DNS over TLS using Stubby (encrypt DNS) - How I made it work

[joet12345]

This took me a while to figure out but I am going to explain it in very simple terms.

1 - Install stubby from the Puppy Package Manager
2 - create two files in /etc. resolv.conf.head and resolv.conf.tail In both files type in nameserver 127.0.0.1 and save.
3 - Add Stubby to start at boot up by going to "system" -> "Boot Manager" -> "Manage startup apps" -> "Add to Startup" type stubby and hit the add button.
4 - open a terminal and type stubby to start it
5 - in a terminal type

Code: Select all

nslookup google.com

to check if stubby is on 127.0.0.1 port 53

That is all, stubby should be working now to its default DNSs

To change to other TSL DNS you need to edit /etc/stubby/stubby.yml... For example if you want to use clearbrowsing DNS you put this in the stubby.yml (you comment out stubby default DNS servers first). https://cleanbrowsing.org/guides/dnsovertls

Code: Select all

- address_data: 185.228.168.9
    tls_auth_name: "security-filter-dns.cleanbrowsing.org" 

NextDNS is also a good one that offers free for a limited amount of queries https://nextdns.io/

That is all...to try stop your internet service provider from snooping on you...probably.

[dimkr]

Another option is https://github.com/dimkr/nss-tls - since Ubuntu 21.04 (and Debian 11) you can apt install -y libnss-tls. In some ways, it's a cleaner solution (note: this is shameless advertising of my own project).

However, it's DoH (DNS-over-HTTPS), not DoT.

[williwaw]

Another option is https://github.com/dimkr/nss-tls - since Ubuntu 21.04 (and Debian 11) you can apt install -y libnss-tls. In some ways, it's a cleaner solution (note: this is shameless advertising of my own project).

However, it's DoH (DNS-over-HTTPS), not DoT.

Cool project, dimkr. would a pet for a non-debian based pup be possible?

[dimkr]

It should be very easy to build on any Puppy, and the dependencies + installation instructions are documented in the README.