dns
- service dns
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Domain Name Server (DNS) parameters
- service dns dynamic
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Dynamic DNS
- Required:
- service dns dynamic interface <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Interface to send DDNS updates for
- Instances:
Multiple
- Required:
- service dns dynamic interface <ifc> advisor <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Advisor to enable or disable DDNS on the interface
- Reference:
- service dns dynamic interface <ifc> service <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – Service name used for DDNS
- Instances:
Multiple
- Required:
- Required:
- Required:
- Required:
- service dns dynamic interface <ifc> service <id> domain <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Domain registered with DDNS service
- Values:
hostname – Hostname registered with DDNS service
record – Record to be updated for RFC2136
- Instances:
Multiple
- service dns dynamic interface <ifc> service <id> encrypted-password <password>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Encripted password or shared secret for DDNS service
- Values:
secret – Secret for RFC2136
- service dns dynamic interface <ifc> service <id> login <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Login for DDNS service
- Values:
login – Login for DDNS service
keyname – Keyname for RFC2136
- service dns dynamic interface <ifc> service <id> password <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Password for DDNS service
- Values:
password – Password for DDNS service
secret – Secret for RFC2136
- service dns dynamic interface <ifc> service <id> server <ipv4|id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Server to send DDNS update to
- Values:
ipv4 – IP address of DDNS server
hostname – Hostname of DDNS server
- service dns dynamic interface <ifc> service <id> ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – Time To Live
- service dns dynamic interface <ifc> service <id> type <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Protocol used for DDNS service
- Values:
id – Custom or predefined protocol
- service dns dynamic interface <ifc> service <id> zone <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – Zone to be updated
- service dns dynamic interface <ifc> update-frecuency <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – Time (in minutes) after which the domain is updated
- service dns dynamic interface <ifc> use-web
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Web check used for obtaining the external IP address
- service dns dynamic interface <ifc> use-web skip <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – Skip everything before this on the given URL
- service dns dynamic interface <ifc> use-web url <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt – URL to obtain the current external IP address
- service dns forwarding
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS Forwarding
- service dns forwarding cache-size <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS forwarding cache size
- Values:
u32 – DNS forwarding cache size (0-10000)
- service dns forwarding dhcp
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from DHCP
- service dns forwarding dhcp interface <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Enable DNS servers received from DHCP for specified interface
- Instances:
Multiple
- service dns forwarding dhcp interface <ifc> priority <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DHCP DNS servers priority for specified interface
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding dhcp priority <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DHCP DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding dhcpv6
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from DHCPv6
- service dns forwarding dhcpv6 interface <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Enable DNS servers received from DHCPv6 for specified interface
- Instances:
Multiple
- service dns forwarding dhcpv6 interface <ifc> priority <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DHCPv6 DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding dhcpv6 priority <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DHCPv6 DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding disable-local-service
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Disable local-service option to accept DNS queries from any host on any subnet
- service dns forwarding dnssec
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNSSEC validation and caching
- service dns forwarding dnssec check-unsigned
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Check if unsigned replies are legitimate
This entails possible extra queries even for the majority of DNS zones which are not, at the moment, signed. If disabled, then those replies are assumed to be valid and passed on (without the “authentic data” bit set). This does not protect against an attacker forging unsigned replies for signed DNS zones, but it is fast.
- service dns forwarding dnssec proxy
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients
This is an alternative to having dnsmasq validate DNSSEC, but it depends on the security of the network between dnsmasq and the upstream servers, and the trustworthiness of the upstream servers. Note that caching the Authenticated Data bit correctly in all cases is not technically possible.
- service dns forwarding domain <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS domain configuration
- Values:
id – DNS domain name
- Instances:
Multiple
- service dns forwarding domain <id> dhcp
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from DHCP
- service dns forwarding domain <id> dhcp interface <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Enable DNS servers received from DHCP for specified interface
- Instances:
Multiple
- service dns forwarding domain <id> dhcpv6
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from DHCPv6
- service dns forwarding domain <id> dhcpv6 interface <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Enable DNS servers received from DHCPv6 for specified interface
- Instances:
Multiple
- service dns forwarding domain <id> name-server <ipv4>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS servers
- Values:
ipv4 – DNS address IPv4
ipv6 – DNS address IPv6
- Instances:
Multiple
- service dns forwarding domain <id> name-server <ipv4> local-address <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Local IP address to use as source for requests to this nameserver
- Values:
ipv4 – Local IPv4 address for this nameserver
ipv6 – Local IPv6 address for this nameserver
- Local IP address:
- service dns forwarding domain <id> name-server <ipv4> local-interface <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Interface to use as source for requests to this nameserver
- service dns forwarding domain <id> name-server <ipv4> local-vrf <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
VRF to use as source for requests to this nameserver
- Reference:
- service dns forwarding domain <id> name-server <ipv4> port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Port in which the DNS server is listening at. Defaults to port 53
- Values:
u32 – DNS server listening port (1-65535)
- service dns forwarding domain <id> ppp
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from PPP
- service dns forwarding listen <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Interfaces to listen for DNS queries
- Instances:
Multiple
- service dns forwarding local-ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – TTL for static entries or DHCP leases
- service dns forwarding logs
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enables DNS forwarding logs
The DNS forwarding logs can be later on retreived by looking at the system journal.
- service dns forwarding max-cache-ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – Maximum TTL for Cache Entries
- service dns forwarding min-cache-ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Minimum TTL for Cache Entries
- Values:
u32 – Minimum time for cache entries in seconds (1-3600)
- service dns forwarding name-server <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS servers
- Values:
ipv4 – DNS address IPv4
ipv6 – DNS address IPv6
- Instances:
Multiple
- service dns forwarding name-server <ipv4|ipv6> local-address <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Local IP address to use as source for requests to this nameserver
- Values:
ipv4 – Local IPv4 address for this nameserver
ipv6 – Local IPv6 address for this nameserver
- Local IP address:
- service dns forwarding name-server <ipv4|ipv6> local-interface <ifc>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ifc – Interface to use as source for requests to this nameserver
- service dns forwarding name-server <ipv4|ipv6> local-vrf <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
VRF to use as source for requests to this nameserver
- Reference:
- service dns forwarding name-server <ipv4|ipv6> port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Port in which the DNS server is listening at. Defaults to port 53
- Values:
u32 – DNS server listening port (1-65535)
- service dns forwarding name-server <ipv4|ipv6> priority <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Local DNS servers priority (the lower the value is, the higher the priority gets)
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding ppp
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from PPP
- service dns forwarding ppp priority <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
PPP DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding record
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS static records used when resolving a request
- service dns forwarding record cname <fqdn>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
fqdn – CNAME record pointing to an existing host record
- Instances:
Multiple
- Required:
- service dns forwarding record cname <fqdn> target <fqdn>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Host this record points to
- Reference:
- service dns forwarding record cname <fqdn> ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – TTL for this host entry. By default, uses global configured value
- service dns forwarding record host <fqdn>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
fqdn – Host records reference either an A, AAAA or PTR records to the DNS
- Instances:
Multiple
- service dns forwarding record host <fqdn> ipv4-address <ipv4>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ipv4 – IP address the host record points to
- Instances:
Multiple
- service dns forwarding record host <fqdn> ipv6-address <ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ipv6 – IP address the host record points to
- Instances:
Multiple
- service dns forwarding record host <fqdn> ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – TTL for this host entry. By default, uses global configured value
- service dns forwarding record mx <fqdn>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
fqdn – MX record for directing mail on a LAN to a server
- Instances:
Multiple
- service dns forwarding record mx <fqdn> hostname <ipv4|ipv6|fqdn|id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Hostname the MX record is pointing to. Defaults to system’s hostname
- Values:
ipv4 – IPv4 address the record points to
ipv6 – IPv6 address the record points to
fqdn – Fully qualified domain name the record points to
id – Hostname the record points to
- service dns forwarding record mx <fqdn> preference <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – Preference of the MX record when querying the hostname
- service dns forwarding record srv <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
SRV DNS records as specified at RFC2782
- Values:
id – Service name for this SRV record
- Instances:
Multiple
- Required:
- service dns forwarding record srv <id> protocol <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – Service protocol for this SRV record
- Instances:
Multiple
- Required:
- service dns forwarding record srv <id> protocol <id> domain <fqdn>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
fqdn –
Service domain this SRV record uses
For example, if the SRV record refers to an IMAP mail server running at teldat.com domain, then domain will be “teldat.com”. “domain” should not be confused with “target”, which can have the same value but refer to different things.
- service dns forwarding record srv <id> protocol <id> port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Service port this SRV points to
- Values:
u32 – Port in which the service is listening to connections (1-65535)
- service dns forwarding record srv <id> protocol <id> priority <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Priority of this SRV record
- Values:
u32 – Priority of this SRV record. The lower the value is, the higher the priority gets
- service dns forwarding record srv <id> protocol <id> target <fqdn>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Service domain this SRV points to
The target refers to the destination the SRV record is pointing to. In a mail server example, the target would be the FQDN in which the mail server lives.
- Reference:
- service dns forwarding record srv <id> protocol <id> weight <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Weight of this SRV record
- Values:
u32 – Weight of this SRV record. The lower the value is, the higher the weight gets
- service dns proxy
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS proxy service configuration options
- Required:
- service dns proxy balancing <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Load balancing algorithms for chosen servers
The DNS proxy queries all the servers given by the source lists. Once populated, servers are sorted from quickest to lowest, and that order will be used for performing the load balancing. Each time a query is made to a server, the time it takes is used to adjust how fast the proxy thinks the server is, using an exponentially weighted average. If the new calculated time happens to be slower than a randomly chosen candidate from the list of servers, then the entries are swapped. When this operation is applied over time, every server will get compared to all the others and the list is progressively kept sorted. Notice that when source lists are used, the servers are placed around the world. If “ph” strategy is chosen, very probably some queries will end-up using slower servers - that is why “p2” is probably the best strategy to use (and therefore the best). Have a look at server response times before choosing the strategy.
- Values:
first – Always pick the fastest server in the list
p2 – Randomly choose between the top 2 fastest servers
ph – Randomly choose between the top fastest half of all servers
random – Just pick any random server from the list
- service dns proxy blocklist
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Configures sources to block
- service dns proxy blocklist ip
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Block IPs. RegEx is also supported
- service dns proxy blocklist ip address <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt –
Block IPs based on a pattern
Blocklist are made of patterns. Thus, the following patterns are valid: 127.*
- Instances:
Multiple
- service dns proxy blocklist ip file <file>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
file – Loads a file containing the IPs to block
- Instances:
Multiple
- service dns proxy blocklist name
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Block domains by name. RegEx is also supported
- service dns proxy blocklist name domain <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt –
Block domain based on a pattern
Blocklist are made of patterns. Thus, the following patterns are valid: example.com =example.com sex ads.* ads*.example.* Usually, these blocklist are handled directly with files. However, it is also possible to specify them manually. More information can be found at:
- Instances:
Multiple
- service dns proxy blocklist name file <file>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
file – Loads a file containing the domains to block
- Instances:
Multiple
- service dns proxy cache
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS proxy caching options
- service dns proxy cache max-negated-ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – How long, at most in seconds, a not found entry will be kept in cache
- service dns proxy cache max-ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – How long, at most in seconds, an entry will be kept in cache
- service dns proxy cache min-negated-ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – How long, at minimum in seconds, a not found entry will be kept in cache
- service dns proxy cache min-ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – How long, at minimum in seconds, an entry will be kept in cache
- service dns proxy cache size <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – Maximum number of entries in the cache
- service dns proxy cipher <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Cipher algorithms ordered by preference
When this field is not set, the best algorithm will be used based on hardware characteristics that do not compromise the exchanged data. Notice that these algorithms conform a “preference”: If the server and the client agree on one, they will use it. However, if the server has no acceptable algorithm from the one the client asks for, it will just show a warning and choose the proper one. Notice that this feature will do nothing when the communication is encrypted using TLS v1.3: The best algorithm is automatically chosen based on hardware characteristics and connection speed.
- Values:
u32 – Preference of the encryption algorithm (1-18)
- Instances:
Multiple
- Required:
- service dns proxy cipher <u32> algorithm <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Cipher algorithm to communicate with the server
- Values:
TLS_RSA_WITH_AES_128_CBC_SHA – [Secure] RSA with AES-128-CBC-SHA (up-to TLS v1.2)
TLS_RSA_WITH_AES_256_CBC_SHA – [Secure] RSA with AES-256-CBC-SHA (up-to TLS v1.2)
TLS_RSA_WITH_AES_128_GCM_SHA256 – [Secure] RSA with AES-128-GCM-SHA256 (only in TLS v1.2)
TLS_RSA_WITH_AES_256_GCM_SHA384 – [Secure] RSA with AES-256-GCM-SHA384 (only in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA – [Secure] ECDHE RSA with AES-128-CBC-SHA (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA – [Secure] ECDHE RSA with AES-256-CBC-SHA (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 – [Secure] ECDHE RSA with AES-128-GCM-SHA256 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 – [Secure] ECDHE RSA with AES-256-GCM-SHA384 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 – [Secure] ECDHE RSA with ChaCha 20 and Poly 1305 (up-to in TLS v1.2)
TLS_RSA_WITH_RC4_128_SHA – [Insecure] RSA with RC4 and SHA1 (up-to in TLS v1.2)
TLS_RSA_WITH_3DES_EDE_CBC_SHA – [Insecure] RSA with 3DES-EDE-CBC and SHA1 (up-to in TLS v1.2)
TLS_RSA_WITH_AES_128_CBC_SHA256 – [Insecure] RSA with AES-128-CBC and SHA256 (only in TLS v1.2)
TLS_ECDHE_RSA_WITH_RC4_128_SHA – [Insecure] ECDHE RSA with RC4 and SHA1 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA – [Insecure] ECDHE RSA with 3DES-EDE-CBC and SHA1 (up-to in TLS v1.2)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 – [Insecure] ECDHE RSA with AES-128-CBC and SHA256 (only in TLS v1.2)
- service dns proxy cloaking
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Configures a set of host entries to point to one or multiple addresses
- service dns proxy cloaking ignore-hosts
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Do not use system configured host entries
- service dns proxy cloaking name <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
FQDN, IP, name or RegEx to match when cloaking
An example is worth a thousand words: 1. example.com 2. .example.com 3. *.example. 4. example[0-9]* The examples above will match a FQDN (1), all subdomains of “example.com” (2), all subdomains and all top-level domains (3) and all domains containing either no or “N” numbers at the end, including all top-level domains too (4). Furthermore, as the input value can be anything, here IP addresses may fit too.
- Values:
name – FQDN, IP, name or regular expression used to match incoming requests
- Instances:
Multiple
- Required:
- service dns proxy cloaking name <txt> destination <fqdn|ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Destination to point incoming petitions to
The incoming traffic may be pointed to another domain, IP or IPv6 address. Moreover, that traffic may be load balanced when setting more than one destination address.
- Values:
fqdn – Domain name to point to
ipv4 – Address to point to
ipv6 – IPv6 Address to point to
- Instances:
Multiple
- service dns proxy cloaking ttl <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
u32 – Cloaking TTL used when serving defined entries
- service dns proxy disable-protocol
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Choose the protocols that will not be used when securing DNS queries
- service dns proxy disable-protocol dnscrypt
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Skip the DNSCrypt protocol if the server implements it
- service dns proxy disable-protocol doh
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Skip the DNS-over-HTTPS protocol if the server implements it
- service dns proxy fallback <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Fallback DNS resolvers when no other connection is available
These are normal, non-encrypted DNS resolvers, that will be only used for one-shot queries when retrieving the initial resolvers list and if the system DNS configuration doesn’t work.
- Values:
ipv4 – IPv4 address where the resolver is listening at
ipv6 – IPv6 address where the resolver is listening at
- Instances:
Multiple
- service dns proxy fallback <ipv4|ipv6> port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Port in which the resolver is listening at
- Values:
u32 – Port where resolver is listening at (1-65535)
- service dns proxy force-tcp
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Always use TCP to connect to upstream servers
This can be useful if you need to route everything through a proxy (like Tor). Otherwise, enabling this option does not improve security and will only increase the latency.
- service dns proxy ipv6
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
IPv6 options for configuring the service
- service dns proxy ipv6 block
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Block any IPv6 requests (useful when IPv6 is not available)
- service dns proxy ipv6 do-not-query
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Ignore DNS servers that are only accessible through IPv6
- service dns proxy keepalive <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Keepalive for HTTP queries, in seconds
- Values:
u32 – Keepalive in seconds
- service dns proxy listen-address <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Address to listen to incoming connections
- Values:
ipv4 – IPv4 address to listen at
ipv6 – IPv6 address to listen at
- Local IP address:
- Instances:
Multiple
- service dns proxy listen-address <ipv4|ipv6> port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Port to listen at
- Values:
u32 – Port to listen at (1-65535)
- service dns proxy log
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable logging and configure related options
- service dns proxy log level <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Log level to use. Defaults to “2”
- Values:
u32 – Verbosity level. 0 is very verbose; 6 only contains fatal errors (0-6)
- service dns proxy require
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Restrictions and limitations to apply to configured servers
- service dns proxy require dnssec
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Servers must support DNS security extensions (DNSSEC)
- service dns proxy require no-filter
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Servers must not enforce its own blocklist (for parental control, ad blocking, …)
- service dns proxy require no-logs
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Servers must not log user queries (declarative)
- service dns proxy server
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Configure the DNS proxy as a DoH server too
- Required:
- service dns proxy server cert
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Certificate to use for securing communications
- Required:
- Required:
- service dns proxy server cert file <file>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
file –
Certificate file for the local DoH server
This certificate file can be generated locally or with an external tool such as Let’s Encrypt. With the first approach, the CA certificate has to be trusted by all clients. With the second approach, the CA certificate is usually trusted by all clients.
- service dns proxy server cert key <file>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
file – Key for the DoH server certificate
- service dns proxy server listen-address <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Address the local DoH server should listen to
- Values:
ipv4 – IPv4 address the local DoH server should listen to
ipv6 – IPv6 address the local DoH server should listen to
- Local IP address:
- Instances:
Multiple
- service dns proxy server listen-address <ipv4|ipv6> port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Port to listen at
- Values:
u32 – Port to listen at (1-65535)
- service dns proxy server path <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id –
Path of the DoH URL
This is not a file, but the part after the hostname in the URL. By convention, “/dns-query” is frequently chosen. For each listen address, the complete URL will have the form:
- service dns proxy server-name <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – Server to use when querying DNS records
- Instances:
Multiple
- service dns proxy source <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Remote lists of available servers
Remote lists are a set of servers that are available for querying DNS records. The lists themselves contain all the required information for a client to connect to a server by simply using a known name. For example, to use Cloudflare as the DNS provider by using a list, it would be as simple as defining “service dns proxy server-name cloudflare”. That setting will automatically populate the DNS list for looking for the “cloudflare” provider data. Some companies publish their own lists with their servers. On the other hand, some projects decide to publish lists with generally available servers. An example is DNSCrypt:
- Values:
source – Source identifier
- Instances:
Multiple
- Required:
- Required:
- service dns proxy source <id> minisign-key <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id –
Public key used to verify the content is legitimate
Lists can be served from any location, even from an untrusted ISP. When this occurs, the DNS proxy will immediately detect and reject the source it has been tampered with.
- service dns proxy source <id> prefix <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – To avoid collisions with other sources, prefix for the declared servers
- service dns proxy source <id> refresh-delay <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Refresh delay for the cached source list
- Values:
u32 – Delay for cached source list in hours (24-720)
- service dns proxy source <id> url <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt – URL to get the source from
- Instances:
Multiple
- service dns proxy static <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Static configuration for server definitions
- Values:
name – Static definition name
- Instances:
Unique
- service dns proxy static <id> protocol
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Protocol identifier for this node
- Instances:
Unique
- service dns proxy static <id> protocol dns-crypt
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server uses DNSCrypt protocol
- Required:
- Required:
- service dns proxy static <id> protocol dns-crypt dnssec
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server supports DNSSEC
- service dns proxy static <id> protocol dns-crypt ip <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ipv4 – IP address of the server
ipv6 – IP address of the server
- service dns proxy static <id> protocol dns-crypt no-filter
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server does not intentionally block domains
- service dns proxy static <id> protocol dns-crypt no-logs
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server does not store any logs
- service dns proxy static <id> protocol dns-crypt port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Port where the server is listening at
- Values:
u32 – Port where the server is listening at (1-65535)
- service dns proxy static <id> protocol dns-crypt provider
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS provider related data
- Required:
- Required:
- service dns proxy static <id> protocol dns-crypt provider name <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – DNS provider name
- service dns proxy static <id> protocol dns-crypt provider public-key <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Provider’s Ed25519 public key, as 32 raw bytes
- Values:
key – Ed25519 public key
- service dns proxy static <id> protocol dns-over-https
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server uses DNS over HTTPS (DoH) protocol
- Required:
- service dns proxy static <id> protocol dns-over-https dnssec
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server supports DNSSEC
- service dns proxy static <id> protocol dns-over-https hash <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The SHA256 digest of one of the TBS certificate
The SHA256 digest of one of the TBS certificate found in the validation chain, typically the certificate used to sign the resolver’s certificate. Multiple hashes can be provided for seamless rotations.
- Values:
sha256 – SHA256 digest of one of the TBS certificate
- Instances:
Multiple
- service dns proxy static <id> protocol dns-over-https host
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Server host related information
- Required:
- service dns proxy static <id> protocol dns-over-https host name <fqdn>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
fqdn – Server hostname that will be used also as SNI name
- service dns proxy static <id> protocol dns-over-https host path <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt – Absolute URI path. By default, “/dns-query” is used
- service dns proxy static <id> protocol dns-over-https host port <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Server port number. If missing, port 443 is assumed
- Values:
u32 – Server port number (1-65535)
- service dns proxy static <id> protocol dns-over-https ip <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
ipv4 –
IP address of the server
The address can be left empty (unset). In that case, the host name will be resolved to an IP address using another resolver.
ipv6 –
IP address of the server
The address can be left empty (unset). In that case, the host name will be resolved to an IP address using another resolver.
- service dns proxy static <id> protocol dns-over-https no-filter
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server does not intentionally block domains
- service dns proxy static <id> protocol dns-over-https no-logs
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
The server does not store any logs
- service dns proxy static <id> stamp <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id –
String that encodes all the required parameters to connect to a server
The stamp is a string that looks like:
- service dns proxy timeout <u32>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Time to wait for a DNS query response, in milliseconds
If the available network has a lot of latency, it could be interesting to increase this value. The startup may be slower if changed so do not increase it too much.
- Values:
u32 – Timeout in milliseconds
- service dns proxy whitelist
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Configures sources to allow
- service dns proxy whitelist ip
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Allow IPs. RegEx is also supported
- service dns proxy whitelist ip address <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt –
Allow IPs based on a pattern
Whitelist are made of patterns. Thus, the following patterns are valid: 127.*
- Instances:
Multiple
- service dns proxy whitelist ip file <file>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
file – Loads a file containing the IPs to allow
- Instances:
Multiple
- service dns proxy whitelist name
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Allow domains by name. RegEx is also supported
- service dns proxy whitelist name domain <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt –
Allow domain based on a pattern
Whitelist are made of patterns. Thus, the following patterns are valid: example.com =example.com sex ads.* ads*.example.* Usually, these whitelist are handled directly with files. However, it is also possible to specify them manually. More information can be found at:
- Instances:
Multiple
- service dns proxy whitelist name file <file>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
file – Loads a file containing the domains to allow
- Instances:
Multiple
- service dns resolver
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS Resolver
- service dns resolver dhcp
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from DHCP
- service dns resolver dhcpv6
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from DHCPv6
- service dns resolver local
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Resolves DNS queries by using a local service
Enabling this option will forward all DNS queries to a local service, previously configured at “service dns forwarding”
- service dns resolver name-server <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
DNS servers
- Values:
ipv4 – DNS address IPv4
ipv6 – DNS address IPv6
- Instances:
Multiple
- service dns resolver ppp
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Enable DNS servers received from PPP
- service dns static
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Static host entries
- service dns static host-name <txt>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
txt – Host name for static address mapping
- Instances:
Multiple
- Required:
- service dns static host-name <txt> alias <id>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
- Values:
id – Alias for this address
- Instances:
Multiple
- service dns static host-name <txt> inet <ipv4|ipv6>
- SDE
M10-Smart
M2
Atlas840
RS420
AresC640
Address
- Values:
ipv4 – IPv4 address
ipv6 – IPv6 address