dns

service dns: SDE M10-Smart M2 RS420
Domain Name Server (DNS) parameters

service dns dynamic

SDE M10-Smart M2 RS420

Dynamic DNS

Required

service dns dynamic interface <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Interface to send DDNS updates for

Instances

Multiple

Required

service dns dynamic interface <ifc> advisor <txt>

SDE M10-Smart M2 RS420

Advisor to enable or disable DDNS on the interface

Reference: system advisor <txt>

service dns dynamic interface <ifc> service <id>

SDE M10-Smart M2 RS420

Values

id – Service name used for DDNS

Instances

Multiple

Required

service dns dynamic interface <ifc> service <id> domain <id>

SDE M10-Smart M2 RS420

Domain registered with DDNS service

Values

hostname – Hostname registered with DDNS service
record – Record to be updated for RFC2136

Instances

Multiple

service dns dynamic interface <ifc> service <id> encrypted-password <password>

SDE M10-Smart M2 RS420

Encripted password or shared secret for DDNS service

Values

secret – Secret for RFC2136

service dns dynamic interface <ifc> service <id> login <id>

SDE M10-Smart M2 RS420

Login for DDNS service

Values

login – Login for DDNS service
keyname – Keyname for RFC2136

service dns dynamic interface <ifc> service <id> password <txt>

SDE M10-Smart M2 RS420

Password for DDNS service

Values

password – Password for DDNS service
secret – Secret for RFC2136

service dns dynamic interface <ifc> service <id> server <ipv4|id>

SDE M10-Smart M2 RS420

Server to send DDNS update to

Values

ipv4 – IP address of DDNS server
hostname – Hostname of DDNS server

service dns dynamic interface <ifc> service <id> ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – Time To Live

service dns dynamic interface <ifc> service <id> type <id>

SDE M10-Smart M2 RS420

Protocol used for DDNS service

Values

id – Custom or predefined protocol

service dns dynamic interface <ifc> service <id> zone <id>

SDE M10-Smart M2 RS420

Values

id – Zone to be updated

service dns dynamic interface <ifc> update-frecuency <u32>

SDE M10-Smart M2 RS420

Values

u32 – Time (in minutes) after which the domain is updated

service dns dynamic interface <ifc> use-web: SDE M10-Smart M2 RS420
Web check used for obtaining the external IP address

service dns dynamic interface <ifc> use-web skip <id>

SDE M10-Smart M2 RS420

Values

id – Skip everything before this on the given URL

service dns dynamic interface <ifc> use-web url <txt>

SDE M10-Smart M2 RS420

Values

txt – URL to obtain the current external IP address

service dns forwarding: SDE M10-Smart M2 RS420
DNS Forwarding

service dns forwarding cache-size <u32>

SDE M10-Smart M2 RS420

DNS forwarding cache size

Values

u32 – DNS forwarding cache size (0-10000)

service dns forwarding dhcp: SDE M10-Smart M2 RS420
Enable DNS servers received from DHCP

service dns forwarding dhcp interface <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Enable DNS servers received from DHCP for specified interface

Instances

Multiple

service dns forwarding dhcp interface <ifc> priority <u32>

SDE M10-Smart M2 RS420

DHCP DNS servers priority for specified interface

Values

u32 – Level of priorities allowed (0-9)

service dns forwarding dhcp priority <u32>

SDE M10-Smart M2 RS420

DHCP DNS servers priority

Values

u32 – Level of priorities allowed (0-9)

service dns forwarding dhcpv6: SDE M10-Smart M2 RS420
Enable DNS servers received from DHCPv6

service dns forwarding dhcpv6 interface <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Enable DNS servers received from DHCPv6 for specified interface

Instances

Multiple

service dns forwarding dhcpv6 interface <ifc> priority <u32>

SDE M10-Smart M2 RS420

DHCPv6 DNS servers priority

Values

u32 – Level of priorities allowed (0-9)

service dns forwarding dhcpv6 priority <u32>

SDE M10-Smart M2 RS420

DHCPv6 DNS servers priority

Values

u32 – Level of priorities allowed (0-9)

service dns forwarding disable-local-service: SDE M10-Smart M2 RS420
Disable local-service option to accept DNS queries from any host on any subnet

service dns forwarding dnssec: SDE M10-Smart M2 RS420
Enable DNSSEC validation and caching

service dns forwarding dnssec check-unsigned

SDE M10-Smart M2 RS420

Check if unsigned replies are legitimate

This entails possible extra queries even for the majority of DNS zones which are not, at the moment, signed. If disabled, then those replies are assumed to be valid and passed on (without the “authentic data” bit set). This does not protect against an attacker forging unsigned replies for signed DNS zones, but it is fast.

service dns forwarding dnssec proxy

SDE M10-Smart M2 RS420

Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients

This is an alternative to having dnsmasq validate DNSSEC, but it depends on the security of the network between dnsmasq and the upstream servers, and the trustworthiness of the upstream servers. Note that caching the Authenticated Data bit correctly in all cases is not technically possible.

service dns forwarding domain <id>

SDE M10-Smart M2 RS420

DNS domain configuration

Values

id – DNS domain name

Instances

Multiple

service dns forwarding domain <id> dhcp: SDE M10-Smart M2 RS420
Enable DNS servers received from DHCP

service dns forwarding domain <id> dhcp interface <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Enable DNS servers received from DHCP for specified interface

Instances

Multiple

service dns forwarding domain <id> dhcpv6: SDE M10-Smart M2 RS420
Enable DNS servers received from DHCPv6

service dns forwarding domain <id> dhcpv6 interface <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Enable DNS servers received from DHCPv6 for specified interface

Instances

Multiple

service dns forwarding domain <id> name-server <ipv4>

SDE M10-Smart M2 RS420

DNS servers

Values

ipv4 – DNS address IPv4
ipv6 – DNS address IPv6

Instances

Multiple

service dns forwarding domain <id> name-server <ipv4> local-address <ipv4|ipv6>

SDE M10-Smart M2 RS420

Local IP address to use as source for requests to this nameserver

Values

ipv4 – Local IPv4 address for this nameserver
ipv6 – Local IPv6 address for this nameserver

Local IP address

service dns forwarding domain <id> name-server <ipv4> local-interface <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Interface to use as source for requests to this nameserver

service dns forwarding domain <id> name-server <ipv4> local-vrf <id>

SDE M10-Smart M2 RS420

VRF to use as source for requests to this nameserver

Reference: system vrf <id>

service dns forwarding domain <id> name-server <ipv4> port <u32>

SDE M10-Smart M2 RS420

Port in which the DNS server is listening at. Defaults to port 53

Values

u32 – DNS server listening port (1-65535)

service dns forwarding domain <id> ppp: SDE M10-Smart M2 RS420
Enable DNS servers received from PPP

service dns forwarding listen <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Interfaces to listen for DNS queries

Instances

Multiple

service dns forwarding local-ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – TTL for static entries or DHCP leases

service dns forwarding logs

SDE M10-Smart M2 RS420

Enables DNS forwarding logs

The DNS forwarding logs can be later on retreived by using either the operational commands or by looking at the system journal.

service dns forwarding max-cache-ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – Maximum TTL for Cache Entries

service dns forwarding min-cache-ttl <u32>

SDE M10-Smart M2 RS420

Minimum TTL for Cache Entries

Values

u32 – Minimum time for cache entries in seconds (1-3600)

service dns forwarding name-server <ipv4|ipv6>

SDE M10-Smart M2 RS420

DNS servers

Values

ipv4 – DNS address IPv4
ipv6 – DNS address IPv6

Instances

Multiple

service dns forwarding name-server <ipv4|ipv6> local-address <ipv4|ipv6>

SDE M10-Smart M2 RS420

Local IP address to use as source for requests to this nameserver

Values

ipv4 – Local IPv4 address for this nameserver
ipv6 – Local IPv6 address for this nameserver

Local IP address

service dns forwarding name-server <ipv4|ipv6> local-interface <ifc>

SDE M10-Smart M2 RS420

Values

ifc – Interface to use as source for requests to this nameserver

service dns forwarding name-server <ipv4|ipv6> local-vrf <id>

SDE M10-Smart M2 RS420

VRF to use as source for requests to this nameserver

Reference: system vrf <id>

service dns forwarding name-server <ipv4|ipv6> port <u32>

SDE M10-Smart M2 RS420

Port in which the DNS server is listening at. Defaults to port 53

Values

u32 – DNS server listening port (1-65535)

service dns forwarding name-server <ipv4|ipv6> priority <u32>

SDE M10-Smart M2 RS420

Local DNS servers priority (the lower the value is, the higher the priority gets)

Values

u32 – Level of priorities allowed (0-9)

service dns forwarding ppp: SDE M10-Smart M2 RS420
Enable DNS servers received from PPP

service dns forwarding ppp priority <u32>

SDE M10-Smart M2 RS420

PPP DNS servers priority

Values

u32 – Level of priorities allowed (0-9)

service dns forwarding record: SDE M10-Smart M2 RS420
DNS static records used when resolving a request

service dns forwarding record cname <fqdn>

SDE M10-Smart M2 RS420

Values

fqdn – CNAME record pointing to an existing host record

Instances

Multiple

Required

service dns forwarding record host <fqdn>

service dns forwarding record cname <fqdn> target <fqdn>

SDE M10-Smart M2 RS420

Host this record points to

Reference: service dns forwarding record host <fqdn>

service dns forwarding record cname <fqdn> ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – TTL for this host entry. By default, uses global configured value

service dns forwarding record host <fqdn>

SDE M10-Smart M2 RS420

Values

fqdn – Host records reference either an A, AAAA or PTR records to the DNS

Instances

Multiple

service dns forwarding record host <fqdn> ipv4-address <ipv4>

SDE M10-Smart M2 RS420

Values

ipv4 – IP address the host record points to

Instances

Multiple

service dns forwarding record host <fqdn> ipv6-address <ipv6>

SDE M10-Smart M2 RS420

Values

ipv6 – IP address the host record points to

Instances

Multiple

service dns forwarding record host <fqdn> ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – TTL for this host entry. By default, uses global configured value

service dns forwarding record mx <fqdn>

SDE M10-Smart M2 RS420

Values

fqdn – MX record for directing mail on a LAN to a server

Instances

Multiple

service dns forwarding record mx <fqdn> hostname <ipv4|ipv6|fqdn|id>

SDE M10-Smart M2 RS420

Hostname the MX record is pointing to. Defaults to system’s hostname

Values

ipv4 – IPv4 address the record points to
ipv6 – IPv6 address the record points to
fqdn – Fully qualified domain name the record points to
id – Hostname the record points to

service dns forwarding record mx <fqdn> preference <u32>

SDE M10-Smart M2 RS420

Values

u32 – Preference of the MX record when querying the hostname

service dns forwarding record srv <id>

SDE M10-Smart M2 RS420

SRV DNS records as specified at RFC2782

Values

id – Service name for this SRV record

Instances

Multiple

Required

service dns forwarding record srv <id> protocol <id>

SDE M10-Smart M2 RS420

Values

id – Service protocol for this SRV record

Instances

Multiple

Required

service dns forwarding record srv <id> protocol <id> domain <fqdn>

SDE M10-Smart M2 RS420

Values

fqdn –
Service domain this SRV record uses

For example, if the SRV record refers to an IMAP mail server running at teldat.com domain, then domain will be “teldat.com”. “domain” should not be confused with “target”, which can have the same value but refer to different things.

service dns forwarding record srv <id> protocol <id> port <u32>

SDE M10-Smart M2 RS420

Service port this SRV points to

Values

u32 – Port in which the service is listening to connections (1-65535)

service dns forwarding record srv <id> protocol <id> priority <u32>

SDE M10-Smart M2 RS420

Priority of this SRV record

Values

u32 – Priority of this SRV record. The lower the value is, the higher the priority gets

service dns forwarding record srv <id> protocol <id> target <fqdn>

SDE M10-Smart M2 RS420

Service domain this SRV points to

The target refers to the destination the SRV record is pointing to. In a mail server example, the target would be the FQDN in which the mail server lives.

Reference: service dns forwarding record host <fqdn>

service dns forwarding record srv <id> protocol <id> weight <u32>

SDE M10-Smart M2 RS420

Weight of this SRV record

Values

u32 – Weight of this SRV record. The lower the value is, the higher the weight gets

service dns proxy

SDE M10-Smart M2 RS420

DNS proxy service configuration options

Required

service dns proxy balancing <id>

SDE M10-Smart M2 RS420

Load balancing algorithms for chosen servers

The DNS proxy queries all the servers given by the source lists. Once populated, servers are sorted from quickest to lowest, and that order will be used for performing the load balancing. Each time a query is made to a server, the time it takes is used to adjust how fast the proxy thinks the server is, using an exponentially weighted average. If the new calculated time happens to be slower than a randomly chosen candidate from the list of servers, then the entries are swapped. When this operation is applied over time, every server will get compared to all the others and the list is progressively kept sorted. Notice that when source lists are used, the servers are placed around the world. If “ph” strategy is chosen, very probably some queries will end-up using slower servers - that is why “p2” is probably the best strategy to use (and therefore the best). Have a look at server response times before choosing the strategy.

Values

first – Always pick the fastest server in the list
p2 – Randomly choose between the top 2 fastest servers
ph – Randomly choose between the top fastest half of all servers
random – Just pick any random server from the list

service dns proxy blocklist: SDE M10-Smart M2 RS420
Configures sources to block

service dns proxy blocklist ip: SDE M10-Smart M2 RS420
Block IPs. RegEx is also supported

service dns proxy blocklist ip address <txt>

SDE M10-Smart M2 RS420

Values

txt –
Block IPs based on a pattern

Blocklist are made of patterns. Thus, the following patterns are valid: 127.*

Instances

Multiple

service dns proxy blocklist ip file <file>

SDE M10-Smart M2 RS420

Values

file – Loads a file containing the IPs to block

Instances

Multiple

service dns proxy blocklist name: SDE M10-Smart M2 RS420
Block domains by name. RegEx is also supported

service dns proxy blocklist name domain <txt>

SDE M10-Smart M2 RS420

Values

txt –
Block domain based on a pattern

Blocklist are made of patterns. Thus, the following patterns are valid: example.com =example.com sex ads.* ads*.example.* Usually, these blocklist are handled directly with files. However, it is also possible to specify them manually. More information can be found at:

Instances

Multiple

service dns proxy blocklist name file <file>

SDE M10-Smart M2 RS420

Values

file – Loads a file containing the domains to block

Instances

Multiple

service dns proxy cache: SDE M10-Smart M2 RS420
DNS proxy caching options

service dns proxy cache max-negated-ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – How long, at most in seconds, a not found entry will be kept in cache

service dns proxy cache max-ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – How long, at most in seconds, an entry will be kept in cache

service dns proxy cache min-negated-ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – How long, at minimum in seconds, a not found entry will be kept in cache

service dns proxy cache min-ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – How long, at minimum in seconds, an entry will be kept in cache

service dns proxy cache size <u32>

SDE M10-Smart M2 RS420

Values

u32 – Maximum number of entries in the cache

service dns proxy cipher <u32>

SDE M10-Smart M2 RS420

Cipher algorithms ordered by preference

When this field is not set, the best algorithm will be used based on hardware characteristics that do not compromise the exchanged data. Notice that these algorithms conform a “preference”: If the server and the client agree on one, they will use it. However, if the server has no acceptable algorithm from the one the client asks for, it will just show a warning and choose the proper one. Notice that this feature will do nothing when the communication is encrypted using TLS v1.3: The best algorithm is automatically chosen based on hardware characteristics and connection speed.

Values

u32 – Preference of the encryption algorithm (1-18)

Instances

Multiple

Required

service dns proxy cipher <u32> algorithm <id>

SDE M10-Smart M2 RS420

Cipher algorithm to communicate with the server

Values

TLS_RSA_WITH_AES_128_CBC_SHA – [Secure] RSA with AES-128-CBC-SHA (up-to TLS v1.2)
TLS_RSA_WITH_AES_256_CBC_SHA – [Secure] RSA with AES-256-CBC-SHA (up-to TLS v1.2)
TLS_RSA_WITH_AES_128_GCM_SHA256 – [Secure] RSA with AES-128-GCM-SHA256 (only in TLS v1.2)
TLS_RSA_WITH_AES_256_GCM_SHA384 – [Secure] RSA with AES-256-GCM-SHA384 (only in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA – [Secure] ECDHE RSA with AES-128-CBC-SHA (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA – [Secure] ECDHE RSA with AES-256-CBC-SHA (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 – [Secure] ECDHE RSA with AES-128-GCM-SHA256 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 – [Secure] ECDHE RSA with AES-256-GCM-SHA384 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 – [Secure] ECDHE RSA with ChaCha 20 and Poly 1305 (up-to in TLS v1.2)
TLS_RSA_WITH_RC4_128_SHA – [Insecure] RSA with RC4 and SHA1 (up-to in TLS v1.2)
TLS_RSA_WITH_3DES_EDE_CBC_SHA – [Insecure] RSA with 3DES-EDE-CBC and SHA1 (up-to in TLS v1.2)
TLS_RSA_WITH_AES_128_CBC_SHA256 – [Insecure] RSA with AES-128-CBC and SHA256 (only in TLS v1.2)
TLS_ECDHE_RSA_WITH_RC4_128_SHA – [Insecure] ECDHE RSA with RC4 and SHA1 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA – [Insecure] ECDHE RSA with 3DES-EDE-CBC and SHA1 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 – [Insecure] ECDHE RSA with AES-128-CBC and SHA256 (only in TLS v1.2)

service dns proxy cloaking: SDE M10-Smart M2 RS420
Configures a set of host entries to point to one or multiple addresses

service dns proxy cloaking ignore-hosts: SDE M10-Smart M2 RS420
Do not use system configured host entries

service dns proxy cloaking name <txt>

SDE M10-Smart M2 RS420

FQDN, IP, name or RegEx to match when cloaking

An example is worth a thousand words: 1. example.com 2. .example.com 3. *.example. 4. example[0-9]* The examples above will match a FQDN (1), all subdomains of “example.com” (2), all subdomains and all top-level domains (3) and all domains containing either no or “N” numbers at the end, including all top-level domains too (4). Furthermore, as the input value can be anything, here IP addresses may fit too.

Values

name – FQDN, IP, name or regular expression used to match incoming requests

Instances

Multiple

Required

service dns proxy cloaking name <txt> destination <fqdn|ipv4|ipv6>

SDE M10-Smart M2 RS420

Destination to point incoming petitions to

The incoming traffic may be pointed to another domain, IP or IPv6 address. Moreover, that traffic may be load balanced when setting more than one destination address.

Values

fqdn – Domain name to point to
ipv4 – Address to point to
ipv6 – IPv6 Address to point to

Instances

Multiple

service dns proxy cloaking ttl <u32>

SDE M10-Smart M2 RS420

Values

u32 – Cloaking TTL used when serving defined entries

service dns proxy disable-protocol: SDE M10-Smart M2 RS420
Choose the protocols that will not be used when securing DNS queries

service dns proxy disable-protocol dnscrypt: SDE M10-Smart M2 RS420
Skip the DNSCrypt protocol if the server implements it

service dns proxy disable-protocol doh: SDE M10-Smart M2 RS420
Skip the DNS-over-HTTPS protocol if the server implements it

service dns proxy fallback <ipv4|ipv6>

SDE M10-Smart M2 RS420

Fallback DNS resolvers when no other connection is available

These are normal, non-encrypted DNS resolvers, that will be only used for one-shot queries when retrieving the initial resolvers list and if the system DNS configuration doesn’t work.

Values

ipv4 – IPv4 address where the resolver is listening at
ipv6 – IPv6 address where the resolver is listening at

Instances

Multiple

service dns proxy fallback <ipv4|ipv6> port <u32>

SDE M10-Smart M2 RS420

Port in which the resolver is listening at

Values

u32 – Port where resolver is listening at (1-65535)

service dns proxy force-tcp

SDE M10-Smart M2 RS420

Always use TCP to connect to upstream servers

This can be useful if you need to route everything through a proxy (like Tor). Otherwise, enabling this option does not improve security and will only increase the latency.

service dns proxy ipv6: SDE M10-Smart M2 RS420
IPv6 options for configuring the service

service dns proxy ipv6 block: SDE M10-Smart M2 RS420
Block any IPv6 requests (useful when IPv6 is not available)

service dns proxy ipv6 do-not-query: SDE M10-Smart M2 RS420
Ignore DNS servers that are only accessible through IPv6

service dns proxy keepalive <u32>

SDE M10-Smart M2 RS420

Keepalive for HTTP queries, in seconds

Values

u32 – Keepalive in seconds

service dns proxy listen-address <ipv4|ipv6>

SDE M10-Smart M2 RS420

Address to listen to incoming connections

Values

ipv4 – IPv4 address to listen at
ipv6 – IPv6 address to listen at

Local IP address

Instances

Multiple

service dns proxy listen-address <ipv4|ipv6> port <u32>

SDE M10-Smart M2 RS420

Port to listen at

Values

u32 – Port to listen at (1-65535)

service dns proxy log: SDE M10-Smart M2 RS420
Enable logging and configure related options

service dns proxy log level <u32>

SDE M10-Smart M2 RS420

Log level to use. Defaults to “2”

Values

u32 – Verbosity level. 0 is very verbose; 6 only contains fatal errors (0-6)

service dns proxy require: SDE M10-Smart M2 RS420
Restrictions and limitations to apply to configured servers

service dns proxy require dnssec: SDE M10-Smart M2 RS420
Servers must support DNS security extensions (DNSSEC)

service dns proxy require no-filter: SDE M10-Smart M2 RS420
Servers must not enforce its own blocklist (for parental control, ad blocking, …)

service dns proxy require no-logs: SDE M10-Smart M2 RS420
Servers must not log user queries (declarative)

service dns proxy server

SDE M10-Smart M2 RS420

Configure the DNS proxy as a DoH server too

Required

service dns proxy server cert

SDE M10-Smart M2 RS420

Certificate to use for securing communications

Required
Required

service dns proxy server cert file <file>

SDE M10-Smart M2 RS420

Values

file –
Certificate file for the local DoH server

This certificate file can be generated locally or with an external tool such as Let’s Encrypt. With the first approach, the CA certificate has to be trusted by all clients. With the second approach, the CA certificate is usually trusted by all clients.

service dns proxy server cert key <file>

SDE M10-Smart M2 RS420

Values

file – Key for the DoH server certificate

service dns proxy server listen-address <ipv4|ipv6>

SDE M10-Smart M2 RS420

Address the local DoH server should listen to

Values

ipv4 – IPv4 address the local DoH server should listen to
ipv6 – IPv6 address the local DoH server should listen to

Local IP address

Instances

Multiple

service dns proxy server listen-address <ipv4|ipv6> port <u32>

SDE M10-Smart M2 RS420

Port to listen at

Values

u32 – Port to listen at (1-65535)

service dns proxy server path <id>

SDE M10-Smart M2 RS420

Values

id –
Path of the DoH URL

This is not a file, but the part after the hostname in the URL. By convention, “/dns-query” is frequently chosen. For each listen address, the complete URL will have the form:

service dns proxy server-name <id>

SDE M10-Smart M2 RS420

Values

id – Server to use when querying DNS records

Instances

Multiple

service dns proxy source <id>

SDE M10-Smart M2 RS420

Remote lists of available servers

Remote lists are a set of servers that are available for querying DNS records. The lists themselves contain all the required information for a client to connect to a server by simply using a known name. For example, to use Cloudflare as the DNS provider by using a list, it would be as simple as defining “service dns proxy server-name cloudflare”. That setting will automatically populate the DNS list for looking for the “cloudflare” provider data. Some companies publish their own lists with their servers. On the other hand, some projects decide to publish lists with generally available servers. An example is DNSCrypt:

Values

source – Source identifier

Instances

Multiple

Required

service dns proxy source <id> minisign-key <id>

SDE M10-Smart M2 RS420

Values

id –
Public key used to verify the content is legitimate

Lists can be served from any location, even from an untrusted ISP. When this occurs, the DNS proxy will immediately detect and reject the source it has been tampered with.

service dns proxy source <id> prefix <id>

SDE M10-Smart M2 RS420

Values

id – To avoid collisions with other sources, prefix for the declared servers

service dns proxy source <id> refresh-delay <u32>

SDE M10-Smart M2 RS420

Refresh delay for the cached source list

Values

u32 – Delay for cached source list in hours (24-720)

service dns proxy source <id> url <txt>

SDE M10-Smart M2 RS420

Values

txt – URL to get the source from

Instances

Multiple

service dns proxy static <id>

SDE M10-Smart M2 RS420

Static configuration for server definitions

Values

name – Static definition name

Instances

Unique

service dns proxy static <id> protocol

SDE M10-Smart M2 RS420

Protocol identifier for this node

Instances: Unique

service dns proxy static <id> protocol dns-crypt

SDE M10-Smart M2 RS420

The server uses DNSCrypt protocol

Required
Required

service dns proxy static <id> protocol dns-crypt dnssec: SDE M10-Smart M2 RS420
The server supports DNSSEC

service dns proxy static <id> protocol dns-crypt ip <ipv4|ipv6>

SDE M10-Smart M2 RS420

Values

ipv4 – IP address of the server
ipv6 – IP address of the server

service dns proxy static <id> protocol dns-crypt no-filter: SDE M10-Smart M2 RS420
The server does not intentionally block domains

service dns proxy static <id> protocol dns-crypt no-logs: SDE M10-Smart M2 RS420
The server does not store any logs

service dns proxy static <id> protocol dns-crypt port <u32>

SDE M10-Smart M2 RS420

Port where the server is listening at

Values

u32 – Port where the server is listening at (1-65535)

service dns proxy static <id> protocol dns-crypt provider

SDE M10-Smart M2 RS420

DNS provider related data

Required
Required

service dns proxy static <id> protocol dns-crypt provider name <id>

SDE M10-Smart M2 RS420

Values

id – DNS provider name

service dns proxy static <id> protocol dns-crypt provider public-key <id>

SDE M10-Smart M2 RS420

Provider’s Ed25519 public key, as 32 raw bytes

Values

key – Ed25519 public key

service dns proxy static <id> protocol dns-over-https

SDE M10-Smart M2 RS420

The server uses DNS over HTTPS (DoH) protocol

Required

service dns proxy static <id> protocol dns-over-https dnssec: SDE M10-Smart M2 RS420
The server supports DNSSEC

service dns proxy static <id> protocol dns-over-https hash <id>

SDE M10-Smart M2 RS420

The SHA256 digest of one of the TBS certificate

The SHA256 digest of one of the TBS certificate found in the validation chain, typically the certificate used to sign the resolver’s certificate. Multiple hashes can be provided for seamless rotations.

Values

sha256 – SHA256 digest of one of the TBS certificate

Instances

Multiple

service dns proxy static <id> protocol dns-over-https host

SDE M10-Smart M2 RS420

Server host related information

Required

service dns proxy static <id> protocol dns-over-https host name <fqdn>

SDE M10-Smart M2 RS420

Values

fqdn – Server hostname that will be used also as SNI name

service dns proxy static <id> protocol dns-over-https host path <txt>

SDE M10-Smart M2 RS420

Values

txt – Absolute URI path. By default, “/dns-query” is used

service dns proxy static <id> protocol dns-over-https host port <u32>

SDE M10-Smart M2 RS420

Server port number. If missing, port 443 is assumed

Values

u32 – Server port number (1-65535)

service dns proxy static <id> protocol dns-over-https ip <ipv4|ipv6>

SDE M10-Smart M2 RS420

Values

ipv4 –
IP address of the server

The address can be left empty (unset). In that case, the host name will be resolved to an IP address using another resolver.
ipv6 –
IP address of the server

The address can be left empty (unset). In that case, the host name will be resolved to an IP address using another resolver.

service dns proxy static <id> protocol dns-over-https no-filter: SDE M10-Smart M2 RS420
The server does not intentionally block domains

service dns proxy static <id> protocol dns-over-https no-logs: SDE M10-Smart M2 RS420
The server does not store any logs

service dns proxy static <id> stamp <id>

SDE M10-Smart M2 RS420

Values

id –
String that encodes all the required parameters to connect to a server

The stamp is a string that looks like:

service dns proxy timeout <u32>

SDE M10-Smart M2 RS420

Time to wait for a DNS query response, in milliseconds

If the available network has a lot of latency, it could be interesting to increase this value. The startup may be slower if changed so do not increase it too much.

Values

u32 – Timeout in milliseconds

service dns proxy whitelist: SDE M10-Smart M2 RS420
Configures sources to allow

service dns proxy whitelist ip: SDE M10-Smart M2 RS420
Allow IPs. RegEx is also supported

service dns proxy whitelist ip address <txt>

SDE M10-Smart M2 RS420

Values

txt –
Allow IPs based on a pattern

Whitelist are made of patterns. Thus, the following patterns are valid: 127.*

Instances

Multiple

service dns proxy whitelist ip file <file>

SDE M10-Smart M2 RS420

Values

file – Loads a file containing the IPs to allow

Instances

Multiple

service dns proxy whitelist name: SDE M10-Smart M2 RS420
Allow domains by name. RegEx is also supported

service dns proxy whitelist name domain <txt>

SDE M10-Smart M2 RS420

Values

txt –
Allow domain based on a pattern

Whitelist are made of patterns. Thus, the following patterns are valid: example.com =example.com sex ads.* ads*.example.* Usually, these whitelist are handled directly with files. However, it is also possible to specify them manually. More information can be found at:

Instances

Multiple

service dns proxy whitelist name file <file>

SDE M10-Smart M2 RS420

Values

file – Loads a file containing the domains to allow

Instances

Multiple

service dns resolver: SDE M10-Smart M2 RS420
DNS Resolver

service dns resolver dhcp: SDE M10-Smart M2 RS420
Enable DNS servers received from DHCP

service dns resolver dhcpv6: SDE M10-Smart M2 RS420
Enable DNS servers received from DHCPv6

service dns resolver local

SDE M10-Smart M2 RS420

Resolves DNS queries by using a local service

Enabling this option will forward all DNS queries to a local service, previously configured at “service dns forwarding”

service dns resolver name-server <ipv4|ipv6>

SDE M10-Smart M2 RS420

DNS servers

Values

ipv4 – DNS address IPv4
ipv6 – DNS address IPv6

Instances

Multiple

service dns resolver ppp: SDE M10-Smart M2 RS420
Enable DNS servers received from PPP

service dns static: SDE M10-Smart M2 RS420
Static host entries

service dns static host-name <txt>

SDE M10-Smart M2 RS420

Values

txt – Host name for static address mapping

Instances

Multiple

Required

service dns static host-name <txt> alias <id>

SDE M10-Smart M2 RS420

Values

id – Alias for this address

Instances

Multiple

service dns static host-name <txt> inet <ipv4|ipv6>

SDE M10-Smart M2 RS420

Address

Values

ipv4 – IPv4 address
ipv6 – IPv6 address