DOH - what IPv4 to use?
I did not find and answer to this via searching; apologies if I missed some other post.
--> I have Peplink router on a non-fixed IP address, and am setting up DOH (DNS -over-HTTPS) with NextDNS so that I will not have problems with staying synched to my blocking profile.
However: To set this up, I must provide both the URL (https://dns.nextdns.io/XXXXXX) with the X's being one's profile identifier I believe, _AND_ IPv4 addresses. Which IPv4 addresses should I use?
The ones listed on the NextDNS site, 45.90.28.63 and 45.90.30.63 did not seem to work.
The 'Anycast' versions of these, 45.90.28.0 and 45.90.30.0 , _do_ work, but are not listed on the site anywhere.
If I use 'nslookup dns.nextdns.io' or ping for the same address, I get utterly different IPs, 104.238.X.X and 209.209.X.X which may or may not be linked to my profile ID, and which do not show up on the NextDNS website. I have not tried these yet, but suspect they might be the ones I should use (?)
PS: Neither nslookup nor ping works for the URL given for my DOH (i.e., https://dns.nextdns.io/XXXXXX or a permutation of that which still includes the XXXXXX's).
--> So which IPv4's should I be using to set up DOH on NextDNS? The Anycast versions? The ones from nslookup? Other?
Many thanks!
8 replies
-
DOH only requires the URL of the server. Makes no sense to ask for IP address
-
Many thanks for the reply!
Doesn't the router need a DNS itself, at least on boot, in order to resolve that DOH URL? I assumed that was why it was asking.
I am not clear how the router could make that initial connection without being told its IP address or being given an IP address for a DNS that can resolve the IP of the URL for it.
I suspect I do not understand this. Regardless my router (Peplink) definitely asks for an IP address (two, actually; presume one is a fallback) when entering the URL for DOH. And once I do that, DOH does seem to be working.
Does anyone else run into this, and if so what IPv4's do you enter there?
-
If I use 'nslookup dns.nextdns.io' or ping for the same address, I get utterly different IPs, 104.238.X.X and 209.209.X.X which may or may not be linked to my profile ID, and which do not show up on the NextDNS website.
I believe that's how anycast works. The IP4 address you are given acts as a "virtual IP" which is supposed to connect you to the best anycast server, which is what you're seeing with nslookup.
I did notice your IP4 address is different than mine, but on the same subnet. I think they must have a few iP4 servers depending on your configuration ID.
I hope I'm not adding to your confusion. I'm just another user, that's happy with the service and mostly understand how it works, but not entirely.
-
For anyone coming across this thread in the future:
1. Yes, an IPv4 is required for the initial DOH lookup.
"A network observer can see the initial old style DNS lookup for the encrypted DNS server name."
https://defensivecomputingchecklist.com/indexold.php#dohdot
2. You should be able to use the IPv4's NextDNS gives you (not the ".0" anycast versions). I eventually got versions of those (with a .number number) to work.
3. I WOULD use those, or Quad9 or whatever, since if you use nslookup to get the actual addresses of the servers in (current) use they are quite different -- NOT the main NextDNS IPv4's. Using WHOIS, they look like cloud service providers that NextDNS presumably uses _and thus may shift_ if there are uptime issues. Using the main NextDNS IPv4's will insulate you from that; otherwise if they shift cloud service providers and you were linked to thosecloud providers IP's instead of their NextDNS IPs, I suspect you lose your DNS resolving (read: internet) until you dig into your router and fix the DNS address(es). For more details on how NextDNS is choosing their cloud service folks to maintain high reliability, c.f.:
NextDNS Anycast discussion: https://help.nextdns.io/t/h7hmvak/what-is-anycast-and-ultralow
-
Some devices and applications require an IP address together with the DoH string, this is called bootstrapping.
The correct IPs to be used with bootstrapping are the 45.90.28.0 & 45.90.30.0 which you mentioned earlier.
All of the 45.90.28.*** and 45.90.30.*** subnets are Anycast addresses, just for your info.
-
When considering which IPv4 address to use for DNS over HTTPS (DoH) setup, it’s important to ensure that your network configuration aligns with your device's capabilities. If you’re using an Intel Evo laptop, you’ll benefit from its enhanced connectivity features, like Wi-Fi 6 and Thunderbolt 4, which are designed to handle advanced network tasks more efficiently.
For setting up DoH on your Intel Evo laptop, you can use public IPv4 addresses provided by trusted DNS services such as:
- Google Public DNS: `8.8.8.8` and `8.8.4.4`
- Cloudflare: `1.1.1.1` and `1.0.0.1`
- Quad9: `9.9.9.9` and `149.112.112.112`These addresses are known for reliability and security, which should complement the robust networking capabilities of your Intel Evo laptop. Just make sure to update your DNS settings in your network configuration to point to the chosen IPv4 addresses, and your DoH setup should work smoothly on your Intel Evo device.
Thank You!
Jonathan Jone
Content aside
- 3 mths agoLast active
- 8Replies
- 848Views
-
4
Following