stubby installation and setup
By default DNS traffic is insecure and runs unencrypted over port 53. Here you'll find detailed instructions about how to configure your Linux system with Stubby DNS resolver in the DNS over TLS mode and also how to configure dnsmasq as a caching DNS server.
It's relevant for Linux Mint Cinnamon, XFCE and Mate 19 and later, Xubuntu, Ubuntu 18.04 and later, Debian 10 (Buster) and later, and other distributions with Stubby in its repositories. Otherwise you need to compile Stubby from source.
[1]
Enter in the terminal:
sudo apt install stubby[2]
Verify the status of the installed service:
systemctl status stubby
[3]
Verify that stubby is listening on TCP and UDP ports both on IPv4 and IPv6:
sudo netstat -lnptu | grep stubby
If the netstat command is not found in your system, install net-tools:
sudo apt install net-tools[4]
Do NOT edit /etc/resolve.conf file to change the name server - leave it in its original state.
Note: /etc/resolve.conf may be a symbolic link to the file /run/NetworkManager/resolv.conf, generated by NetworkManager.
[5]
Click the Network Manager icon on the upper-right corner and select Network settings. Then click Wired settings icon (i.e. your current network).
Select IPv4 tab.
To prevent the system from getting DNS server address from your router, switch DNS Automatic button to OFF.
Enter
127.0.0.1 in the DNS field and click Apply button.
Note for Linux Mint XFCE and MATE : On the IPv4 tab set DHCP Method: to Automatic (DHCP) addresses only
[6]
Restart NetworkManager
sudo systemctl restart NetworkManager[7]
Check Network Settings. You'd see that DNS is 127.0.0.1
[8]
Edit the stubby.yml configuration file to add the DNS server that you want to use.
sudo nano /etc/stubby/stubby.ymlGo to the line upstream_recursive_servers: and add the following after this line and above other DNS servers:
For Cloudflare DNS over TLS server:
#CloudFlare servers - address_data: 1.1.1.1 tls_auth_name: "cloudflare-dns.com" - address_data: 1.0.0.1 tls_auth_name: "cloudflare-dns.com"#For Google DNS over TLS server:
# Google - address_data: 8.8.8.8 tls_auth_name: "dns.google" - address_data: 8.8.4.4 tls_auth_name: "dns.google"#Note: The code copied from Blogspot pages can be corrupted (in spite of the code tag). Double-check copy-paste result. Anyway you can find these Cloudflare and Google lines further down in the stubby.yml commented out. Just move them up and remove the #.
Then change the line:
round_robin_upstreams: 1to
round_robin_upstreams: 0Save the file
stubby.yml.If round_robin_upstreams option set to '1' the servers are loadbalanced, if round_robin_upstreams set to '0' only the first DNS server is used.
[9]
Restart stubby:
sudo systemctl restart stubbyCloudflare test page:
[10]
To be sure we are using port 853 and DNS server 1.1.1.1 install Wireshark
sudo apt install wireshark
sudo adduser your_user_name wiresharkLog out and log in to apply the changes.
Start Wireshark, select curent network interface, enter "port 853" in the filter field and click the left icon on the toolbar to start the capture.
A quick test can be done by using dig. Enter in the terminal:
dig A linuxmint.comYou can see in the Wireshark main window that request and answer are encrypted and we are using server 1.1.1.1 and port 853:
[11]
All is working now and you can set up the DNS cache by installing and configuring a separate dns cacher, if any.
dnsmasq installation and setup
[1]
sudo apt install dnsmasq
[2]
sudo nano /etc/default/dnsmasq
Verify these two lines and save the file:
ENABLED=1
IGNORE_RESOLVCONF=yes
[3]
sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf.orig
sudo nano /etc/dnsmasq.conf
Delete the content of dnsmasq.conf and insert in it these lines:
#
# Configuration file for dnsmasq acting as a caching nameserver.
#
# no-hosts = to ignore /etc/hosts
#
no-hosts
#
# no-resolv = not to use /etc/resolv.conf
# no-resolv
server=127.0.0.1#53000
listen-address=127.0.0.1
interface=lo
bind-interfaces
[4]
sudo nano /etc/stubby/stubby.yml
Change two lines under listen_addressesand save the file:
before:
listen_addresses:
- 127.0.0.1
- 0::1
after:
listen_addresses:
- 127.0.0.1@53000
- 0::1@53000
[5]
sudo systemctl restart stubby.service
[6]
sudo systemctl restart dnsmasq.service
[TEST]
Enter the command:
dig A wireshark.com
Repeat the command:
dig A wireshark.com
Note Query times: 12 msec and 0 msec
