Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
macOS DoH! (DNS over HTTPS) using cloudflared
1) Install cloudflared using homebrew:
brew install cloudflare/cloudflare/cloudflared
2) Create /usr/local/etc/cloudflared/config.yaml, with the following content
proxy-dns: true
proxy-dns-upstream:
- https://1.1.1.1/dns-query
- https://1.0.0.1/dns-query
3) Activate cloudflared as a service
sudo cloudflared service install
4) Test
dig +short @127.0.0.1 github.com AA
5) If OK, change DNS on your mac to 127.0.0.1 (System Preferences->Network->Advanced->DNS)
@soderlind

This comment has been minimized.

Copy link
Owner Author

soderlind commented Apr 9, 2018

Note, I had to remove dnsmasq to make this work

brew remove dnsmasq --force isn't enough, you have to remove the /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist file

@soderlind

This comment has been minimized.

Copy link
Owner Author

soderlind commented Apr 9, 2018

@soderlind

This comment has been minimized.

Copy link
Owner Author

soderlind commented May 2, 2018

If DNS resolving stop working, restart the service:

sudo cloudflared service uninstall
sudo cloudflared service install

@Paxa

This comment has been minimized.

Copy link

Paxa commented Jan 14, 2019

Got problem Cannot determine default origin certificate path. No file cert.pem in [~/.cloudflared ~/.cloudflare-warp ~/cloudflare-warp /usr/local/etc/cloudflared /etc/cloudflared]
Solution: cloudflare/cloudflared#68

@fAS6NWnn7xA429U2

This comment has been minimized.

Copy link

fAS6NWnn7xA429U2 commented Jul 14, 2019

Works perfectly. Thank you.

However, when connecting via a VPN, the following issue occurs:

DNS server address 127.0.0.1 is a private address but is not being routed through the VPN.

For some reason, when a private address is used, Tunnelblick/OpenVPN is unable to override the default DNS with its own configuration as it is usually able to do.

Note that everything is still working correctly and neither my IP address nor DNS are leaking in a way that should compromise my privacy. Although, even if I decide to trust Cloudflare, I think I would prefer to use my VPN service's DNS server when I'm connected through it.

Anyone else run into this?

@V33m

This comment has been minimized.

Copy link

V33m commented Jul 18, 2019

However, when connecting via a VPN, the following issue occurs:

DNS server address 127.0.0.1 is a private address but is not being routed through the VPN.

For some reason, when a private address is used, Tunnelblick/OpenVPN is unable to override the default DNS with its own configuration as it is usually able to do.

Anyone else run into this?

@fAS6NWnn7xA429U2, you have to do the following to make your VPN connection change DNS server:

  1. First you have to add a line to your OpenVPN configuration file for each DNS server: "dhcp-option DNS address"
    Example:
    dhcp-option DNS 8.8.8.8
    dhcp-option DNS 8.8.4.4

  2. Then you have to make sure that "Set nameserver" in Tunnelblick's settings for the configuration is specified.

  3. Lastly, you have to check "Allow changes to manually-set network settings" in "Advanced" for the configuration.

There you go 😃

@fAS6NWnn7xA429U2

This comment has been minimized.

Copy link

fAS6NWnn7xA429U2 commented Jul 18, 2019

@V33m — In that case, all I really needed to do was step 3. Thanks!

How do you personally feel about it? Would you rather keep 1.1.1.1 for normal internet activities and then switch it up for VPN use, or just go with 1.1.1.1 for everything to take advantage of its performance?

@V33m

This comment has been minimized.

Copy link

V33m commented Jul 19, 2019

It's difficult to say the policies Cloudfare are going with. They have an agreement with Mozilla where they limit the logged data and data retention for Firefox users which enable DOH and are using DNS https://cloudflare-dns.com/dns-query. I don't think the limited logging policy is the case for DNS 1.1.1.1 / 1.0.0.1...

I advice you to setup different DOH servers for different cases/activities. Here is a list of some possible DOH servers: https://github.com/curl/curl/wiki/DNS-over-HTTPS

@LuisEduLeiva

This comment has been minimized.

Copy link

LuisEduLeiva commented Jul 22, 2019

;; connection timed out; no servers could be reached

When I use dig +short @127.0.0.1 github.com AA

@fAS6NWnn7xA429U2

This comment has been minimized.

Copy link

fAS6NWnn7xA429U2 commented Jul 30, 2019

New Issue: Tunnelblick will only update the WiFi DNS, not the Ethernet DNS.

I've set the priority to Ethernet-first in the Mac settings, turned off WiFi, and even set it to inactive, but Tunnelblick will not switch to Ethernet.

Is there a way to alter Tunnelblick's network priority or more ideally, have it interact with Ethernet only?

@hzbd

This comment has been minimized.

Copy link

hzbd commented Oct 6, 2019

Just a new open doh&dot service:

dns.containpi.com

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.