Arch Linux

Arciere · 2021-11-29 15:08:54

.

Last edited by Arciere (2025-04-30 08:40:42)

Trilby · 2021-11-29 15:35:32

While learning for learning sake is great, you are drastically over-complicating things for your stated goal. Several of the programs you mentioned are completely irrelevant: e.g, dnsmasq can be used to run a DNS server (as well as a dhcp server, etc) - it doesn't seem that this is your goal. This is the type of software that OpenNIC would use.

If you just want to use OpenNIC's DNS, simply create /etc/resolv.conf.head with a single line of "nameserver A.B.C.D" where A.B.C.D is the IP address for OpenNIC's server.

Also depending on your ISP, you might question the validity of the anti-ISP DNS arguments you've heard. I've tried a handful of alternative DNSs, and my ISP's is several times faster than any other (not surprising given the network layout). And while it's certainly possible my ISP is keeping a log of my DNS requests, it's pretty unlikely that they are doing so to spy on me ... and even if they are, I couldn't care less. There is nothing so secret about which websites I visit. And if there is anything secret about which websites you are visiting, an alternative DNS doesn't actually add any protection. The ISP still knows where to route your traffic, and can still get the destination domain name quite easily if they wanted to track your activity. If you really think your ISP is spying on you, the only solution is to change ISPs.

FYI, I say this all despite loathing my ISP. They effectively have a monopoly so I have no choice. Their prices are awful, and their customer support is nearly non-existent (and blatantly rude and totally incompetent when it does exist). But I have no security concerns about using their DNS.

Last edited by Trilby (2021-11-29 16:35:11)

Arciere · 2021-11-29 15:46:59

.

Last edited by Arciere (2025-04-30 08:40:33)

Trilby · 2021-11-29 15:53:08

Arciere wrote:

I read somewhere that NetworkManager rewrites this file to its liking, unless the user does something that I don't remember now: did I get it wrong?

NetworkManager most likely rewrites /etc/resolv.conf, but most definitely not /etc/resolv.conf.head or /etc/resolv.conf.tail

Arciere wrote:

Also do I need to install systemd-resolv in order to properly configure /etc/resolv.conf.head?

No. NetworkManager should insert the content of resolv.conf.head before it's own settings in resolv.conf. I say should as I've never used NetworkManager, but that's the whole point of the file - if NM fails to do this, it should be considered a bug. You will need to restart your networking service (i.e., networkmanager.service or whatever it is called). You can then check the content of /etc/resolv.conf to ensure the resolve.conf.head lines(s) are included.

nl6720 · 2021-11-29 16:48:42

/etc/resolv.conf.head and /etc/resolv.conf.tail are specific to dhcpcd. NetworkManager does not use those files.

Head_on_a_Stick · 2021-11-29 17:01:51

For NetworkManager it's probably best to stop it managing /etc/resolv.conf then create the file yourself with the desired contents.

Arciere · 2021-11-29 17:08:54

.

Last edited by Arciere (2025-04-30 08:40:17)

seth · 2021-11-29 21:27:50

The wiki you linked wrote:

openresolv is a resolvconf implementation, i.e. a resolv.conf management framework.

resolv.conf.head is included by dhcpcd, I don't assume networkmanager (let alone resolved) would do the same.

If you're using networkmanager, use its configuration to configure the DNS server, https://wiki.archlinux.org/title/Networ … NS_servers
afaiu that's all you actually want to achieve? Avoid your ISPs shitty DNS server?

Trilby · 2021-11-29 21:38:09

Sorry about misrepresenting resolv.conf.head - I thought that was a more general mechanism. But there will be a mechanism to achieve the same goal in any major networking service. Seth linked to NM-specific info.

Arciere · 2021-11-30 07:35:45

.

Last edited by Arciere (2025-04-30 08:40:09)

seth · 2021-11-30 08:03:47

my ISP's DNS are not slow or poor

Reads like an advertisment for your ISP

The main reason is that I am ashamed of not knowing how to do something as basic as changing simple DNS.

A DNS server is a phone-book for the internet. You know its number, dial it and ask for the number of the page you want to visit.
Plain DNS on port 53 is inherently insecure and your ISP is technically a MitM and can mess with it in all sorts of ways (typically they would simply redirect any communication to port 53 to their own servers) which is why a bunch of mitigations have evolved.
https://en.wikipedia.org/wiki/Domain_Name_System

tl;dr: don't use DoH, it's a dumb idea on many levels.
If you don't suspect aggressive malice from your ISP, most open DNS on 53 will provide you unrestricted domain resolution. If you suspect malice, use a DoT server.
Understand that no matter who you chose to do the domain resolution for you, they will know what domains you're asking for ( don't worry: they all already know that you're watching porn )

Arciere · 2021-11-30 08:22:49

.

Last edited by Arciere (2025-04-30 08:39:31)

Arciere · 2021-11-30 08:25:03

.

Last edited by Arciere (2025-04-30 08:39:24)

seth · 2021-11-30 09:01:45

"::1,127.0.0.1" are the localhost in IPv6 and IPv4 - unless you're running resolved or dnsmasq, there'll be no DNS server (cache) on those IPs and you can omit them

The config is certainly not w/ the ellipsis and you'll have to provide an IP, eg. "84.200.69.80" or "84.200.70.40" - I guess networkmanager has also a GUI to configure this - idk whether it'll automatically prefer 853 over 53, but in doubt, just add the port, eg. "8.8.8.8:853" (google)

Here's a bunch of DNS servers: https://wiki.ipfire.org/dns/public-servers

Arciere · 2021-11-30 10:11:48

.

Last edited by Arciere (2025-04-30 08:39:16)

Arciere · 2021-11-30 10:18:13

.

Last edited by Arciere (2025-04-30 08:39:09)

seth · 2021-11-30 14:20:39

% nmap -p 53,443,853 84.200.69.80
Starting Nmap 7.91 ( https://nmap.org ) at 2021-11-30 15:19 CET
Nmap scan report for 84.200.69.80
Host is up (0.023s latency).

PORT    STATE  SERVICE
53/tcp  open   domain
443/tcp closed https
853/tcp closed domain-s

Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds

Only port 53 is open so that server does only plain DNS.

Arciere · 2021-11-30 14:49:05

.

Last edited by Arciere (2025-04-30 08:39:00)

seth · 2021-11-30 14:52:26

Should I also proceed with this?

That's mutually exclusive from configuring the DNS servers in networkmanager. If you tell NM to stay away from the resolver config, those settings are ignored and you have to write the resolv.conf manually (what HoaS suggested in #6)

Arciere · 2021-11-30 15:14:08

.

Last edited by Arciere (2025-04-30 08:38:47)

Arch Linux

#1 2021-11-29 15:08:54

.

#2 2021-11-29 15:35:32

Re: .

#3 2021-11-29 15:46:59

Re: .

#4 2021-11-29 15:53:08

Re: .

#5 2021-11-29 16:48:42

Re: .

#6 2021-11-29 17:01:51

Re: .

#7 2021-11-29 17:08:54

Re: .

#8 2021-11-29 21:27:50

Re: .

#9 2021-11-29 21:38:09

Re: .

#10 2021-11-30 07:35:45

Re: .

#11 2021-11-30 08:03:47

Re: .

#12 2021-11-30 08:22:49

Re: .

#13 2021-11-30 08:25:03

Re: .

#14 2021-11-30 09:01:45

Re: .

#15 2021-11-30 10:11:48

Re: .

#16 2021-11-30 10:18:13

Re: .

#17 2021-11-30 14:20:39

Re: .

#18 2021-11-30 14:49:05

Re: .

#19 2021-11-30 14:52:26

Re: .

#20 2021-11-30 15:14:08

Re: .

Board footer