We recently had a blog post on how to secure your DNS traffic using DNS-over-TLS or DNS-over-HTTPS (German only). The article gave an introduction on how to run dnsdist as a local resolver on Debian11. In this case, dnsdist would accept queries using DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).
This surely is the right solution for those scenarios, where your clients are capable of speaking DoT or DoH natively. But what if they don’t? In this case you can create your own resolver that listens on the “usual” aka unencrypted DNS ports. The DNS traffic on your local network is then unencrypted, which might or might not be acceptable depending on your threat analysis. Once the requests have reached your local resolver, it will forward them using DoH to a server of your choice. Which one to pick is up to you, a list of available servers can be found at DNSprivacy.org.
In this article, we will run our own resolver in Kubernetes using a helm chart for
cloudflared. Despite the name, it can be used with many different endpoints, not just the ones from Cloudflare.
Blocky is a dns-proxy capable of blocking undesired content, i.e. ads or malware. It supports blocklist-based filtering, supports new DNS protocols like
DoH (DNS-over-HTTPS) or
DoT (DNS over TLS) and a gazillion of other features. It is being provided as a docker image, and while docker is a fascinating piece of software, who choses to run things in plain Docker when you can do so in Kubernetes? While not everyone might be running Kubernetes at home, with k3s this is really easy. And it uses the same Kubernetes resources you see in data centers and edge locations and windparks and cars and whatnot.
This article will describe how to setup Blocky within your Kubernetes cluster, how to make it available from the outside and how to start using it. The configuration of Blocky itself is explained in full details in the project’s documentation, and as the installation inside Kubernetes uses the same configuration file, all of it applies also to instances within Kubernetes.
Let’s get started, shall we?Weiter lesen ...
This article describes how to setup Traefik as ingress controller to do that, using Gitea as an example.Weiter lesen ...
Sollte man sich schon mal k3s, die kleine Kubernetes-Distribution von Rancher Labs, angeschaut oder allgemein in der Kubernetes-Dokumentation über die zusätzlichen Controller gestolpert sein, so wird man vielleicht schonmal “Traefik” gelesen haben und sich fragen: was ist das eigentlich?Weiter lesen ...