. DNS queries and responses are camouflaged within other HTTPS traffic since it all comes and goes from the same port.<\/p>\nhttps:\/\/developers.cloudflare.com\/1.1.1.1\/<\/a>encryption<\/a>\/dns-over-https\/<\/a><\/cite><\/blockquote>\n\n\n\n In today’s landscape, original ideas are scarce; I’ve heavily drawn from the exceptional work of others. Specifically:<\/p>\n\n\n\n If you choose to run Ubuntu server as I do, it normally blocks Port 53 which is crucial for DNS resolution. The fix is to apply these commands at the CLI:<\/p>\n\n\n\n Normally, Docker services are confined to an internal network with specific ports exposed. But with the Macvlan network driver<\/a>, one can provide an IP Address to each service. Both worked as expected – here’s the Macvlan option.<\/p>\n\n\n\n <\/p>\n\n\n\n For portability, I elected to use a Docker Compose <\/a>environment<\/a> file<\/a>.<\/p>\n\n\n\n Because of persistent issues in getting the Cloudflared service to consistently establish the tunnel, particularly after a Docker host reboot, I opted to run two instances: one for tunnel establishment (tunnel-up) and the other for executing the dns-proxy command. <\/p>\n\n\n\n Adapting this configuration is easy due to the parameters in the .env file. Notice how each service depends on the one before to control boot order.<\/p>\n\n\n\n Switching to another proxy server like Traefik<\/a> or Caddy<\/a> should be straightforward.<\/p>\n\n\n\n Resulting view from Portainer:<\/strong><\/p>\n\n\n\n\n
Bits and Bobs<\/h2>\n\n\n\n
\n
\n
\n
\n
Configuration<\/h2>\n\n\n\n
sudo sed -r -i.orig 's\/#?DNSStubListener=yes\/DNSStubListener=no\/g' \/etc\/systemd\/resolved.conf\n\nsudo sh -c 'rm \/etc\/resolv.conf && ln -s \/run\/systemd\/resolve\/resolv.conf \/etc\/resolv.conf'\n\nsudo systemctl restart systemd-resolved <\/code><\/pre>\n\n\n\n#---------------------------------------\n# Docker macvlan example\n# Must run this on Docker host prior to \n# deploying the stack\n#---------------------------------------\ndocker network create -d macvlan \\\n --subnet=192.168.10.0\/24 \\\n --gateway=192.168.10.1 \\\n -o parent=eth0 doh_lan<\/code><\/pre>\n\n\n\n.env<\/strong><\/h3>\n\n\n\n
\n#---------------------------\n# Docker-compose parameters\n#---------------------------\n# Common\nTZ=America_New_York\nPREFIX=onlan\n\n# Service: Cloudflared (part 1 and 2)\nCF1_ORDER=1 # numbers the services\nC1_NAME=tunnel-up\nTUNNEL_UP_IP:192.168.10.11\n\nCF2_ORDER=2\nC2_NAME=tunnel-dns\nCMD_TUNNEL='tunnel --no-autoupdate run --token <YOUR CLOUDFLARED TOKEN HERE>'\nDNS_TUNNEL_IP=192.168.10.12\n\n# Service: PiHole\nPI_ORDER=3 \nPI_NAME=pihole\nWEB_PORT=80\nWEBPASSWORD=changeme\nDNS1=192.168.10.12#53\nDNS2=no\nPI_IP=192.168.10.13\n\n# Service (npm) nginx proxy manager\nNPM_ORDER=4 \nNPM_NAME=proxy\nNPM_IP=192.168.10.14\n\n<\/code><\/pre>\n\n\n\ndocker-compose.yml<\/strong><\/h3>\n\n\n\n
\n#-------------------------------------------------------------------------\n# Docker Stack\n#--------------------------------------------------------------------------\n# Services:\n# 1. Cloudflared-tunnel\n# 2. Cloudflared-dns\n# 3. Pi-Hole\n# 4. NPM (Nginx Proxy Manager)\n#--------------------------------------------------------------------------\nversion: '3.9'\nservices:\n# Creates a connection to a Cloudflare Zero-Trust Tunnel\n cloudflared-tunnel:\n container_name: ${CF1_ORDER}-${PREFIX}-${C1_NAME}\n command: ${CMD_TUNNEL}\n image: 'cloudflare\/cloudflared:latest'\n restart: unless-stopped\n networks:\n doh_lan:\n ipv4_address: ${TUNNEL_UP_IP}\n\n# Layers on the Cloudflared proxy-dns command\n cloudflared-dns:\n container_name: ${CF2_ORDER}-${PREFIX}-${C2_NAME}\n depends_on:\n - \"cloudflared-tunnel\"\n restart: unless-stopped\n image: cloudflare\/cloudflared\n depends_on:\n - \"cloudflared-tunnel\" \n command: proxy-dns\n environment:\n - \"TUNNEL_DNS_UPSTREAM=https:\/\/1.1.1.1\/dns-query,https:\/\/1.0.0.1\/dns-query,https:\/\/9.9.9.9\/dns-query,https:\/\/149.112.112.9\/dns-query\"\n - \"TUNNEL_METRICS=0.0.0.0:49312\"\n - \"TUNNEL_DNS_ADDRESS=0.0.0.0\"\n - \"TUNNEL_DNS_PORT=53\"\n sysctls:\n - net.ipv4.ip_unprivileged_port_start=53\n networks:\n doh_lan:\n ipv4_address: ${DNS_TUNNEL_IP}\n\n pihole:\n image: pihole\/pihole\n container_name: ${PI_ORDER}-${PREFIX}-${PI_NAME}\n hostname: ${PREFIX}${PI_NAME}\n restart: unless-stopped\n depends_on:\n - \"cloudflared-dns\"\n environment:\n - \"TZ=${TZ}\"\n - \"DNS1=${DNS1}\"\n - \"DNS2=${DNS2}\"\n - \"DNSMASQ_LISTENING=all\"\n - \"WEBPASSWORD=${WEBPASSWORD}\"\n - \"WEB_PORT=${WEB_PORT}\"\n volumes:\n - '\/home\/docker\/pihole\/config:\/etc\/pihole\/'\n - '\/home\/docker\/pihole\/dnsmasq:\/etc\/dnsmasq.d\/'\n networks:\n doh_lan:\n ipv4_address: ${PI_IP}\n# Nginx Proxy Manager and Certificate Management\n npm:\n image: 'jc21\/nginx-proxy-manager:latest'\n container_name: ${NPM_ORDER}-${PREFIX}-${NPM_NAME}\n restart: unless-stopped\n depends_on:\n - \"pihole\"\n ports:\n - '80:80'\n - '81:81'\n - '443:443'\n volumes:\n - \/home\/docker\/npm\/data:\/data\n - \/home\/docker\/npm\/letsencrypt:\/etc\/letsencrypt\n networks:\n doh_lan:\n ipv4_address: ${NPM_IP}\n\nnetworks:\n doh_lan:\n external:\n name: doh_lan\n<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/blog.vicnunes.com\/wp-content\/uploads\/2024\/05\/CleanShot-2024-05-03-at-12.56.49@2x-1024x460.png\")
<\/figure>\n\n\n\n