DoH and custom DNS servers with OpenWrt
DNS-over-HTTPS (DoH) encrypts DNS traffic for greater privacy and security, and is enabled by default for Canadian users of Firefox.
Its configured in Firefox under
Edit->Settings->General->Network Settings, where
Enable DNS over HTTPS is checked.
Use Provider for Canadians is
CIRA Canadian Shield (Default).
Canadian Shield is a free DNS service offered in three levels:
- Private offers encrypted DNS resolution but no cybersecurity or filtering (this is what is enabled in Firefox)
- Protected adds security to the private service by blocking requests to domains known to contain malware or engage in phishing
- Family adds to the protected service to include blocking pornographic content
Good stuff for web browsing on my own laptop!
How about extending the Canadian Shield service to include all devices on my home network?
I do this by configuring my router/gateway to use the custom DNS servers provided by CIRA. All DNS lookups will flow through the router and be passed on to these servers for resolution.
- Internet service provider is Rogers
- ISP-provided cable modem operates in bridge mode
- OpenWrt installed on router
- Dnsmasq (pre-installed) on router handles both DNS and DHCP for home network
Login to the web console on router.
Network make note of the current DNS servers and their IP addresses of the DNS servers for
IPv4 Upstream and
IPv6 Upstream (these are most likely provided by the ISP).
Keep this information handy in case you need to revert the changes.
By default, OpenWrt itself acts as nameserver for the home network. Client devices receive the router's IP (default:
18.104.22.168). The WAN interfaces tell OpenWrt which external DNS servers it should actually use for IP address lookups.
Network->Interfaces. I have a
WAN interface for IPv4 and a
WAN6 interface for IPv6.
Advanced Settings tab:
Use DNS servers advertised by peers
Use custom DNS serversappears
- Click the
+to add the new DNS addresses for desired level of protection: CIRA DNS resolver addresses
Interfaces there is a notice that
Interface has X pending changes.
Click on the notice and
Save & Apply the changes.
Repeat the procedure for
WAN6 and add the custom DNS servers for IPv6.
Navigate back to
Status->Overview and confirm the change in DNS addresses has been made.
» Later: A backup you don't have to think about is a backup that gets done
« Earlier: Minimal Debian Bullseye