DoT with Adguard and Zoraxy

[shajman]

Hey all. Would really appreciate if someone could help or guide me on setting up DoT with Zoraxy.

I've just migrated from Traefik to Zoraxy and all my self hosted docker containers work perfectly. The only one I haven't been able to figure out is DNS over TLS.

Currently I'm running Traefik only for the sake of DoT but would prefer to totally migrate to Zoraxy.

The current Traefik compose is:

services:
  traefik:
    image: traefik:latest
    restart: unless-stopped
    ports:
      #- 443:443
      - 853:853
    command:
      - --ping=true
      - --api=true
      - --api.dashboard=false
      - --api.insecure=false
      - --global.sendAnonymousUsage=false
      - --global.checkNewVersion=false
      - --log=true
      - --log.level=DEBUG
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      #- --entryPoints.websecure.address=:443
      - --entryPoints.dot.address=:853
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=****@***.**
      - --certificatesresolvers.letsencrypt.acme.storage=/config/acme.json
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik:/config
    healthcheck:
      test:
        - CMD
        - traefik
        - healthcheck
        - --ping
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - traefik
networks:
  traefik:
    external: true

And AdGuard is:

services:
  adguard:
    image: adguard/adguardhome:latest
    container_name: adguard
    restart: unless-stopped
    expose:
      - "80"
      - "53"
      - "853"
    ports:
      - 53:53/tcp
      - 53:53/udp
      - 81:80/tcp # http web interface
      - 3002:3000/tcp # initial setup web interface
    networks:
      - traefik
    volumes:
      - ./work:/opt/adguardhome/work
      - ./conf:/opt/adguardhome/conf
    labels:
      - traefik.enable=true
      - traefik.tcp.routers.adguard-tls.rule=HostSNI(`***.****.**`) # change with your own domain/sub domain
      - traefik.tcp.routers.adguard-tls.tls=true
      - traefik.tcp.routers.adguard-tls.entrypoints=dot
      - traefik.tcp.routers.adguard-tls.tls.certresolver=letsencrypt
      - traefik.tcp.routers.adguard-tls.service=adguard-tls
      - traefik.tcp.services.adguard-tls.loadbalancer.server.port=53
networks:
  traefik:
    external: true

Would appreciate any help.

[shalafi99]

I believe you would create a stream proxy for TCP 853 in Zoraxy

[shajman]

Hey again shalafi99,

Followed the above, but it didn't work. However, here is the funny thing. When I enabled private DNS on my phone, using the domain I assigned, it says no Internet connection, but I was getting Whatsapp msgs!?

Nothing else would load (browser, apps etc).

For now, I've gone back to Traefik for adguard. What do you think the issue could be? What am I missing?

[shalafi99]

It was something I missed myself while answering your question - I do not use Traefik, did not pay enough attention to your compose files.

I understand these lines here for Traefik:

  - traefik.tcp.routers.adguard-tls.service=adguard-tls
  - traefik.tcp.services.adguard-tls.loadbalancer.server.port=53

Tell it to terminate the TLS connection and forward the received traffic to port 53 in AdGuard

@tobychui can correct me, but I think Zoraxy's Stream Proxy cannot achieve equivalent functionality. Not even a Reverse Proxy can handle that, because it is not http traffic (let alone the fact it is not using port 443/80).

All that standing correct, @shajman I suppose your only 2 choices will be either to

1. keep doing what you are now (using Traefik for DoT)
2. configure your AdGuard itself to listen for DoT traffic (add your certificate there and enable the DNS over TLS protocol).

With this 2nd option you should be able to use Zoraxy's Stream Proxy just fine (it will be passing through the TLS traffic onwards to AdGuard without termination/inspection).

[shajman]

Hi again shalafi99,

Firstly, just wanted to thank you for taking the time to help me with this issue.

With regard to the second option, is there a way I can extract the certificate made via Zoraxy or create a new certificate to add to AdGuard?

[tobychui]

but I think Zoraxy's Stream Proxy cannot achieve equivalent functionality.

Zoraxy Stream Proxy is basically a TCP / UDP proxy that forward packets in the transport layer. And in application layer, Zoraxy only handles HTTP(s) traffics, not DNS traffics. So with Zoraxy Stream Proxy you need something in the adguard side to ingest the TLS headers and extract the payload out of the request.

is there a way I can extract the certificate made via Zoraxy or create a new certificate to add to AdGuard?

If you are using DNS challenge, that can be easily done by setting up a cron job to copy the certificate in the conf folder into your AdGuard instance.

[shajman]

Hey tobychui,

I just wanted to say thank you for this amazing software. I'm genuinely shocked it is not discussed and used more.

Zoraxy Stream Proxy is basically a TCP / UDP proxy that forward packets in the transport layer. And in application layer, Zoraxy only handles HTTP(s) traffics, not DNS traffics. So with Zoraxy Stream Proxy you need something in the adguard side to ingest the TLS headers and extract the payload out of the request.

Any plans to implement this Traefik feature to Zoraxy? :)

If you are using DNS challenge, that can be easily done by setting up a cron job to copy the certificate in the conf folder into your AdGuard instance.

Let me try and do that.