dns
- service dns
- Devices
Domain Name Server (DNS) parameters
- service dns dynamic
- Devices
Dynamic DNS
- Required:
- service dns dynamic interface <ifc>
- Devices
- Values:
ifc – Interface to send DDNS updates for
- Instances:
Multiple
- Required:
- service dns dynamic interface <ifc> advisor <txt>
- Devices
Advisor to enable or disable DDNS on the interface
- Reference:
- service dns dynamic interface <ifc> service <id>
- Devices
- Values:
id – Service name used for DDNS
- Instances:
Multiple
- Required:
service dns dynamic interface <ifc> service <id> domain <id>- Required:
- Required:
service dns dynamic interface <ifc> service <id> encrypted-password <password>- Required:
- service dns dynamic interface <ifc> service <id> domain <id>
- Devices
Domain registered with DDNS service
- Values:
hostname – Hostname registered with DDNS service
record – Record to be updated for RFC2136
- Instances:
Multiple
- service dns dynamic interface <ifc> service <id> encrypted-password <password>
- Devices
Encripted password or shared secret for DDNS service
- Values:
secret – Secret for RFC2136
- service dns dynamic interface <ifc> service <id> login <id>
- Devices
Login for DDNS service
- Values:
login – Login for DDNS service
keyname – Keyname for RFC2136
- service dns dynamic interface <ifc> service <id> password <txt>
- Devices
Password for DDNS service
- Values:
password – Password for DDNS service
secret – Secret for RFC2136
- service dns dynamic interface <ifc> service <id> server <ipv4|id>
- Devices
Server to send DDNS update to
- Values:
ipv4 – IP address of DDNS server
hostname – Hostname of DDNS server
- service dns dynamic interface <ifc> service <id> ttl <u32>
- Devices
- Values:
u32 – Time To Live
- service dns dynamic interface <ifc> service <id> type <id>
- Devices
Protocol used for DDNS service
- Values:
id – Custom or predefined protocol
- service dns dynamic interface <ifc> service <id> zone <id>
- Devices
- Values:
id – Zone to be updated
- service dns dynamic interface <ifc> update-frecuency <u32>
- Devices
- Values:
u32 – Time (in minutes) after which the domain is updated
- service dns dynamic interface <ifc> use-web
- Devices
Web check used for obtaining the external IP address
- service dns dynamic interface <ifc> use-web skip <id>
- Devices
- Values:
id – Skip everything before this on the given URL
- service dns dynamic interface <ifc> use-web url <txt>
- Devices
- Values:
txt – URL to obtain the current external IP address
- service dns forwarding
- Devices
DNS Forwarding
- service dns forwarding cache-size <u32>
- Devices
DNS forwarding cache size
- Values:
u32 – DNS forwarding cache size (0-10000)
- service dns forwarding dhcp
- Devices
Enable DNS servers received from DHCP
- service dns forwarding dhcp interface <ifc>
- Devices
- Values:
ifc – Enable DNS servers received from DHCP for specified interface
- Instances:
Multiple
- service dns forwarding dhcp interface <ifc> priority <u32>
- Devices
DHCP DNS servers priority for specified interface
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding dhcp priority <u32>
- Devices
DHCP DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding dhcpv6
- Devices
Enable DNS servers received from DHCPv6
- service dns forwarding dhcpv6 interface <ifc>
- Devices
- Values:
ifc – Enable DNS servers received from DHCPv6 for specified interface
- Instances:
Multiple
- service dns forwarding dhcpv6 interface <ifc> priority <u32>
- Devices
DHCPv6 DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding dhcpv6 priority <u32>
- Devices
DHCPv6 DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding disable-local-service
- Devices
Disable local-service option to accept DNS queries from any host on any subnet
- service dns forwarding dnssec
- Devices
Enable DNSSEC validation and caching
- service dns forwarding dnssec check-unsigned
- Devices
Check if unsigned replies are legitimate
This entails possible extra queries even for the majority of DNS zones which are not, at the moment, signed. If disabled, then those replies are assumed to be valid and passed on (without the “authentic data” bit set). This does not protect against an attacker forging unsigned replies for signed DNS zones, but it is fast.
- service dns forwarding dnssec proxy
- Devices
Copy the DNSSEC Authenticated Data bit from upstream servers to downstream clients
This is an alternative to having dnsmasq validate DNSSEC, but it depends on the security of the network between dnsmasq and the upstream servers, and the trustworthiness of the upstream servers. Note that caching the Authenticated Data bit correctly in all cases is not technically possible.
- service dns forwarding domain <id>
- Devices
DNS domain configuration
- Values:
id – DNS domain name
- Instances:
Multiple
- service dns forwarding domain <id> dhcp
- Devices
Enable DNS servers received from DHCP
- service dns forwarding domain <id> dhcp interface <ifc>
- Devices
- Values:
ifc – Enable DNS servers received from DHCP for specified interface
- Instances:
Multiple
- service dns forwarding domain <id> dhcpv6
- Devices
Enable DNS servers received from DHCPv6
- service dns forwarding domain <id> dhcpv6 interface <ifc>
- Devices
- Values:
ifc – Enable DNS servers received from DHCPv6 for specified interface
- Instances:
Multiple
- service dns forwarding domain <id> name-server <ipv4>
- Devices
DNS servers
- Values:
ipv4 – DNS address IPv4
ipv6 – DNS address IPv6
- Instances:
Multiple
- service dns forwarding domain <id> name-server <ipv4> local-address <ipv4|ipv6>
- Devices
Local IP address to use as source for requests to this nameserver
- Values:
ipv4 – Local IPv4 address for this nameserver
ipv6 – Local IPv6 address for this nameserver
- Local IP address:
- service dns forwarding domain <id> name-server <ipv4> local-interface <ifc>
- Devices
- Values:
ifc – Interface to use as source for requests to this nameserver
- service dns forwarding domain <id> name-server <ipv4> local-vrf <id>
- Devices
VRF to use as source for requests to this nameserver
- Reference:
- service dns forwarding domain <id> name-server <ipv4> port <u32>
- Devices
Port in which the DNS server is listening at. Defaults to port 53
- Values:
u32 – DNS server listening port (1-65535)
- service dns forwarding domain <id> ppp
- Devices
Enable DNS servers received from PPP
- service dns forwarding domain <id> ppp interface <txt>
- Devices
Enable DNS servers received from PPP for specified interface
- Reference:
- Instances:
Multiple
- service dns forwarding listen <ifc>
- Devices
- Values:
ifc – Interfaces to listen for DNS queries
- Instances:
Multiple
- service dns forwarding local-ttl <u32>
- Devices
- Values:
u32 – TTL for static entries or DHCP leases
- service dns forwarding logs
- Devices
Enables DNS forwarding logs
The DNS forwarding logs can be later on retreived by looking at the system journal.
- service dns forwarding max-cache-ttl <u32>
- Devices
- Values:
u32 – Maximum TTL for Cache Entries
- service dns forwarding min-cache-ttl <u32>
- Devices
Minimum TTL for Cache Entries
- Values:
u32 – Minimum time for cache entries in seconds (1-3600)
- service dns forwarding name-server <ipv4|ipv6>
- Devices
DNS servers
- Values:
ipv4 – DNS address IPv4
ipv6 – DNS address IPv6
- Instances:
Multiple
- service dns forwarding name-server <ipv4|ipv6> local-address <ipv4|ipv6>
- Devices
Local IP address to use as source for requests to this nameserver
- Values:
ipv4 – Local IPv4 address for this nameserver
ipv6 – Local IPv6 address for this nameserver
- Local IP address:
- service dns forwarding name-server <ipv4|ipv6> local-interface <ifc>
- Devices
- Values:
ifc – Interface to use as source for requests to this nameserver
- service dns forwarding name-server <ipv4|ipv6> local-vrf <id>
- Devices
VRF to use as source for requests to this nameserver
- Reference:
- service dns forwarding name-server <ipv4|ipv6> port <u32>
- Devices
Port in which the DNS server is listening at. Defaults to port 53
- Values:
u32 – DNS server listening port (1-65535)
- service dns forwarding name-server <ipv4|ipv6> priority <u32>
- Devices
Local DNS servers priority (the lower the value is, the higher the priority gets)
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding ppp
- Devices
Enable DNS servers received from PPP
- service dns forwarding ppp interface <txt>
- Devices
Enable DNS servers received from PPP for specified interface
- Reference:
- Instances:
Multiple
- service dns forwarding ppp interface <txt> priority <u32>
- Devices
PPP DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding ppp priority <u32>
- Devices
PPP DNS servers priority
- Values:
u32 – Level of priorities allowed (0-9)
- service dns forwarding record
- Devices
DNS static records used when resolving a request
- service dns forwarding record cname <fqdn>
- Devices
- Values:
fqdn – CNAME record pointing to an existing host record
- Instances:
Multiple
- Required:
- service dns forwarding record cname <fqdn> target <fqdn>
- Devices
Host this record points to
- Reference:
- service dns forwarding record cname <fqdn> ttl <u32>
- Devices
- Values:
u32 – TTL for this host entry. By default, uses global configured value
- service dns forwarding record host <fqdn>
- Devices
- Values:
fqdn – Host records reference either an A, AAAA or PTR records to the DNS
- Instances:
Multiple
- service dns forwarding record host <fqdn> ipv4-address <ipv4>
- Devices
- Values:
ipv4 – IP address the host record points to
- Instances:
Multiple
- service dns forwarding record host <fqdn> ipv6-address <ipv6>
- Devices
- Values:
ipv6 – IP address the host record points to
- Instances:
Multiple
- service dns forwarding record host <fqdn> ttl <u32>
- Devices
- Values:
u32 – TTL for this host entry. By default, uses global configured value
- service dns forwarding record mx <fqdn>
- Devices
- Values:
fqdn – MX record for directing mail on a LAN to a server
- Instances:
Multiple
- service dns forwarding record mx <fqdn> hostname <ipv4|ipv6|fqdn|id>
- Devices
Hostname the MX record is pointing to. Defaults to system’s hostname
- Values:
ipv4 – IPv4 address the record points to
ipv6 – IPv6 address the record points to
fqdn – Fully qualified domain name the record points to
id – Hostname the record points to
- service dns forwarding record mx <fqdn> preference <u32>
- Devices
- Values:
u32 – Preference of the MX record when querying the hostname
- service dns forwarding record srv <id>
- Devices
SRV DNS records as specified at RFC2782
- Values:
id – Service name for this SRV record
- Instances:
Multiple
- Required:
- service dns forwarding record srv <id> protocol <id>
- Devices
- Values:
id – Service protocol for this SRV record
- Instances:
Multiple
- Required:
service dns forwarding record srv <id> protocol <id> domain <fqdn>
- service dns forwarding record srv <id> protocol <id> domain <fqdn>
- Devices
- Values:
fqdn –
Service domain this SRV record uses
For example, if the SRV record refers to an IMAP mail server running at teldat.com domain, then domain will be “teldat.com”. “domain” should not be confused with “target”, which can have the same value but refer to different things.
- service dns forwarding record srv <id> protocol <id> port <u32>
- Devices
Service port this SRV points to
- Values:
u32 – Port in which the service is listening to connections (1-65535)
- service dns forwarding record srv <id> protocol <id> priority <u32>
- Devices
Priority of this SRV record
- Values:
u32 – Priority of this SRV record. The lower the value is, the higher the priority gets
- service dns forwarding record srv <id> protocol <id> target <fqdn>
- Devices
Service domain this SRV points to
The target refers to the destination the SRV record is pointing to. In a mail server example, the target would be the FQDN in which the mail server lives.
- Reference:
- service dns forwarding record srv <id> protocol <id> weight <u32>
- Devices
Weight of this SRV record
- Values:
u32 – Weight of this SRV record. The lower the value is, the higher the weight gets
- service dns proxy
- Devices
DNS proxy service configuration options
- Required:
- service dns proxy balancing <id>
- Devices
Load balancing algorithms for chosen servers
The DNS proxy queries all the servers given by the source lists. Once populated, servers are sorted from quickest to lowest, and that order will be used for performing the load balancing. Each time a query is made to a server, the time it takes is used to adjust how fast the proxy thinks the server is, using an exponentially weighted average. If the new calculated time happens to be slower than a randomly chosen candidate from the list of servers, then the entries are swapped. When this operation is applied over time, every server will get compared to all the others and the list is progressively kept sorted. Notice that when source lists are used, the servers are placed around the world. If “ph” strategy is chosen, very probably some queries will end-up using slower servers - that is why “p2” is probably the best strategy to use (and therefore the best). Have a look at server response times before choosing the strategy.
- Values:
first – Always pick the fastest server in the list
p2 – Randomly choose between the top 2 fastest servers
ph – Randomly choose between the top fastest half of all servers
random – Just pick any random server from the list
- service dns proxy blocklist
- Devices
Configures sources to block
- service dns proxy blocklist ip
- Devices
Block IPs. RegEx is also supported
- service dns proxy blocklist ip address <txt>
- Devices
- Values:
txt –
Block IPs based on a pattern
Blocklist are made of patterns. Thus, the following patterns are valid: 127.*
- Instances:
Multiple
- service dns proxy blocklist ip file <file>
- Devices
- Values:
file – Loads a file containing the IPs to block
- Instances:
Multiple
- service dns proxy blocklist name
- Devices
Block domains by name. RegEx is also supported
- service dns proxy blocklist name domain <txt>
- Devices
- Values:
txt –
Block domain based on a pattern
Blocklist are made of patterns. Thus, the following patterns are valid: example.com =example.com sex ads.* ads*.example.* Usually, these blocklist are handled directly with files. However, it is also possible to specify them manually. More information can be found at:
- Instances:
Multiple
- service dns proxy blocklist name file <file>
- Devices
- Values:
file – Loads a file containing the domains to block
- Instances:
Multiple
- service dns proxy cache
- Devices
DNS proxy caching options
- service dns proxy cache max-negated-ttl <u32>
- Devices
- Values:
u32 – How long, at most in seconds, a not found entry will be kept in cache
- service dns proxy cache max-ttl <u32>
- Devices
- Values:
u32 – How long, at most in seconds, an entry will be kept in cache
- service dns proxy cache min-negated-ttl <u32>
- Devices
- Values:
u32 – How long, at minimum in seconds, a not found entry will be kept in cache
- service dns proxy cache min-ttl <u32>
- Devices
- Values:
u32 – How long, at minimum in seconds, an entry will be kept in cache
- service dns proxy cache size <u32>
- Devices
- Values:
u32 – Maximum number of entries in the cache
- service dns proxy cipher <u32>
- Devices
Cipher algorithms ordered by preference
When this field is not set, the best algorithm will be used based on hardware characteristics that do not compromise the exchanged data. Notice that these algorithms conform a “preference”: If the server and the client agree on one, they will use it. However, if the server has no acceptable algorithm from the one the client asks for, it will just show a warning and choose the proper one. Notice that this feature will do nothing when the communication is encrypted using TLS v1.3: The best algorithm is automatically chosen based on hardware characteristics and connection speed.
- Values:
u32 – Preference of the encryption algorithm (1-18)
- Instances:
Multiple
- Required:
- service dns proxy cipher <u32> algorithm <id>
- Devices
- Values:
id – Cipher algorithm to communicate with the server
- service dns proxy cloaking
- Devices
Configures a set of host entries to point to one or multiple addresses
- service dns proxy cloaking ignore-hosts
- Devices
Do not use system configured host entries
- service dns proxy cloaking name <txt>
- Devices
FQDN, IP, name or RegEx to match when cloaking
An example is worth a thousand words: 1. example.com 2. .example.com 3. *.example. 4. example[0-9]* The examples above will match a FQDN (1), all subdomains of “example.com” (2), all subdomains and all top-level domains (3) and all domains containing either no or “N” numbers at the end, including all top-level domains too (4). Furthermore, as the input value can be anything, here IP addresses may fit too.
- Values:
name – FQDN, IP, name or regular expression used to match incoming requests
- Instances:
Multiple
- Required:
service dns proxy cloaking name <txt> destination <fqdn|ipv4|ipv6>
- service dns proxy cloaking name <txt> destination <fqdn|ipv4|ipv6>
- Devices
Destination to point incoming petitions to
The incoming traffic may be pointed to another domain, IP or IPv6 address. Moreover, that traffic may be load balanced when setting more than one destination address.
- Values:
fqdn – Domain name to point to
ipv4 – Address to point to
ipv6 – IPv6 Address to point to
- Instances:
Multiple
- service dns proxy cloaking ttl <u32>
- Devices
- Values:
u32 – Cloaking TTL used when serving defined entries
- service dns proxy disable-protocol
- Devices
Choose the protocols that will not be used when securing DNS queries
- service dns proxy disable-protocol dnscrypt
- Devices
Skip the DNSCrypt protocol if the server implements it
- service dns proxy disable-protocol doh
- Devices
Skip the DNS-over-HTTPS protocol if the server implements it
- service dns proxy fallback <ipv4|ipv6>
- Devices
Fallback DNS resolvers when no other connection is available
These are normal, non-encrypted DNS resolvers, that will be only used for one-shot queries when retrieving the initial resolvers list and if the system DNS configuration doesn’t work.
- Values:
ipv4 – IPv4 address where the resolver is listening at
ipv6 – IPv6 address where the resolver is listening at
- Instances:
Multiple
- service dns proxy fallback <ipv4|ipv6> port <u32>
- Devices
Port in which the resolver is listening at
- Values:
u32 – Port where resolver is listening at (1-65535)
- service dns proxy force-tcp
- Devices
Always use TCP to connect to upstream servers
This can be useful if you need to route everything through a proxy (like Tor). Otherwise, enabling this option does not improve security and will only increase the latency.
- service dns proxy ipv6
- Devices
IPv6 options for configuring the service
- service dns proxy ipv6 block
- Devices
Block any IPv6 requests (useful when IPv6 is not available)
- service dns proxy ipv6 do-not-query
- Devices
Ignore DNS servers that are only accessible through IPv6
- service dns proxy keepalive <u32>
- Devices
Keepalive for HTTP queries, in seconds
- Values:
u32 – Keepalive in seconds
- service dns proxy listen-address <ipv4|ipv6>
- Devices
Address to listen to incoming connections
- Values:
ipv4 – IPv4 address to listen at
ipv6 – IPv6 address to listen at
- Local IP address:
- Instances:
Multiple
- service dns proxy listen-address <ipv4|ipv6> port <u32>
- Devices
Port to listen at
- Values:
u32 – Port to listen at (1-65535)
- service dns proxy log
- Devices
Enable logging and configure related options
- service dns proxy log level <u32>
- Devices
Log level to use. Defaults to “2”
- Values:
u32 – Verbosity level. 0 is very verbose; 6 only contains fatal errors (0-6)
- service dns proxy require
- Devices
Restrictions and limitations to apply to configured servers
- service dns proxy require dnssec
- Devices
Servers must support DNS security extensions (DNSSEC)
- service dns proxy require no-filter
- Devices
Servers must not enforce its own blocklist (for parental control, ad blocking, …)
- service dns proxy require no-logs
- Devices
Servers must not log user queries (declarative)
- service dns proxy server
- Devices
Configure the DNS proxy as a DoH server too
- Required:
- service dns proxy server cert
- Devices
Certificate to use for securing communications
- Required:
- Required:
- service dns proxy server cert file <file>
- Devices
- Values:
file –
Certificate file for the local DoH server
This certificate file can be generated locally or with an external tool such as Let’s Encrypt. With the first approach, the CA certificate has to be trusted by all clients. With the second approach, the CA certificate is usually trusted by all clients.
- service dns proxy server cert key <file>
- Devices
- Values:
file – Key for the DoH server certificate
- service dns proxy server listen-address <ipv4|ipv6>
- Devices
Address the local DoH server should listen to
- Values:
ipv4 – IPv4 address the local DoH server should listen to
ipv6 – IPv6 address the local DoH server should listen to
- Local IP address:
- Instances:
Multiple
- service dns proxy server listen-address <ipv4|ipv6> port <u32>
- Devices
Port to listen at
- Values:
u32 – Port to listen at (1-65535)
- service dns proxy server path <id>
- Devices
- Values:
id –
Path of the DoH URL
This is not a file, but the part after the hostname in the URL. By convention, “/dns-query” is frequently chosen. For each listen address, the complete URL will have the form:
- service dns proxy server-name <id>
- Devices
- Values:
id – Server to use when querying DNS records
- Instances:
Multiple
- service dns proxy source <id>
- Devices
Remote lists of available servers
Remote lists are a set of servers that are available for querying DNS records. The lists themselves contain all the required information for a client to connect to a server by simply using a known name. For example, to use Cloudflare as the DNS provider by using a list, it would be as simple as defining “service dns proxy server-name cloudflare”. That setting will automatically populate the DNS list for looking for the “cloudflare” provider data. Some companies publish their own lists with their servers. On the other hand, some projects decide to publish lists with generally available servers. An example is DNSCrypt:
- Values:
source – Source identifier
- Instances:
Multiple
- Required:
- Required:
- service dns proxy source <id> minisign-key <id>
- Devices
- Values:
id –
Public key used to verify the content is legitimate
Lists can be served from any location, even from an untrusted ISP. When this occurs, the DNS proxy will immediately detect and reject the source it has been tampered with.
- service dns proxy source <id> prefix <id>
- Devices
- Values:
id – To avoid collisions with other sources, prefix for the declared servers
- service dns proxy source <id> refresh-delay <u32>
- Devices
Refresh delay for the cached source list
- Values:
u32 – Delay for cached source list in hours (24-720)
- service dns proxy source <id> url <txt>
- Devices
- Values:
txt – URL to get the source from
- Instances:
Multiple
- service dns proxy ssl-allow-insecure
- Devices
Disable validation of CA certificate
- service dns proxy static <id>
- Devices
Static configuration for server definitions
- Values:
name – Static definition name
- Instances:
Unique
- service dns proxy static <id> protocol
- Devices
Protocol identifier for this node
- Instances:
Unique
- service dns proxy static <id> protocol dns-crypt
- Devices
The server uses DNSCrypt protocol
- service dns proxy static <id> protocol dns-crypt dnssec
- Devices
The server supports DNSSEC
- service dns proxy static <id> protocol dns-crypt ip <ipv4|ipv6>
- Devices
- Values:
ipv4 – IP address of the server
ipv6 – IP address of the server
- service dns proxy static <id> protocol dns-crypt no-filter
- Devices
The server does not intentionally block domains
- service dns proxy static <id> protocol dns-crypt no-logs
- Devices
The server does not store any logs
- service dns proxy static <id> protocol dns-crypt port <u32>
- Devices
Port where the server is listening at
- Values:
u32 – Port where the server is listening at (1-65535)
- service dns proxy static <id> protocol dns-crypt provider
- Devices
DNS provider related data
- service dns proxy static <id> protocol dns-crypt provider name <id>
- Devices
- Values:
id – DNS provider name
- service dns proxy static <id> protocol dns-crypt provider public-key <id>
- Devices
Provider’s Ed25519 public key, as 32 raw bytes
- Values:
key – Ed25519 public key
- service dns proxy static <id> protocol dns-over-https
- Devices
The server uses DNS over HTTPS (DoH) protocol
- service dns proxy static <id> protocol dns-over-https dnssec
- Devices
The server supports DNSSEC
- service dns proxy static <id> protocol dns-over-https hash <id>
- Devices
The SHA256 digest of one of the TBS certificate
The SHA256 digest of one of the TBS certificate found in the validation chain, typically the certificate used to sign the resolver’s certificate. Multiple hashes can be provided for seamless rotations.
- Values:
sha256 – SHA256 digest of one of the TBS certificate
- Instances:
Multiple
- service dns proxy static <id> protocol dns-over-https host
- Devices
Server host related information
- service dns proxy static <id> protocol dns-over-https host name <fqdn>
- Devices
- Values:
fqdn – Server hostname that will be used also as SNI name
- service dns proxy static <id> protocol dns-over-https host path <txt>
- Devices
- Values:
txt – Absolute URI path. By default, “/dns-query” is used
- service dns proxy static <id> protocol dns-over-https host port <u32>
- Devices
Server port number. If missing, port 443 is assumed
- Values:
u32 – Server port number (1-65535)
- service dns proxy static <id> protocol dns-over-https ip <ipv4|ipv6>
- Devices
- Values:
ipv4 –
IP address of the server
The address can be left empty (unset). In that case, the host name will be resolved to an IP address using another resolver.
ipv6 –
IP address of the server
The address can be left empty (unset). In that case, the host name will be resolved to an IP address using another resolver.
- service dns proxy static <id> protocol dns-over-https no-filter
- Devices
The server does not intentionally block domains
- service dns proxy static <id> protocol dns-over-https no-logs
- Devices
The server does not store any logs
- service dns proxy static <id> stamp <id>
- Devices
- Values:
id –
String that encodes all the required parameters to connect to a server
The stamp is a string that looks like:
- service dns proxy timeout <u32>
- Devices
Time to wait for a DNS query response, in milliseconds
If the available network has a lot of latency, it could be interesting to increase this value. The startup may be slower if changed so do not increase it too much.
- Values:
u32 – Timeout in milliseconds
- service dns proxy whitelist
- Devices
Configures sources to allow
- service dns proxy whitelist ip
- Devices
Allow IPs. RegEx is also supported
- service dns proxy whitelist ip address <txt>
- Devices
- Values:
txt –
Allow IPs based on a pattern
Whitelist are made of patterns. Thus, the following patterns are valid: 127.*
- Instances:
Multiple
- service dns proxy whitelist ip file <file>
- Devices
- Values:
file – Loads a file containing the IPs to allow
- Instances:
Multiple
- service dns proxy whitelist name
- Devices
Allow domains by name. RegEx is also supported
- service dns proxy whitelist name domain <txt>
- Devices
- Values:
txt –
Allow domain based on a pattern
Whitelist are made of patterns. Thus, the following patterns are valid: example.com =example.com sex ads.* ads*.example.* Usually, these whitelist are handled directly with files. However, it is also possible to specify them manually. More information can be found at:
- Instances:
Multiple
- service dns proxy whitelist name file <file>
- Devices
- Values:
file – Loads a file containing the domains to allow
- Instances:
Multiple
- service dns resolver
- Devices
DNS Resolver
- service dns resolver dhcp
- Devices
Enable DNS servers received from DHCP
- service dns resolver dhcpv6
- Devices
Enable DNS servers received from DHCPv6
- service dns resolver local
- Devices
Resolves DNS queries by using a local service
Enabling this option will forward all DNS queries to a local service, previously configured at “service dns forwarding”
- service dns resolver name-server <ipv4|ipv6>
- Devices
DNS servers
- Values:
ipv4 – DNS address IPv4
ipv6 – DNS address IPv6
- Instances:
Multiple
- service dns resolver ppp
- Devices
Enable DNS servers received from PPP
- service dns static
- Devices
Static host entries
- service dns static host-name <txt>
- Devices
- Values:
txt – Host name for static address mapping
- Instances:
Multiple
- Required:
- service dns static host-name <txt> alias <id>
- Devices
- Values:
id – Alias for this address
- Instances:
Multiple
- service dns static host-name <txt> inet <ipv4|ipv6>
- Devices
Address
- Values:
ipv4 – IPv4 address
ipv6 – IPv6 address