Configure Ubuntu Pi-hole for Cloudflare DNS over HTTPS

last updated in Categories , ,

I installed OpenVPN VPN solutions on Ubuntu for my businesses to secure all data communications. I also set up Pin-hole ad blocker on Ubuntu server along with OpenVPN. How do I force Pi-hole to use Cloudflare DNS over HTTPS (DoH) to increase my privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks?

Pi-hole is a free and open source software to block Internet ads and tracking domains. The most significant advantage is ad blocking on all devices on the network from your smartphone to your tablets including all desktop computers and apps. This page shows how to configure Cloudflare DNS over HTTPS service along with Pi-Hole server running on Ubuntu Linux 18.04 LTS.

Pi-hole DNS over HTTPS

DNS over HTTPS (DoH) is a protocol for DNS resolution through the HTTPS protocol. DoH increase your user’s privacy and security and help prevent manipulation of DNS.

How to configure Pi-hole for Cloudflare DNS

Naturally, you must set up and configure OpenVPN Server on Ubuntu and Pi-hole on Ubuntu Linux 18.04 LTS.

Download Cloudflared

There are numerous DNS over HTTPS (DoH) clients you can use to connect to Cloudflare DNS server IP address 1.1.1.1 and 1.0.0.1. We are going to use Cloudflared by downloading .deb package for Ubuntu. Type the following wget command:
cd /tmp
wget https://bin.equinox.io/c/VdrWdbjqyF/cloudflared-stable-linux-amd64.deb

How to configuring DNS-Over-HTTPS on Pi-hole

Install Cloudflared

Installing cloudflared is comfortable job with the help of apt command or apt-get command:
$ sudo apt install ./cloudflared-stable-linux-amd64.deb
Verify installation, run:
cloudflared --version
Securing DNS with Pi-Hole and Cloudflare DNS over HTTPS

How to add a new Ubuntu Linux user for cloudflared

In order to configuring cloudflared to run on startup, first add a new Linux user named cloudflared using the useradd command:
sudo useradd -r -M -s /usr/sbin/nologin -c "Cloudflared user" cloudflared
Verify that user has been created with the help of grep command and /etc/passwd:
grep '^cloudflared' /etc/passwd
Alternatively, one can use the id command as well on Ubuntu to verify cloudflared user account:
id cloudflared
Lock down the Linux account named cloudflared:
sudo passwd -l cloudflared
sudo chage -E 0 cloudflared

You can see account aging information, run chage command:
sudo chage -l cloudflared
Setup Pihole for Cloudflare DNS over HTTPS

How to configuring cloudflared dns

Create a file named /etc/default/cloudflared as follows using text editor such as vim command or nano command:
sudo vi /etc/default/cloudflared
Append the following text:

## args for cloudflared ##
## 5353 is localhost:5353. This is where dns queries are sent by pi-hole ##
## 1.1.1.1 and 1.0.0.1 are Cloudflare DNS servers ##
CLOUDFLARED_OPTS=--port 5353 --upstream https://1.1.1.1/dns-query --upstream https://1.0.0.1/dns-query

Save and close the file in vim.
Set up permission using chown command:
sudo chown -v cloudflared:cloudflared /usr/local/bin/cloudflared /etc/default/cloudflared
Sample outputs:

changed ownership of '/usr/local/bin/cloudflared' from root:root to cloudflared:cloudflared
changed ownership of '/etc/default/cloudflared' from root:root to cloudflared:cloudflared

How to create systemd startup script for Cloudflared

Type the following command:
sudo vi /lib/systemd/system/cloudflared.service
Append the following config:

[Unit]
Description=cloudflared DoH proxy
After=syslog.target network-online.target
 
[Service]
Type=simple
User=cloudflared
EnvironmentFile=/etc/default/cloudflared
ExecStart=/usr/local/bin/cloudflared proxy-dns $CLOUDFLARED_OPTS
Restart=on-failure
RestartSec=10
KillMode=process
 
[Install]
WantedBy=multi-user.target

Enable and start the cloudflared service

Run the following systemctl command:
sudo systemctl enable cloudflared
sudo systemctl start cloudflared
echo $?
sudo systemctl status cloudflared

Pi-hole for Cloudflare DNS running on Ubuntu 18.04 LTS
Save and exit from the vim.

Verify that cloudflared working

Run the dig command or host command as follows to test Cloduflare DoH proxy:
dig -p 5353 www.nixcraft.com @127.0.0.1
Configure Ubuntu Pi-hole for Cloudflare DNS over HTTPS verification

Configure Ubuntu Pi-hole for Cloudflare DNS over HTTPS

Now, everything is set up and running. Hence, it is time to configure Pi-hole to use the local cloudflared service running on 127.0.0.1 port 5353. Fire the web browser and type the pi-hole admin url as per your setup. In my case my OpenVPN and pi-hole running on 10.8.0.1, hence I type:
http://10.8.0.1/

Pi-hole DNS over HTTPS using cloudflare DoH
Click to enlarge image

Click on the Settings > DNS > Choose Custom 1 (IPv4) under Upstream DNS Servers and enter “127.0.0.1#5353” > Scroll down and click on the Save button.

Conclusion

This page explained DoH, and you learned how to implement DNS-Over-HTTPS on PiHole. For more information see this page here and here.

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Notable Replies

  1. So, I have also setup pihole Using https via cloud flare. But After the user connect via OpenVPN, how do you set the client to point to PIHole DNS with OpenVPN? The openvpn tend to use google DNS.

  2. Edit openvpn config /etc/openvpn/server.conf on server.

    vi /etc/openvpn/server.conf
    

    Delete or comment out existing DNS entries:

    ##Stop using Google DNS for our OpenVPN###
    #push "dhcp-option DNS 8.8.8.8"
    #push "dhcp-option DNS 8.8.4.4"
    

    Next add our PI-Hole DNS IP address i.e. OpenVPN DNS address:

    push "dhcp-option DNS 10.8.0.1"
    

    Save and close the file. Restart the OpenVPN server:

    sudo systemctl restart openvpn@server
    

    Read for more info (see section Update OpenVPN config to push our PI-hole dns server):

    Once done. Test your DNS using any online service that shows your current DNS. It should now show cloudflare. For example (look for Cloudflare):

    curl http://$RANDOM.dns.whatsmydnsserver.com/api
    
  3. @hooman64 welcome to nixCraft forum!

    First, verify that all files created and path specified correctly as per tutorial. Second, Can you see the log for the service? It should give you some hint.

    sudo systemctl status cloudflared
    sudo journalctl -u cloudflared
    

Continue the discussion www.nixcraft.com

3 more replies

Participants

Historical Comment Archive

7 comment

    Still, have a question? Get help on our forum!