documentation/dns-over-https.md

# DoH Server

## Note!

This setup verified partially only. It is slightly better than blocking, but likely DOH clients will refuse to work due certificate mismatch.

## Installing/updating unbound

1. Update typical docker image `docker pull alpinelinux/unbound`
2. You might beed to do in some cases `docker-compose build --no-cache` in directory of unbound docker-compose.yml
3. Generate certificates, same directory where unbound.conf is located

```bash
openssl genrsa -out key.pem 4096
openssl req -new -x509 -key key.pem -out cert.pem -days 3650 \
  -subj "/C=US/ST=State/L=City/O=Organization/CN=spinesystems.solutions"
```
4. Add the following to unbound.conf to `server:` section

```
server:
    ...
    interface: 0.0.0.0@443
    tls-service-key: "/etc/unbound/key.pem"
    tls-service-pem: "/etc/unbound/cert.pem"
```

5. Run the container `docker-compose up -d`

Your unbound ready now to accept DoH requests on port 443

## IPTables on nat/pppoe


```
ipset create dohservers hash:net family inet

# Cloudflare DNS (1.1.1.1, 1.0.0.1)
ipset add dohservers 1.1.1.1/32
ipset add dohservers 1.0.0.1/32
#ipset add dohservers 2606:4700:4700::1111/128
#ipset add dohservers 2606:4700:4700::1001/128

# Google DNS (8.8.8.8, 8.8.4.4)
ipset add dohservers 8.8.8.8/32
ipset add dohservers 8.8.4.4/32
#ipset add dohservers 2001:4860:4860::8888/128
#ipset add dohservers 2001:4860:4860::8844/128

# Quad9 DNS (9.9.9.9, 149.112.112.112)
ipset add dohservers 9.9.9.9/32
ipset add dohservers 149.112.112.112/32
#ipset add dohservers 2620:fe::fe/128
#ipset add dohservers 2620:fe::9/128

# NextDNS (45.90.28.0 - 45.90.31.255)
ipset add dohservers 45.90.28.0/22
#ipset add dohservers 2a07:a8c0::/29

# AdGuard DNS (94.140.14.14, 94.140.15.15)
ipset add dohservers 94.140.14.14/32
ipset add dohservers 94.140.15.15/32
#ipset add dohservers 2a10:50c0::ad1:ff/128
#ipset add dohservers 2a10:50c0::ad2:ff/128

# OpenDNS (Cisco Umbrella) (208.67.222.222, 208.67.220.220)
ipset add dohservers 208.67.222.222/32
ipset add dohservers 208.67.220.220/32
#ipset add dohservers 2620:119:35::35/128
#ipset add dohservers 2620:119:53::53/128

# DNS.SB (185.222.222.222, 185.184.222.222)
ipset add dohservers 185.222.222.222/32
ipset add dohservers 185.184.222.222/32
#ipset add dohservers 2a09::/32

# cloudflare-dns.com
dig +short cloudflare-dns.com A | xargs -n1 ipset add dohservers
# dns.google
dig +short dns.google A | xargs -n1 ipset add dohservers
# dns9.quad9.net
dig +short dns9.quad9.net A | xargs -n1 ipset add dohservers


# Here goes other ipset stuff and maybe iptables rules...

iptables -t nat -A PREROUTING -p tcp --dport 443 -m set --match-set dohservers dst -j DNAT --to-destination 10.0.100.6:443
```

## More complete DOH server list

Thanks to Khodor for contribution!

```
1.1.1.1
1.0.0.1
1.1.1.2
1.0.0.2
1.1.1.3
1.0.0.3
104.16.132.229
104.16.133.229
168.235.81.167
176.56.236.175
176.103.130.131
176.103.130.130
176.103.130.132
176.103.130.134
37.252.185.229
206.189.215.75
104.24.120.142
104.24.121.142
108.61.201.119
139.59.48.222
104.16.249.249
104.16.248.249
199.58.81.218
23.92.29.236
104.28.0.106
104.28.1.106
8.8.4.4
8.8.8.8
185.95.218.42
185.95.218.43
185.222.222.222
185.184.222.222
46.101.66.244
172.64.108.27
172.64.109.27
45.77.124.64
45.32.253.116
104.236.178.232
89.234.186.112
45.90.28.0
45.90.30.0
193.17.47.1
185.43.135.1
136.144.215.158
118.126.68.223
118.89.110.78
47.96.179.163
145.100.185.15
145.100.185.16
174.138.29.175
45.77.180.10
185.216.27.142
217.169.20.23
217.169.20.22
172.65.3.223
188.60.252.16
149.112.112.112
9.9.9.9
149.112.112.9
9.9.9.10
149.112.112.10
9.9.9.11
149.112.112.11
9.9.9.12
149.112.112.12
9.9.9.13
149.112.112.13
43.132.150.250
103.254.108.74
51.38.83.141
51.38.82.198
206.189.142.179
94.237.80.211
185.228.168.9
185.228.169.9
185.228.168.10
185.228.169.11
185.228.168.168
185.228.169.168
139.162.131.245
76.76.2.1
76.76.2.2
76.76.2.3
76.76.2.4
76.76.2.5
76.76.10.1
76.76.10.2
76.76.10.3
76.76.10.4
76.76.10.5
51.89.22.36
164.132.45.112
172.64.105.36
172.64.104.36
195.30.94.28
125.77.154.35
104.27.164.27
104.27.165.27
47.101.136.37
114.115.240.175
119.29.107.85
118.24.208.197
103.2.57.5
103.2.57.6
174.138.21.128
172.104.93.80
146.148.56.78
185.157.233.92
210.17.9.228
96.113.151.141
96.113.151.142
96.113.151.143
96.113.151.147
96.113.151.148
96.113.151.149
96.113.151.150
167.114.220.125
149.56.228.45
5.2.75.75
45.79.120.233
45.67.219.208
185.213.26.187
45.132.75.16
45.91.95.12
45.132.74.167
185.175.56.133
193.29.62.196
103.73.64.132
80.156.145.201
95.216.229.153
51.15.124.208
104.168.247.138
45.153.187.96
185.235.81.1
185.235.81.2
185.235.81.3
185.235.81.4
185.235.81.5
185.235.81.6
146.112.41.2
146.112.41.3
146.112.41.4
208.67.222.222
208.67.220.220
208.67.222.123
208.67.220.123
208.67.220.2
208.67.222.2
88.198.161.8
116.203.35.255
116.203.70.156
174.68.248.77
185.26.126.37
178.62.214.105
35.231.247.227
116.203.115.192
5.45.107.88
46.239.223.80
51.158.147.50
93.177.65.183
146.255.56.98
176.9.93.198
176.9.1.117
13.89.120.251
40.76.112.230
116.203.179.248
198.251.90.114
198.251.90.89
209.141.34.95
199.195.251.84
104.244.78.231
104.18.2.55
104.18.3.55
104.18.26.128
104.18.27.128
149.112.121.10
149.112.122.10
149.112.121.20
149.112.122.20
149.112.121.30
149.112.122.30
74.82.42.42
223.5.5.5
223.6.6.6
130.59.31.251
130.59.31.248
45.90.57.121
95.216.212.177
78.46.244.143
139.162.112.47
192.53.175.149
8.26.56.26
8.20.247.20
139.59.55.13
104.24.122.53
104.24.123.53
209.250.241.25
149.154.153.153
185.233.106.232
185.233.107.4
3.0.59.48
54.169.103.244
172.67.153.154
104.28.13.215
104.28.12.215
176.9.199.158
46.227.200.54
46.227.200.55
185.134.196.54
185.134.197.54
46.227.200.52
46.227.203.52
185.134.196.52
80.241.218.68
159.69.114.157
91.239.100.100
130.225.244.166
130.226.161.34
185.38.24.52
198.180.150.12
89.233.43.71
45.76.113.31
139.99.222.72
45.90.28.1
45.90.28.2
45.90.28.3
45.90.28.4
45.90.28.5
45.90.28.6
45.90.28.7
45.90.28.8
45.90.28.9
45.90.28.10
45.90.28.11
45.90.28.12
45.90.28.13
45.90.28.14
45.90.28.15
45.90.28.16
45.90.28.17
45.90.28.18
45.90.28.19
45.90.28.20
45.90.28.21
45.90.28.22
45.90.28.23
45.90.28.24
45.90.28.25
45.90.28.26
45.90.28.27
45.90.28.28
45.90.28.29
45.90.28.30
45.90.28.31
45.90.28.32
45.90.28.33
45.90.28.34
45.90.28.35
45.90.28.36
45.90.28.37
45.90.28.38
45.90.28.39
45.90.28.40
45.90.28.41
45.90.28.42
45.90.28.43
45.90.28.44
45.90.28.45
45.90.28.46
45.90.28.47
45.90.28.48
45.90.28.49
45.90.28.50
45.90.28.51
45.90.28.52
45.90.28.53
45.90.28.54
45.90.28.55
45.90.28.56
45.90.28.57
45.90.28.58
45.90.28.59
45.90.28.60
45.90.28.61
45.90.28.62
45.90.28.63
45.90.28.64
45.90.28.65
45.90.28.66
45.90.28.67
45.90.28.68
45.90.28.69
45.90.28.70
45.90.28.71
45.90.28.72
45.90.28.73
45.90.28.74
45.90.28.75
45.90.28.76
45.90.28.77
45.90.28.78
45.90.28.79
45.90.28.80
45.90.28.81
45.90.28.82
45.90.28.83
45.90.28.84
45.90.28.85
45.90.28.86
45.90.28.87
45.90.28.88
45.90.28.89
45.90.28.90
45.90.28.91
45.90.28.92
45.90.28.93
45.90.28.94
45.90.28.95
45.90.28.96
45.90.28.97
45.90.28.98
45.90.28.99
45.90.28.100
45.90.28.101
45.90.28.102
45.90.28.103
45.90.28.104
45.90.28.105
45.90.28.106
45.90.28.107
45.90.28.108
45.90.28.109
45.90.28.110
45.90.28.111
45.90.28.112
45.90.28.113
45.90.28.114
45.90.28.115
45.90.28.116
45.90.28.117
45.90.28.118
45.90.28.119
45.90.28.120
45.90.28.121
45.90.28.122
45.90.28.123
45.90.28.124
45.90.28.125
45.90.28.126
45.90.28.127
45.90.28.128
45.90.28.129
45.90.28.130
45.90.28.131
45.90.28.132
45.90.28.133
45.90.28.134
45.90.28.135
45.90.28.136
45.90.28.137
45.90.28.138
45.90.28.139
45.90.28.140
45.90.28.141
45.90.28.142
45.90.28.143
45.90.28.144
45.90.28.145
45.90.28.146
45.90.28.147
45.90.28.148
45.90.28.149
45.90.28.150
45.90.28.151
45.90.28.152
45.90.28.153
45.90.28.154
45.90.28.155
45.90.28.156
45.90.28.157
45.90.28.158
45.90.28.159
45.90.28.160
45.90.28.161
45.90.28.162
45.90.28.163
45.90.28.164
45.90.28.165
45.90.28.166
45.90.28.167
45.90.28.168
45.90.28.169
45.90.28.170
45.90.28.171
45.90.28.172
45.90.28.173
45.90.28.174
45.90.28.175
45.90.28.176
45.90.28.177
45.90.28.178
45.90.28.179
45.90.28.180
45.90.28.181
45.90.28.182
45.90.28.183
45.90.28.184
45.90.28.185
45.90.28.186
45.90.28.187
45.90.28.188
45.90.28.189
45.90.28.190
45.90.28.191
45.90.28.192
45.90.28.193
45.90.28.194
45.90.28.195
45.90.28.196
45.90.28.197
45.90.28.198
45.90.28.199
45.90.28.200
45.90.28.201
45.90.28.202
45.90.28.203
45.90.28.204
45.90.28.205
45.90.28.206
45.90.28.207
45.90.28.208
45.90.28.209
45.90.28.210
45.90.28.211
45.90.28.212
45.90.28.213
45.90.28.214
45.90.28.215
45.90.28.216
45.90.28.217
45.90.28.218
45.90.28.219
45.90.28.220
45.90.28.221
45.90.28.222
45.90.28.223
45.90.28.224
45.90.28.225
45.90.28.226
45.90.28.227
45.90.28.228
45.90.28.229
45.90.28.230
45.90.28.231
45.90.28.232
45.90.28.233
45.90.28.234
45.90.28.235
45.90.28.236
45.90.28.237
45.90.28.238
45.90.28.239
45.90.28.240
45.90.28.241
45.90.28.242
45.90.28.243
45.90.28.244
45.90.28.245
45.90.28.246
45.90.28.247
45.90.28.248
45.90.28.249
45.90.28.250
45.90.28.251
45.90.28.252
45.90.28.253
45.90.28.254
45.90.30.1
45.90.30.2
45.90.30.3
45.90.30.4
45.90.30.5
45.90.30.6
45.90.30.7
45.90.30.8
45.90.30.9
45.90.30.10
45.90.30.11
45.90.30.12
45.90.30.13
45.90.30.14
45.90.30.15
45.90.30.16
45.90.30.17
45.90.30.18
45.90.30.19
45.90.30.20
45.90.30.21
45.90.30.22
45.90.30.23
45.90.30.24
45.90.30.25
45.90.30.26
45.90.30.27
45.90.30.28
45.90.30.29
45.90.30.30
45.90.30.31
45.90.30.32
45.90.30.33
45.90.30.34
45.90.30.35
45.90.30.36
45.90.30.37
45.90.30.38
45.90.30.39
45.90.30.40
45.90.30.41
45.90.30.42
45.90.30.43
45.90.30.44
45.90.30.45
45.90.30.46
45.90.30.47
45.90.30.48
45.90.30.49
45.90.30.50
45.90.30.51
45.90.30.52
45.90.30.53
45.90.30.54
45.90.30.55
45.90.30.56
45.90.30.57
45.90.30.58
45.90.30.59
45.90.30.60
45.90.30.61
45.90.30.62
45.90.30.63
45.90.30.64
45.90.30.65
45.90.30.66
45.90.30.67
45.90.30.68
45.90.30.69
45.90.30.70
45.90.30.71
45.90.30.72
45.90.30.73
45.90.30.74
45.90.30.75
45.90.30.76
45.90.30.77
45.90.30.78
45.90.30.79
45.90.30.80
45.90.30.81
45.90.30.82
45.90.30.83
45.90.30.84
45.90.30.85
45.90.30.86
45.90.30.87
45.90.30.88
45.90.30.89
45.90.30.90
45.90.30.91
45.90.30.92
45.90.30.93
45.90.30.94
45.90.30.95
45.90.30.96
45.90.30.97
45.90.30.98
45.90.30.99
45.90.30.100
45.90.30.101
45.90.30.102
45.90.30.103
45.90.30.104
45.90.30.105
45.90.30.106
45.90.30.107
45.90.30.108
45.90.30.109
45.90.30.110
45.90.30.111
45.90.30.112
45.90.30.113
45.90.30.114
45.90.30.115
45.90.30.116
45.90.30.117
45.90.30.118
45.90.30.119
45.90.30.120
45.90.30.121
45.90.30.122
45.90.30.123
45.90.30.124
45.90.30.125
45.90.30.126
45.90.30.127
45.90.30.128
45.90.30.129
45.90.30.130
45.90.30.131
45.90.30.132
45.90.30.133
45.90.30.134
45.90.30.135
45.90.30.136
45.90.30.137
45.90.30.138
45.90.30.139
45.90.30.140
45.90.30.141
45.90.30.142
45.90.30.143
45.90.30.144
45.90.30.145
45.90.30.146
45.90.30.147
45.90.30.148
45.90.30.149
45.90.30.150
45.90.30.151
45.90.30.152
45.90.30.153
45.90.30.154
45.90.30.155
45.90.30.156
45.90.30.157
45.90.30.158
45.90.30.159
45.90.30.160
45.90.30.161
45.90.30.162
45.90.30.163
45.90.30.164
45.90.30.165
45.90.30.166
45.90.30.167
45.90.30.168
45.90.30.169
45.90.30.170
45.90.30.171
45.90.30.172
45.90.30.173
45.90.30.174
45.90.30.175
45.90.30.176
45.90.30.177
45.90.30.178
45.90.30.179
45.90.30.180
45.90.30.181
45.90.30.182
45.90.30.183
45.90.30.184
45.90.30.185
45.90.30.186
45.90.30.187
45.90.30.188
45.90.30.189
45.90.30.190
45.90.30.191
45.90.30.192
45.90.30.193
45.90.30.194
45.90.30.195
45.90.30.196
45.90.30.197
45.90.30.198
45.90.30.199
45.90.30.200
45.90.30.201
45.90.30.202
45.90.30.203
45.90.30.204
45.90.30.205
45.90.30.206
45.90.30.207
45.90.30.208
45.90.30.209
45.90.30.210
45.90.30.211
45.90.30.212
45.90.30.213
45.90.30.214
45.90.30.215
45.90.30.216
45.90.30.217
45.90.30.218
45.90.30.219
45.90.30.220
45.90.30.221
45.90.30.222
45.90.30.223
45.90.30.224
45.90.30.225
45.90.30.226
45.90.30.227
45.90.30.228
45.90.30.229
45.90.30.230
45.90.30.231
45.90.30.232
45.90.30.233
45.90.30.234
45.90.30.235
45.90.30.236
45.90.30.237
45.90.30.238
45.90.30.239
45.90.30.240
45.90.30.241
45.90.30.242
45.90.30.243
45.90.30.244
45.90.30.245
45.90.30.246
45.90.30.247
45.90.30.248
45.90.30.249
45.90.30.250
45.90.30.251
45.90.30.252
45.90.30.253
45.90.30.254
```