nixpkgs/nixos/modules/services/networking/dnscrypt-proxy.xml

70 lines
1.8 KiB
XML
Raw Normal View History

<chapter xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="sec-dnscrypt-proxy">
<title>DNSCrypt client proxy</title>
<para>
The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled
upstream resolver. The traffic between the client and the upstream
resolver is encrypted and authenticated, mitigating the risk of MITM
attacks, DNS poisoning attacks, and third-party snooping (assuming the
upstream is trustworthy).
</para>
<sect1><title>Basic configuration</title>
<para>
To enable the client proxy, set
<programlisting>
services.dnscrypt-proxy.enable = true;
</programlisting>
</para>
<para>
Enabling the client proxy does not alter the system nameserver; to
relay local queries, prepend <literal>127.0.0.1</literal> to
<option>networking.nameservers</option>.
</para>
</sect1>
<sect1><title>As a forwarder for another DNS client</title>
<para>
To run the DNSCrypt proxy client as a forwarder for another
DNS client, change the default proxy listening port to a
non-standard value and point the other client to it:
<programlisting>
services.dnscrypt-proxy.localPort = 43;
</programlisting>
</para>
<sect2><title>dnsmasq</title>
<para>
<programlisting>
{
services.dnsmasq.enable = true;
services.dnsmasq.servers = [ "127.0.0.1#43" ];
}
</programlisting>
</para>
</sect2>
<sect2><title>unbound</title>
<para>
<programlisting>
{
services.unbound.enable = true;
services.unbound.forwardAddresses = [ "127.0.0.1@43" ];
}
</programlisting>
</para>
</sect2>
</sect1>
</chapter>