1

2024 Ubiquiti DNS Shield Configuration Issue

I noticed that Ubiquiti now allows the use of DNS Shield which allows DNS over HTTPS within the Dream Machine Pro's Controller software. I also noticed that NextDNS has 3 entries in the UniFi control panel by default (see attached screenshot). I have a paid NextDNS Pro account. How do I force Ubiquiti's settings to use my specific paid account? In other words, how do I set it to use "https://dns.nextdns.io/XXXXXX" as an entry?

64 replies

null
    • Roman_Gonzalez
    • 8 mths ago
    • Reported - view

    Hi Guys, I enabled both the CLI and the Custom. is there any issue with doing this? show I only have one?

      • Radman
      • 8 mths ago
      • Reported - view

       you mean you have the DNS Shield set up and the CLI installed? 
       

      there are no issues with that, it’s what I have. 

      • James.46
      • 8 mths ago
      • Reported - view

       this is a pretty smart move, I think I'll do it too! If for whatever reason Unifi OS gets updated and you forget to restart the CLI installation, at least the traffic will continue to pass through NextDNS albeit without device names...

      • NextDNs
      • 8 mths ago
      • Reported - view

       with the latest version of the CLI, it will survive UDM firmware upgrade BTW.

      • Radman
      • 8 mths ago
      • Reported - view

       “kinda”

      as above while it survives it is not fully functional until manually restarted.

    • miles267
    • 8 mths ago
    • Reported - view

    Since Unifi has added the ability to configure NextDNS within their UDM’s UI using Custom DNS (formerly DNS Shield), what is the point or benefit of continuing to use the CLI installer?

      • David_A.1
      • 8 mths ago
      • Reported - view

       You get per device information in the nextdns portal doing it this way. If you use the GUI you can't tell what host made the dns request.

      • Radman
      • 8 mths ago
      • Reported - view

        what David said, I use both. The CLI to add per endpoint info, and DNS Shield for network wide channeling of encrypted DNS.

      • Daniel.53
      • 8 mths ago
      • Reported - view

       one question: does the internal DNS resolution of the Unifi device (e.g. creating own records etc) still work when using either one or both of them, or do you loose this functionality?

    • Defender
    • 8 mths ago
    • Reported - view

    I'm using Control D's CLI which will work with NextDNS or any other DoH/DoT provider.  It's much more stable, survives reboots and firmware updates, and is highly configurable.  Until Ubiquiti changes something in their firmware which they're known for doing.

    • Elliot_Tonquin
    • 6 mths ago
    • Reported - view

    Running Unifi OS 4.1.13 on a UDM Pro with Network v9.0.114. Not interested in installing the CLI at this time. In order to use NextDNS and have the logging and analytics work, do I setup NextDNS using Security->Protection->Encrypted DNS->Custom and just fill in the server name and DNS stamp? I did this and it resolves names, but it doesn't use my profile. I also don't see any entries in the Analytics or Logs tabs. I also tried the Predefined setup and picked NextDNS from the list with the same result.  Do I also need to link my IP and point my WAN interface to the NextDNS primary and secondary? The setup screen makes it look like it's Endpoint or Linked IP, but not both. Some documentation would really help out here. Thank you 

      • jond_7
      • 5 mths ago
      • Reported - view

      Your DNS stamp must include your profile. Enter the stamp below at https://dnscrypt.info/stamps/ and then change "abcdef" to your profile. The site will update the stamp string.

      sdns://AgEAAAAAAAAAAAAOZG5zLm5leHRkbnMuaW8HL2FiY2RlZg

      You can also find your stamp on your NextDNS profile page > Setup Guide under Linux or Routers.

    • James.57
    • yesterday
    • Reported - view

    I see this topic has aged a bit, so I am going to ask this question.  Looking at buying a Ubiquiti UDM-PRO-MAX for my church and for my homelab here.  Can these units work with DOH3 with NextDNS and can they force all traffic connected to the network to use that DNS even if they are using other settings?  Basically I am looking to absolutely ensure that I minimize the chance of someone using the church network for illicit activity and to keep everything child safe.  Looking at these also because in the end there will be four separate VLANS passing through either with or without outside access.  Thank you!

      • Duck.1
      • 15 hrs ago
      • Reported - view

       

       said:
      Can these units work with DOH3

       From my logs, I don't think so, but it's still very fast with DoH. The main benefit with DOH3 is when the network is unreliable. I assume your church has a wired internet connection, so this shouldn't be a problem. NextDNS over HTTPS is likely faster than your ISP using UDP:53.

       said:
      can they force all traffic connected to the network to use that DNS even if they are using other settings? 

       Yes, mostly. 

      You can catch all UDP:53 DNS with a destination NAT rule that redirects it to localhost on your UDM to then be resolved in the same way as clients configured to use your UDM as their DNS server. 

      You may also need a firewall rule allowing the zone with the DNS traffic you want to catch access to localhost port 53.

      You can block port 853 (DoT).

      The UDM firewall has DNS, DNS over TLS and DNS over HTTPS listed as apps. You can block these. I assume it's excellent for DNS and DoT. It's ok for DoH. It blocks most that I've tried, but not all. It would have to use IP addresses that are known to host DoH, as the traffic otherwise looks like any other HTTPS, so unless you are going to block everything it's the best you can do.  (Unless you control every device that connects to your network.)

      You can set up NextDNS with DoT by creating a token with your profile using the DNS crypt calculator or use the CLI tool.

       

       said:
      that I minimize the chance of someone using the church network for illicit activity and to keep everything child safe.

       Someone who is really determined could  get around your restrictions but it would take some knowledge and time. It's much easier to just turn off wifi and use 4/5G. They would know what they're doing and should take all responsibility for anything they see or do. With these things in place your network would be safer than almost all offering BYOD access.

      I'd also suggest doing what you can to block VPNs.

    • jond_7
    • 23 hrs ago
    • Reported - view

    @james.57  I don’t think you can force everyone to use your DNS; those days are gone somewhat. I’ve not configured DOH3 or DoQ and I’m not sure UniFi supports it.  You might be better off asking that in UniFi forums, but here’s what I can say… NextDNS support for DoQ and DOH3 seems sketchy at best. Perhaps you have reasons for requiring these newish protocols, but seems like you might be too soon to the party. 

    - Using the native secure DNS in UniFi (DNS Shield) you can use DOH from the UDM’s “natively.” 

    - Using the NextDNS CLI installed on a UniFi cloud gateway you can use DOH for secure DNS. 

    So if you accept using DOH, not DOH3, you still cannot prevent devices from using their own secure DNS without pretty advanced (draconian?) traffic filtering. DOH uses TCP port 443 which is intended to make blocking it difficult. For example, any Apple user with iCloud Private Relay will be using secure DNS which you will probably not be able to block.  Anyone using the NextDNS client app will also bypass your preferred DNS. 

    Lots of DNS traffic still uses original port 53 DNS, and you can block or redirect such traffic. You may even be able to block the use of DoT, but not DoH. 

    Additional info:

    The CLI does not seem to support DoQ or DOH3, and support is not currently planned:

    - https://github.com/nextdns/nextdns/issues/658

    - https://github.com/nextdns/nextdns/issues/812

    You may be able to get DOH3 working using the Control D client app and NextDNS’s doh3.dns.nextdns.io as reported here:

    https://github.com/Control-D-Inc/ctrld/wiki/Example-Configurations

    This is what NextDNS says about the different protocols:

    https://help.nextdns.io/t/x2hmvas/what-is-dns-over-tls-dot-dns-over-quic-doq-and-dns-over-https-doh-doh3

Login to reply

Content aside

  • 1 Likes
  • 11 hrs agoLast active
  • 64Replies
  • 17286Views
  • 32 Following