DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. It is more secure than the traditional DNS and helps protect user privacy.
To learn more about Firewalla DNS Services, here is a detailed guide: DNS Services Introduction.
How does it work?
When you type a web address or domain name into your address bar, your browser sends a request over the Internet to look up the IP address for that website. Traditionally, this request is sent to servers over a plain text connection. This connection is not encrypted, making it easy for third parties to see what website you’re about to access.
DNS over HTTPS (DoH) works differently. It sends the domain name you typed to a DoH-compatible DNS server using an encrypted HTTPS connection instead of a plain text one. This prevents third parties from seeing what websites you are trying to access.
If DNS over HTTPS is enabled on Firewalla, your device will use the DoH server even if it has its own DNS server configured.
A few important things to note:
- DoH can be slower than traditional DNS queries. (Due to encryption)
- DoH will encrypt your DNS entries. If you have network security devices beyond Firewalla, it will not be able to see the DNS requests.
- If your router maps a domain name to a local IP address, you won't be able to resolve the domain name when DoH is on.
- DNS over HTTPS only encrypts the DNS query. The destination IP address in packet headers can still expose which server/s you are talking to.
- Remember, DNS over HTTPS will only hide your queries from ISPs but NOT the DNS over HTTPS providers.
- We have seen some DoH services are not stable as normal DNS servers, if you encounter problems, please try to change the DoH provider or turn off the service and test again.
How to enable DoH?
Tap on the "More" button on the main page of Firewalla Box, or go to "Settings" -> "Features", you'll find the "DNS over HTTPS" feature. This feature is disabled by default.
To enable "DNS over HTTPS", tap on the feature, switch on the feature button. You can select which devices to apply to, and which server (Cloudflare, Google, Quad9, OpenDNS) to handle the DoH queries.
How to check DoH?
To test DNS over HTTPS, set DNS over HTTPS settings to Cloudflare only (turn others off), then visit https://220.127.116.11/help
If you see problems with the test page, please check following:
- Double-check DoH settings, and make sure only Cloudflare is checked. This test is made by Cloudflare. You can turn on other sources after the test.
- Double-check that the DNS booster is on. (If you don't know what this is, please ignore.)
- Be sure the device doing the test is being "monitored" by Firewalla and that you have included the device in the DoH "Applies to" list.
How use Custom DoH Servers
You can also add customized DoH endpoints. If you want to use a provider other than the defaults provided in the app, you can use the custom DoH server to add any DoH service you like. For example, in addition to simple, unfiltered DoH service, Cloudflare Offers DoH with Filters for Malware and another for Malware and Pornography. You can add them to Firewalla like so:
The same approach will work with OpenDNS' FamilyShield:
Dependencies with other features:
- Family Mode may not work if DoH is on.
- DNS Booster must be turned on for DoH to work.