Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Ronski]

I'd be interested if those installing the update are able to revert the settings back to true DNS Resolver with DHCP hosts, and still be able to get decent latency plots.

Andy

Installed this morning, only uncheck, saved and applied "Enable Forwarding Mode" and a brief period of really bad pings then it cleared, I've now enabled forwarding mode, will test it again overnight tonight.

[Alex Atkin UK]

I'd be interested if those installing the update are able to revert the settings back to true DNS Resolver with DHCP hosts, and still be able to get decent latency plots.

Andy

You mean assign DNS to dynamic DHCP clients? (or whatever its called)  I believe that's inherently always going to be broken as Unbound has to be restarted every time a new host is added/removed, which takes down DNS for a few seconds.

[Chrysalis]

I'd be interested if those installing the update are able to revert the settings back to true DNS Resolver with DHCP hosts, and still be able to get decent latency plots.

Andy

I dont suggest it, some devices phones etc. can be quite often updating dhcp, and you risk dns resolution outages if you try and do a lookup during a dns service restart.

If dhcp hostnames are important to you then setup dhcp static mapping for those devices.

[Ronski]

With Forwarding mode off I still latency spikes, so I've turned forwarding back on

[Alex Atkin UK]

With Forwarding mode off I still latency spikes, so I've turned forwarding back on

Do you actually notice them in use though or just on the graph?  They don't really look frequent enough to indicate a problem IMO.

[Ronski]

No, but then I don't notice anything detrimental having forwarding mode on either.

[Alex Atkin UK]

We have to remember, ping is only a rough guide.  You can have huge ping latency but real-world performance be fine.

[Ronski]

I'm well aware of that  It certainly wasn't fine when I was having all the problems, it was that bad my daughters were complaining, it's only the tweaks we've made that have improved things. And that final tweak eliminates the last signs of it, with no detrimental effects.

[Chrysalis]

I think the only benefits of direct dns mode (forwarding off) is if for privacy concerns you just dont want to use a MITM dns server for fear of logging, or for commercial use as for that direct has more benefits.  DNS lookups are not just a simple query for one A record, you have to also resolve NS, and other records, some times queries to glue servers as well, so the performance hit on direct mode can be quite significant with much more dns traffic.

[Alex Atkin UK]

There is also the security of getting your results unfiltered from the source, especially domains using DNSSEC.

Even though they added the UI for DNS over TLS, the Netgate staff on the forum always go on about DNS Resolution being the correct way to do DNS.

I can see their logic though, theres always a lot of novices on the forum trying to use Google, Cloudflare and QUAD9, which can give unpredictable results if you randomly get different records back.  Full resolution means you aren't trusting someone to not modify the result.

[Chrysalis]

well i trust them to serve proper dns response, the trust issue is down to logging, tracking, and out of the box configuration will have you using isp supplied dns forwarding, ip results been different? services like google will have many public facing ips, and using a different dns resolver ip could easily have a different one been picked.

it is normal behaviour for ip records to change frequently on some services.

but yeah if you have trust issues thats a reason to go direct.

[Alex Atkin UK]

well i trust them to serve proper dns response, the trust issue is down to logging, tracking, and out of the box configuration will have you using isp supplied dns forwarding, ip results been different? services like google will have many public facing ips, and using a different dns resolver ip could easily have a different one been picked.

it is normal behaviour for ip records to change frequently on some services.

but yeah if you have trust issues thats a reason to go direct.

I don't think that is what they mean, its that services like QUAD9 do filtering, like OpenDNS.  So sometimes you might get a filtered result, sometimes the real one, creating an inconsistent experience.

[Chrysalis]

I dont know what they supposedly mean given I cannot find any posts of them telling people to not use forwarding, but if you are using a forwarder that filters, then unless you mixing it with another resolver that doesnt filter then it will be consistent.  The developers wrote their own dns over tls guide for cloudflare, they wouldnt do that if they didnt support such a configuration.

If someone misconfigures their unit that doesnt make a feature bad or good, thats just simply operator error.

[Alex Atkin UK]

I never said it was bad, I said that there is less scope for user error and for DNSSEC a guarantee you are getting unfiltered DNS rather than trusting the upstream supplier to be honest about how they are managing DNS.

What the forums mods pointed out was if you are using DoT to avoid your ISP logging your DNS, you are still trusting the upstream resolver you are using to not log those requests.  Their logic being that if you are getting all DNS from the root servers, this is less likely to be an issue as any logging is spread across all those servers so no central place to retrieve all your history from.

I'm honestly not sure which side I'm on in this argument.  I kinda liked Cloudflare as my domains are hosted there, but have been using full resolution for a while now.  I do think perhaps I've had a few less resolution errors since doing so but its obviously impossible to really test.

[Chrysalis]

Well yeah its the same for VPNs really dont trust your isp, so use a VPN, but then of course the VPN provider can log etc.

I have moved between different positions, at one point had DNSSEC resolution enabled as well, I have settled on using cloudflare DNS currently.  Going direct DNS doesnt protect you from MITM attacks either, thats why DNSSEC exists but the amount of domains DNSSEC enabled is a pittance and that has its own issues.

Cloudflare dont do trackable logging, unless you think they lying, but one thing I am sure on is I dont think direct DNS resolution is worth it for consumer use, DNS is so performance sensitive.

Ultimately in security there is a bunch of what if's and then there is a bunch of practical situations, if you end up getting your DNS records manipulated, unless its part of a feature like malware/parental filtering on the upstream provider, then its more then likely going to be a compromise on your own network.

Also one thing to consider as well, if your DNS queries are not encrypted, its trivial for an isp to intercept your lookups, try doing DNS encryption direct.

If you are really paranoid, which it sounds like you are, then you could use dnscrypt or something similar to your own private resolver hosted outside of the UK.  Which is what I used to do until I realised it really messes up some geo services (they may check DNS server country origin) include getting ip banned from amazon video.  After I switched to a mainstream forwarder service I realised I just wasnt that bothered enough anymore.

I think most people prefer a 3rd party service to log instead of their own isp as their isp already will have records with their personal details for billing purposes, so its fairly logical to conclude the further away the logging is from your isp the better.