DNS over HTTPS

In the land of Russia where your freedom is becoming ever more limited goverment is trying to censor the Internet. Those who are not content with website bans have to find ways how to get around this problem. One way to get around the block is to use Google's DNS instead of the DNS provided by your ISP. After reading Hacker News today I stumbled on an intersting arcticle. The gist is that Google provides an encrypted way to access DNS (unlike traditional UDP which can be easily monitored by your ISP).

Unfortunately there's no way to just point your router or computer to it because DNS has a protocol and since Google secure DNS doesn't conform to it existing programs can't access it directly. So in this article we are going to set up our own DNS server, and yes, it can have blackjack and promiscuous women.

Some kind soul has written a Go package to interact with this secure DNS server. It is located here: https://github.com/wrouesnel/dns-over-https-proxy . We are going to need Go language in order to run that package. Details of how to install and run Go are outside of this article but you can refer to this page https://golang.org/doc/install .

After package was downloaded you need to execute is using the following command (we add debug there to see output):

 
sudo ./bin/dns-over-https-proxy -debug=true -address=127.0.0.1:53 -log.level=debug

In order to test if it's working we need to go into OS network settings and add DNS servers there. We can't do it via router because ISP often adds their own DNS and not all routers have options to ignore it.

There's one more issue. The go script which is running DNS uses a domain name itself. Go to your /etc/hosts file and add the following line:

 
8.8.4.4 dns.google.com

We can check if it's working or not by executing the following command

 
dig -p 53 @127.0.0.1 google.com

Now unfortunately some resources are not just banned by DNS but also by IP. For those you will have to use a proxy in addition to DNS. I highly recommend FoxyProxy browser plugin. Also make sure to connect via HTTPS to these websites otherwise your ISP will be able to inspect the information you are sending to your proxy and will still be able to stop your requests.

P.s. original article by Google: https://developers.google.com/speed/public-dns/docs/dns-over-https

Popular posts from this blog

HTTP server in Ruby 3 - Fibers & Ractors

Image
This is part #2. Head over to part #1 to learn about HTTP in Ruby. Motivation Historically Ruby's been lacking in the concurrency department. Ruby has "native" threads (prior to 1.9 there were only "green"), which means there can be multiple threads controlled by an OS, but only 1 thread can be executed at a time, this is managed via Global Interpreter Lock (GIL). However, native calls and I/O calls can be executed in parallel. During an I/O call, a thread gives up control and waits for a signal that the I/O has finished. This means I/O heavy applications can benefit from multiple threads. In this article we are going to explore different concurrency modes for our HTTP server: Single-threaded Multi-threaded Fibers Ractors Single-threaded Let's start simple and see how a single threaded HTTP server could look like ( full code ): def start socket = TCPServer.new(HOST, PORT) sock...
Read more

Next.js: restrict pages to authenticated users

Image
Many websites have pages that need to be restricted to authenticated users, for example profile pages or dashboards. Next.js web framework comes with a lot of functionality built-in JS compilation, rendering code on server and caching. When it comes to most other aspecs, it's up to a programmer to build, including such needed functionality as restricting access to some pages only to authenticated users. In this article we are going to build just that: a function that augments a page object, that could be used like that: Here's the implementation in TypeScript: In order to make it work on server we are going to need one more utility function fetchWithCookies . When making HTTP request from inside a Web Browser, the browser automatically sends cookies with each requests and then stores new cookies if a response comes in with set-cookie header. On server-side we need to build this feature ourselves, because neither Next.js nor NodeJS make any a...
Read more

Migration locks for TypeORM

Image
Schema migrations is a must-have functionality for any DB framework. TypeORM provides decent utilities for dealing with migrations, however having a decade of experience in Ruby on Rails I got really spoiled and take some features for granted. One of these features is locking a database while a migration going on so 2 processes running concurrently don't step on each other's toes. This is also important when you run migrations in Kubernetes before launching your app. I was really surprised to find out that this basic feature is not supported , so decided to implement it on my own. Implementation // typeormMigrationUtils.ts import { Connection, createConnection } from 'typeorm' import config from '../ormconfig' import CRC32 from 'crc-32' const MIGRATOR_SALT = 2053462845 async function withAdvisoryLock( connection: Connection, callback: () => Promise<void> ): Promise<boolean> { // generate a unique lock...
Read more