dns over https 简单测试(docker 运行)

 

dns over https 已经成为了标准了，给予我们的dns 解析添加了安全的支持

测试项目使用docker && docker-compose 运行

一张参考图

环境准备

• dnscrypt-proxy (dns 代理的)

直接下载了linux 版本，并安装依赖
https://github.com/jedisct1/dnscrypt-proxy/releases

• doh server

使用源码编译安装,使用docker 的multi stage 构建

• nginx

使用openresty

docker-compose

• 文件

version: "3"
services:
  nginx:
    image: openresty/openresty:alpine
    ports:
    - "443:443"
    - "8080:80"
    volumes:
    - "./nginx/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf"
    - "./nginx/cert/apicaddy.com/cert1.pem:/usr/local/openresty/nginx/conf/cert1.pem"
    - "./nginx/cert/apicaddy.com/privkey1.pem:/usr/local/openresty/nginx/conf/privkey1.pem"

  dns-server:
    image: dalongrong/doh-server
    volumes:
    - "./dns-server/doh-server.conf:/app/doh-server.conf"
    build:
      context: ./dns-server
      dockerfile: Dockerfile
  dns-proxy:
    image: dalongrong/dnscrypt-proxy
    build:
      context: ./dns-proxy
      dockerfile: Dockerfile

• nginx 配置

worker_processes auto;
events {
    worker_connections 65535;
}
http {
    include mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;
    gzip on;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;
    server {
        listen 80;
        server_name localhost;
        charset utf-8;
        location / {
           proxy_set_header Host $http_host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $remote_addr;
           client_body_buffer_size 10M;
           client_max_body_size 10G;
           proxy_buffers 1024 4k;
           proxy_pass http://dns-server:8053;
           real_ip_header X-Forwarded-For;
           real_ip_recursive on;
        }
        location /dns-query {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-NginX-Proxy true;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_redirect off;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_read_timeout 86400;
                proxy_pass http://dns-server:8053/dns-query ;
        }
    }
    server {
        listen 443 ssl http2;
        server_name app.apicaddy.com;
        ssl_certificate cert1.pem;
        ssl_certificate_key privkey1.pem;
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 5m;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:AES256+EDH';
        ssl_prefer_server_ciphers on;
        location / {
           proxy_set_header Host $http_host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $remote_addr;
           client_body_buffer_size 10M;
           client_max_body_size 10G;
           proxy_buffers 1024 4k;
           proxy_pass http://dns-server:8053;
           real_ip_header X-Forwarded-For;
           real_ip_recursive on;
        }
        location /dns-query {
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Host $http_host;
                proxy_set_header X-NginX-Proxy true;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_redirect off;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_read_timeout 86400;
                proxy_pass http://dns-server:8053/dns-query ;
        }
    }
}

• 修改配置文件

因为运行的时候没有启动ipv6 ，同时默认大部分软件绑定的端口是127.0.0.1
doh-server 配置修改
listen = [
    "0.0.0.0:8053",
]
。。。。
upstream = [
    # "1.1.1.1:53",
    # "1.0.0.1:53",
    # "8.8.8.8:53",
    # "8.8.4.4:53",
    "dns-proxy:53"
]
dnscrypt-proxy 配置：
listen_addresses = ['0.0.0.0:53']

构建&测试

• 构建

docker-compose up -d

• 测试
  查询参数的意思参考 https://developers.google.com/speed/public-dns/docs/dns-over-https
  
  http 实际上也是可以访问的，只是及时必须使用https
  
  请求log
  

说明

dns over https 是很不错的东西，从安全以及灵活性，都是比较方便的，更多的使用还有待仔细研究

参考资料

https://github.com/jedisct1/dnscrypt-proxy/releases
https://www.aaflalo.me/2018/10/tutorial-setup-dns-over-https-server/
https://github.com/rongfengliang/dns-proxy-demo
https://github.com/m13253/dns-over-https
https://developers.google.com/speed/public-dns/docs/dns-over-https