Pull request: 2799 trusted proxies
Merge in DNS/adguard-home-wiki from 2799-proxies to master
Squashed commit of the following:
commit 530e19fd4ae77309100ac649e05662674d1f0457
Merge: 60098db ab8edf0
Author: Eugene Burkov <e.burkov@adguard.com>
Date: Mon Jul 26 19:27:59 2021 +0300
Merge branch 'master' into 2799-proxies
commit 60098db73043ecbd26a236719f8d2d773836d34b
Author: Eugene Burkov <e.burkov@adguard.com>
Date: Mon Jul 26 18:48:12 2021 +0300
Encryption: fix lists
commit c7e8ab9821507ee37b25653bd7ecb7c9953c1ff3
Author: Eugene Burkov <e.burkov@adguard.com>
Date: Mon Jul 26 18:35:55 2021 +0300
Encryption: spaces
commit cb54cabd6c7bcf6633fc9778679982ef8f68b200
Author: Eugene Burkov <e.burkov@adguard.com>
Date: Mon Jul 26 18:22:21 2021 +0300
Encryption: imp & fmt
commit d45c2fab8ee32012f74b0ae01d04344d4c0fa7ce
Author: Eugene Burkov <e.burkov@adguard.com>
Date: Mon Jul 26 15:54:04 2021 +0300
all: trusted_proxies & using with reverse proxy
Eugene Burkov
parent
ab8edf0458
commit
95020709e7
|
|
@ -357,7 +357,10 @@ Settings are stored in [YAML format](https://en.wikipedia.org/wiki/YAML), possib
|
||||||
- **Access settings**
|
- **Access settings**
|
||||||
- `allowed_clients` — IP addresses of allowed clients
|
- `allowed_clients` — IP addresses of allowed clients
|
||||||
- `disallowed_clients` — IP addresses of clients that should be blocked
|
- `disallowed_clients` — IP addresses of clients that should be blocked
|
||||||
- `blocked_hosts` — hosts that should be blocked
|
- `blocked_hosts` — Hosts that should be blocked
|
||||||
|
- `trusted_proxies` (**since v0.107.0**) – The list of IP addresses and CIDR
|
||||||
|
networks to detect proxy servers' addresses from which AdGuard Home should
|
||||||
|
accept and handle DNS-over-HTTPS requests.
|
||||||
- **DNS cache settings**
|
- **DNS cache settings**
|
||||||
- `cache_size` — DNS cache size (in bytes)
|
- `cache_size` — DNS cache size (in bytes)
|
||||||
- `cache_ttl_min` — override TTL value (minimum) received from upstream server. This value can't larger than 3600 (1 hour).
|
- `cache_ttl_min` — override TTL value (minimum) received from upstream server. This value can't larger than 3600 (1 hour).
|
||||||
|
|
|
||||||
301
Encryption.md
301
Encryption.md
|
|
@ -1,131 +1,282 @@
|
||||||
# AdGuard Home - Encryption
|
# AdGuard Home – Encryption
|
||||||
|
|
||||||
We are proud to say that AdGuard Home supports all modern DNS encryption protocols **out-of-the-box**:
|
We are proud to say that AdGuard Home supports all modern DNS encryption
|
||||||
|
protocols **out-of-the-box**:
|
||||||
|
|
||||||
- [DNS-over-HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS)
|
* [DNS-over-HTTPS](https://en.wikipedia.org/wiki/DNS_over_HTTPS)
|
||||||
- [DNS-over-TLS](https://en.wikipedia.org/wiki/DNS_over_TLS)
|
* [DNS-over-TLS](https://en.wikipedia.org/wiki/DNS_over_TLS)
|
||||||
- [DNS-over-QUIC](https://tools.ietf.org/html/draft-ietf-dprive-dnsoquic-01)
|
* [DNS-over-QUIC](https://tools.ietf.org/html/draft-ietf-dprive-dnsoquic-01)
|
||||||
|
|
||||||
> AdGuard Home also supports [DNSCrypt](https://dnscrypt.info/) (both client-side and server-side). [Read this](DNSCrypt) to learn about configuring AdGuard Home as a DNSCrypt server.
|
> AdGuard Home also supports [DNSCrypt](https://dnscrypt.info/) (both
|
||||||
|
> client-side and server-side). [Read this](DNSCrypt) to learn about
|
||||||
|
> configuring AdGuard Home as a DNSCrypt server.
|
||||||
|
|
||||||
In this guide we will explain how to setup your own "Secure DNS" server with AdGuard Home.
|
In this guide we will explain how to setup your own "Secure DNS" server with
|
||||||
|
AdGuard Home.
|
||||||
|
|
||||||
1. [Install AdGuard Home on your server](#install)
|
1. [Install AdGuard Home on your server](#install)
|
||||||
2. [Register a domain name](#register)
|
1. [Register a domain name](#register)
|
||||||
3. [Get an SSL certificate](#certificate)
|
1. [Get an SSL certificate](#certificate)
|
||||||
- [Install CertBot](#certbot)
|
* [Install CertBot](#certbot)
|
||||||
- [Get a certificate using DNS challenge](#certbot-dnschallenge)
|
* [Get a certificate using DNS challenge](#certbot-dnschallenge)
|
||||||
- [Alternative to CertBot: Lego](#lego)
|
* [Alternative to CertBot: Lego](#lego)
|
||||||
4. [Configure AdGuard Home](#configure-home)
|
1. [Configure AdGuard Home](#configure-home)
|
||||||
5. [Configure your devices](#configure-devices)
|
1. [Using with reverse proxy](#reverse-proxy)
|
||||||
|
* [Nginx](#nginx)
|
||||||
|
* [Cloudflare CDN](#cf-cdn)
|
||||||
|
1. [Configure your devices](#configure-devices)
|
||||||
|
* [Android](#android)
|
||||||
|
* [iOS](#ios)
|
||||||
|
* [Windows](#windows)
|
||||||
|
* [MacOS](#macos)
|
||||||
|
* [Other implementations](#other-imps)
|
||||||
|
|
||||||
<a id="install"></a>
|
|
||||||
|
|
||||||
## Install AdGuard Home on your server
|
|
||||||
|
|
||||||
It does not make much sense to configure DNS encryption inside of your own local network. The purpose of securing your DNS traffic is to secure it from third-parties that might be analyzing or modifying it. For instance, from your ISP.
|
## <a href="#install" id="install" name="install">Install AdGuard Home on your server</a>
|
||||||
|
|
||||||
It means that you will need a server with a public dedicated IP address. There are plenty of cheap cloud servers providers: [DigitalOcean](https://digitalocean.com), [Vultr](https://vultr.com), [Linode](https://www.linode.com/), etc. Just choose one, create a cloud server there, and [install AdGuard Home](Getting-Started) on your server.
|
It does not make much sense to configure DNS encryption inside of your own local
|
||||||
|
network. The purpose of securing your DNS traffic is to secure it from
|
||||||
|
third-parties that might be analyzing or modifying it. For instance, from your
|
||||||
|
ISP.
|
||||||
|
|
||||||
<a id="register"></a>
|
It means that you will need a server with a public dedicated IP address. There
|
||||||
|
are plenty of cheap cloud servers providers: [DigitalOcean][digital-ocean],
|
||||||
|
[Vultr][vultr], [Linode][linode], etc. Just choose one, create a cloud server
|
||||||
|
there, and [install AdGuard Home](Getting-Started) on your server.
|
||||||
|
|
||||||
## Register a domain name
|
|
||||||
|
|
||||||
First of all, you need a domain name. If you have never registered one, here is a [simple instruction](https://www.pcworld.com/article/241722/web-apps/how-to-register-your-own-domain-name.html) that will help you with that.
|
|
||||||
|
|
||||||
<a id="certificate"></a>
|
[digital-ocean]: https://digitalocean.com
|
||||||
|
[vultr]: https://vultr.com
|
||||||
|
[linode]: https://www.linode.com
|
||||||
|
|
||||||
## Get an SSL certificate
|
|
||||||
|
|
||||||
Both `DNS-over-HTTPS` and `DNS-over-TLS` are based on [TLS encryption](https://en.wikipedia.org/wiki/Transport_Layer_Security) so in order to use them, you will need to acquire an SSL certificate.
|
|
||||||
|
|
||||||
An SSL certificate can be bought from a "Certificate Authority" (CA), a company trusted by browsers and operating systems to enroll SSL certificates for domains.
|
## <a href="#register" id="register" name="register">Register a domain name</a>
|
||||||
|
|
||||||
Alternatively, you can get the certificate for free from ["Let's Encrypt" CA](https://letsencrypt.org/), a free certificate authority developed by the Internet Security Research Group (ISRG).
|
First of all, you need a domain name. If you have never registered one, here is
|
||||||
|
a [simple instruction][domain-name-register] that will help you with that.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[domain-name-register]: https://www.pcworld.com/article/241722/web-apps/how-to-register-your-own-domain-name.html
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## <a href="#certificate" id="certificate" name="certificate">Get an SSL certificate</a>
|
||||||
|
|
||||||
|
Both `DNS-over-HTTPS` and `DNS-over-TLS` are based on [TLS
|
||||||
|
encryption][tls-wikipedia] so in order to use them, you will need to acquire an
|
||||||
|
SSL certificate.
|
||||||
|
|
||||||
|
An SSL certificate can be bought from a "Certificate Authority" (CA), a company
|
||||||
|
trusted by browsers and operating systems to enroll SSL certificates for
|
||||||
|
domains.
|
||||||
|
|
||||||
|
Alternatively, you can get the certificate for free from ["Let's Encrypt"
|
||||||
|
CA][letsencrypt], a free certificate authority developed by the Internet
|
||||||
|
Security Research Group (ISRG).
|
||||||
|
|
||||||
In this guide I'll explain how to get a certificate from them.
|
In this guide I'll explain how to get a certificate from them.
|
||||||
|
|
||||||
<a id="certbot"></a>
|
### <a href="#certbot" id="certbot" name="certbot">Install CertBot</a>
|
||||||
|
|
||||||
### Install CertBot
|
|
||||||
|
|
||||||
Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt.
|
Certbot is an easy-to-use client that fetches a certificate from Let’s Encrypt.
|
||||||
|
|
||||||
1. Go to [https://certbot.eff.org/](https://certbot.eff.org/) and choose "None of the above" software and your operating system.
|
1. Go to [certbot.eff.org][certbot] and choose "None of the above"
|
||||||
2. Follow the installation instructions, and stop there - don't get to the "Get Started" section.
|
software and your operating system.
|
||||||
|
1. Follow the installation instructions, and stop there – don't get to the "Get
|
||||||
|
Started" section.
|
||||||
|
|
||||||
<a id="certbot-dnschallenge"></a>
|
### <a href="#certbot-dnschallenge" id="certbot-dnschallenge" name="certbot-dnschallenge">Get a certificate using DNS challenge</a>
|
||||||
|
|
||||||
### Get a certificate using DNS challenge
|
You have just got a domain name so I suppose using DNS challenge will be the
|
||||||
|
easiest way to get a certificate.
|
||||||
You have just got a domain name so I suppose using DNS challenge will be the easiest way to get a certificate.
|
|
||||||
|
|
||||||
Run this command and follow the certbot's instructions:
|
Run this command and follow the certbot's instructions:
|
||||||
|
|
||||||
```bash
|
```sh
|
||||||
sudo certbot certonly --manual --preferred-challenges=dns
|
sudo certbot certonly --manual --preferred-challenges=dns
|
||||||
```
|
```
|
||||||
|
|
||||||
In the end you'll get two files:
|
In the end you'll get two files:
|
||||||
|
|
||||||
- `fullchain.pem` -- your PEM-encoded SSL certificate
|
* `fullchain.pem` – your PEM-encoded SSL certificate.
|
||||||
- `privkey.pem` -- your PEM-encoded private key
|
|
||||||
|
* `privkey.pem` – your PEM-encoded private key.
|
||||||
|
|
||||||
Both will be necessary to configure AdGuard Home.
|
Both will be necessary to configure AdGuard Home.
|
||||||
|
|
||||||
> You will need to use the very same procedure to renew the existing certificate.
|
> You will need to use the very same procedure to renew the existing
|
||||||
|
> certificate.
|
||||||
|
|
||||||
<a id="lego"></a>
|
### <a href="#lego" id="lego" name="lego">Alternative to CertBot: Lego</a>
|
||||||
|
|
||||||
### Alternative to CertBot: Lego
|
There's also a really nice and easy-to-use alternative to CertBot called
|
||||||
|
[lego][lego-source].
|
||||||
|
|
||||||
There's also a really nice and easy-to-use alternative to CertBot called [lego](https://go-acme.github.io/lego/).
|
1. Install it using [an appropriate method][lego-install].
|
||||||
|
1. Choose your DNS provider from [the list][lego-provider]
|
||||||
|
and follow the instruction to obtain a certificate.
|
||||||
|
|
||||||
1. Install it using [an appropriate method](https://go-acme.github.io/lego/installation/).
|
|
||||||
2. Choose your DNS provider from [the list](https://go-acme.github.io/lego/dns/) and follow the instruction to obtain a certificate.
|
|
||||||
|
|
||||||
<a id="configure-home"></a>
|
|
||||||
|
|
||||||
## Configure AdGuard Home
|
[tls-wikipedia]: https://en.wikipedia.org/wiki/Transport_Layer_Security
|
||||||
|
[letsencrypt]: https://letsencrypt.org
|
||||||
|
[certbot]: https://certbot.eff.org
|
||||||
|
[lego-source]: https://go-acme.github.io/lego
|
||||||
|
[lego-install]: https://go-acme.github.io/lego/installation
|
||||||
|
[lego-provider]: https://go-acme.github.io/lego/dns
|
||||||
|
|
||||||
1. Open AdGuard Home web interface and go to settings.
|
|
||||||
2. Scroll down to the "Encryption" settings
|
|
||||||
|
|
||||||
3. Copy/paste the contents of the `fullchain.pem` file to "Certificates"
|
|
||||||
4. Copy/paste the contents of the `privkey.pem` file to "Private key"
|
|
||||||
5. Enter your domain name to "Server name"
|
|
||||||
6. Click "Save settings".
|
|
||||||
|
|
||||||
<a id="configure-devices"></a>
|
|
||||||
|
|
||||||
## Configure your devices
|
## <a href="#configure-home" id="configure-home" name="configure-home">Configure AdGuard Home</a>
|
||||||
|
|
||||||
### Android
|
1. Open AdGuard Home web interface and go to settings.
|
||||||
|
1. Scroll down to the "Encryption" settings.
|
||||||
|
|
||||||
- Android 9 supports `DNS-over-TLS` natively. To configure it, go to Settings → Network & internet → Advanced → Private DNS and enter your domain name there.
|
![][encryption-screenshot]
|
||||||
- [AdGuard for Android](https://adguard.com/en/adguard-android/overview.html) supports `DNS-over-HTTPS`, `DNS-over-TLS`, `DNSCrypt` and `DNS-over-QUIC`.
|
|
||||||
- [Intra](https://getintra.org/) adds `DNS-over-HTTPS` support to Android.
|
|
||||||
|
|
||||||
### iOS
|
3. Copy/paste the contents of the `fullchain.pem` file to "Certificates".
|
||||||
|
3. Copy/paste the contents of the `privkey.pem` file to "Private key".
|
||||||
|
3. Enter your domain name to "Server name".
|
||||||
|
3. Click "Save settings".
|
||||||
|
|
||||||
- iOS 14 and higher support `DNS-over-TLS` and `DNS-over-HTTPS` natively via configuration profiles. In order to make things easier, AdGuard Home can generate these configuration profiles for you. Just head to "Setup Guide" -> "DNS Privacy" and scroll to iOS.
|
|
||||||
- [AdGuard for iOS](https://adguard.com/en/adguard-ios/overview.html) supports `DNS-over-HTTPS`, `DNS-over-TLS`, `DNSCrypt` and `DNS-over-QUIC`.
|
|
||||||
- [DNSCloak](https://itunes.apple.com/app/id1452162351) supports `DNS-over-HTTPS` but in order to configure it to use your own server, you'll need to generate a [DNS Stamp](https://dnscrypt.info/stamps) for it.
|
|
||||||
|
|
||||||
### Windows
|
|
||||||
|
|
||||||
- Windows 10 Build 19628 and higher support `DNS-over-HTTPS` natively.
|
[encryption-screenshot]: https://user-images.githubusercontent.com/5947035/53301027-2a0c2b80-385f-11e9-81f3-bcc63de4eef1.png
|
||||||
- [AdGuard for Windows](https://adguard.com/en/adguard-windows/overview.html) supports `DNS-over-HTTPS`, `DNS-over-TLS`, `DNSCrypt` and `DNS-over-QUIC`.
|
|
||||||
|
|
||||||
### MacOS
|
|
||||||
|
|
||||||
- MacOS Big Sur and higher support `DNS-over-TLS` and `DNS-over-HTTPS` natively via configuration profiles. In order to make things easier, AdGuard Home can generate these configuration profiles for you. Just head to "Setup Guide" -> "DNS Privacy" and scroll to iOS.
|
|
||||||
|
|
||||||
### Other implementations
|
## <a href="#reverse-proxy" id="reverse-proxy" name="reverse-proxy">Using with reverse proxy</a>
|
||||||
|
|
||||||
- AdGuard Home itself can be a secure DNS client on any platform.
|
We already have a [guide][reverse-proxy-faq] on configuring a reverse proxy
|
||||||
- [dnsproxy](https://github.com/AdguardTeam/dnsproxy) supports all known secure DNS protocols.
|
server for accessing AdGuard Home web UI.
|
||||||
- [dnscrypt-proxy](https://github.com/jedisct1/dnscrypt-proxy) supports `DNS-over-HTTPS`.
|
|
||||||
- [Mozilla Firefox](https://www.mozilla.org/firefox/) supports `DNS-over-HTTPS`.
|
|
||||||
|
|
||||||
You can find more implementations [here](https://dnscrypt.info/implementations) and [here](https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients).
|
Since v0.107.0 AdGuard Home is able to restrict DNS-over-HTTPS requests which
|
||||||
|
came from the proxy server not included into "trusted" list. By default, it's
|
||||||
|
configured to accept requests from IPv4 and IPv6 loopback addresses.
|
||||||
|
|
||||||
|
To enable AdGuard Home to handle DNS-over-HTTPS requests from a reverse proxy
|
||||||
|
server, set the `trusted_proxies` setting in `AdGuardHome.yaml` to the IP
|
||||||
|
address of the proxy server. If you have several proxy servers, you can use a
|
||||||
|
CIDR instead of a simple IP address.
|
||||||
|
|
||||||
|
### <a href="#nginx" id="nginx" name="nginx">Nginx reverse proxy</a>
|
||||||
|
|
||||||
|
To configure AdGuard Home for accepting requests from Nginx reverse proxy
|
||||||
|
server, make sure that the reverse proxy server itself is configured correctly.
|
||||||
|
|
||||||
|
The `nginx.conf` file should contain the appropriate directives to add the
|
||||||
|
supported forwarding headers to the request which are `X-Real-IP` or
|
||||||
|
`X-Forwarded-For`. This may be achieved with `ngx_http_realip_module` which is
|
||||||
|
explained [here][ngx-http-realip-module]. In short, the module takes real IP
|
||||||
|
address of the client and writes it to the HTTP request's header. The AdGuard
|
||||||
|
Home will receive and interpret the value of this header as real client's
|
||||||
|
address. The address of the reverse proxy server will be received too and also
|
||||||
|
checked against the "trusted" proxies list.
|
||||||
|
|
||||||
|
For example, if the configuration of the reverse proxy server contains the
|
||||||
|
following directives:
|
||||||
|
|
||||||
|
```none
|
||||||
|
location /dns-query {
|
||||||
|
...
|
||||||
|
proxy_set_header X-Real-IP '1.2.3.4';
|
||||||
|
proxy_bind 192.168.1.2;
|
||||||
|
...
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
AdGuard Home will get the `192.168.1.2` as the address of your proxy server and
|
||||||
|
check it against the `trusted_proxies`. The `1.2.3.4` will be controlled by
|
||||||
|
access settings in case the proxy is "trusted".
|
||||||
|
|
||||||
|
### <a href="#cf-cdn" id="cf-cdn" name="cf-cdn">Cloudflare CDN</a>
|
||||||
|
|
||||||
|
The Cloudflare's content delivery network acts as the reverse proxy appending
|
||||||
|
its [own headers][cloudflare-headers] to the forwarded requests, which are
|
||||||
|
`CF-Connecting-IP` and `True-Client-IP`. These are also supported by AdGuard
|
||||||
|
Home so the reverse proxy servers' [addresses][cloudflare-addresses] may be
|
||||||
|
inserted into `trusted_proxies` list directly. An official Cloudflare's
|
||||||
|
reference on restoring the original visitor's IP may be found
|
||||||
|
[here][cloudflare-real-ip].
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[reverse-proxy-faq]: https://github.com/AdguardTeam/AdGuardHome/wiki/FAQ#how-to-configure-a-reverse-proxy-server-for-adguard-home
|
||||||
|
[ngx-http-realip-module]: https://nginx.org/en/docs/http/ngx_http_realip_module.html
|
||||||
|
[cloudflare-headers]: https://support.cloudflare.com/hc/en-us/articles/200170986
|
||||||
|
[cloudflare-addresses]: https://www.cloudflare.com/ips
|
||||||
|
[cloudflare-real-ip]: https://support.cloudflare.com/hc/en-us/articles/200170786
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## <a href="#configure-devices" id="configure-devices" name="configure-devices">Configure your devices</a>
|
||||||
|
|
||||||
|
### <a href="#android" id="android" name="android">Android</a>
|
||||||
|
|
||||||
|
* Android 9 supports `DNS-over-TLS` natively. To configure it, go to Settings
|
||||||
|
→ Network & internet → Advanced → Private DNS and enter your domain name
|
||||||
|
there.
|
||||||
|
|
||||||
|
* [AdGuard for Android][ag-for-android] supports `DNS-over-HTTPS`,
|
||||||
|
`DNS-over-TLS`, `DNSCrypt` and `DNS-over-QUIC`.
|
||||||
|
|
||||||
|
* [Intra][intra] adds `DNS-over-HTTPS` support to Android.
|
||||||
|
|
||||||
|
### <a href="#ios" id="ios" name="ios">iOS</a>
|
||||||
|
|
||||||
|
* iOS 14 and higher support `DNS-over-TLS` and `DNS-over-HTTPS` natively via
|
||||||
|
configuration profiles. In order to make things easier, AdGuard Home can
|
||||||
|
generate these configuration profiles for you. Just head to "Setup Guide" →
|
||||||
|
"DNS Privacy" and scroll to iOS.
|
||||||
|
|
||||||
|
* [AdGuard for iOS][ag-for-ios] supports `DNS-over-HTTPS`, `DNS-over-TLS`,
|
||||||
|
`DNSCrypt` and `DNS-over-QUIC`.
|
||||||
|
|
||||||
|
* [DNSCloak][dnscloak] supports `DNS-over-HTTPS` but in order to configure it
|
||||||
|
to use your own server, you'll need to generate a [DNS Stamp][stamps] for
|
||||||
|
it.
|
||||||
|
|
||||||
|
### <a href="#windows" id="windows" name="windows">Windows</a>
|
||||||
|
|
||||||
|
* Windows 10 Build 19628 and higher support `DNS-over-HTTPS` natively.
|
||||||
|
|
||||||
|
* [AdGuard for Windows][ag-for-windows] supports `DNS-over-HTTPS`,
|
||||||
|
`DNS-over-TLS`, `DNSCrypt` and `DNS-over-QUIC`.
|
||||||
|
|
||||||
|
### <a href="#macos" id="macos" name="macos">MacOS</a>
|
||||||
|
|
||||||
|
* MacOS Big Sur and higher support `DNS-over-TLS` and `DNS-over-HTTPS`
|
||||||
|
natively via configuration profiles. In order to make things easier, AdGuard
|
||||||
|
Home can generate these configuration profiles for you. Just head to "Setup
|
||||||
|
Guide" → "DNS Privacy" and scroll to iOS.
|
||||||
|
|
||||||
|
### <a href="#other-imps" id="other-imps" name="other-imps">Other implementations</a>
|
||||||
|
|
||||||
|
* AdGuard Home itself can be a secure DNS client on any platform.
|
||||||
|
|
||||||
|
* [dnsproxy][ag-dnsproxy] supports all known secure DNS protocols.
|
||||||
|
|
||||||
|
* [dnscrypt-proxy][dnscrypt-proxy] supports `DNS-over-HTTPS`.
|
||||||
|
|
||||||
|
* [Mozilla Firefox][firefox] supports `DNS-over-HTTPS`.
|
||||||
|
|
||||||
|
You can find more implementations [here][dnscrypt-imps1] and
|
||||||
|
[here][dnscrypt-imps2].
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
[ag-for-android]: https://adguard.com/en/adguard-android/overview.html
|
||||||
|
[intra]: https://getintra.org
|
||||||
|
[ag-for-ios]: https://adguard.com/en/adguard-ios/overview.html
|
||||||
|
[dnscloak]: https://itunes.apple.com/app/id1452162351
|
||||||
|
[stamps]: https://dnscrypt.info/stamps
|
||||||
|
[ag-for-windows]: https://adguard.com/en/adguard-windows/overview.html
|
||||||
|
[ag-dnsproxy]: https://github.com/AdguardTeam/dnsproxy
|
||||||
|
[dnscrypt-proxy]: https://github.com/jedisct1/dnscrypt-proxy
|
||||||
|
[firefox]: https://www.mozilla.org/firefox
|
||||||
|
[dnscrypt-imps1]: https://dnscrypt.info/implementations
|
||||||
|
[dnscrypt-imps2]: https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue