Hacking COMPLETED [RELEASE] YourFriendlyDNS,awesome multi-platform(lin,win,mac,android) local caching and proxying dns

[softwareengineer]

I present to you YourFriendlyDNS 2.0 your very own locally run caching and proxying dns server that only caches and proxies the requests you want, and none you don't and also enables encryption by default so you're very easily encrypting your dns requests out of the box! Your web traffic is important enough to encrypt! So why aren't we treating our dns queries with the same care! Now we can, and easily!

macOS v2.1.1:

TLDR:
V 2.1.1 Links ->

Linux Version: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032228/Linux-x64.zip

Mac Version: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032217/Mac-x64.zip

Windows: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032225/Windows-x64.zip

Android ARM: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032221/Android-armeabi-v7a.zip

Android x86: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032220/Android-x86.zip

Source: https://github.com/softwareengineer1/YourFriendlyDNS/archive/2.1.1.zip

github: https://github.com/softwareengineer1/YourFriendlyDNS

<-


I saw a need in that 'Switch DNS' services are being provided by people where they are keeping how it works behind their server like there's some kind of secret to it or something, which there's not. This is bad if we actually want to use a service like this, because since we don't even know what it's doing behind the scenes it could stop working at any time and we have no indication if/when that happens, except when the thing updates on you and then you're like great thanks random IP I got off the internet! lol. I thought a different approach was better and this is what I had in mind.

A local caching and proxying server that you yourself run and you control exactly how it operates and it's 100% free and open source! I have found myself using it just as my local dns server now even for just basic things (well I had to test it ),since it's kind of nice to have your own dns cache without constantly looking up domains. (And during making this I really got to see just how many requests are fired constantly!) The closest thing I saw like this was a python script, but it still for some reason needed an external ip which I thought defeated the purpose, so not really the same thing. In order for it to be accessible to most people I also made it majorly multi-platform, for linux, mac, windows, and android (and iOS version can be built, but). Since this is a dns server on linux,mac,and windows it binds to port 53 which requires root/administrator, and then depending on which mode is selected (whitelist or blacklist) it will forward the request to your real dns servers of choice (OpenDNS by default) and return a valid response (like A records containing IPs of the domain )!

In whitelist mode everything is forwarded to 127.0.0.1/localhost (you can customize this in the settings) unless it's in the whitelist. Conversely in blacklist mode everything is responded to validly unless it's in the blacklist in which case 127.0.0.1 is returned. Change the amount of minutes the each domain's cache is deemed valid for (for example at 10 minutes after getting the ips for that domain, it won't request them again for 10 minutes and just return the ones from that single request). You can also custom map certain IPs to domains which changes the behavior of just that item in the list (so you can have certain things go to other places besides everything being directed to 127.0.0.1, like for example 10.0.0.1 for a router or 10.0.0.5 for a webserver running on a machine on your network) As you can see it also supports wildcard matching. So for instance: *srv.nintendo.net would match new.firmware.update.prefix.srv.nintendo.net or dauth-lp1.ndas.srv.nintendo.net or basically anything.anything.anything.anything.srv.nintendo.net (just to exemplify the point!)

I always was skeptical about that if they change it to something else, and one of those foreign IP DNSs was just looking for a particular string and they change even a single character in it, then it could bypass their filtering and force an update just by shifting a single bit. I didn't want mine to be that fragile, so this should give you more fine grained control over what or what is not filtered or unfiltered.

I'm open to suggestions for improvement and things to add (but I've spent some time making it proper and responding as fast as possible so it's not noticeable that there's even anything in the middle of you and your actual dns server!) Like for example I've seen one thing where the dns is able to say hey you're trapped behind a captive portal, I haven't figured out how to do that but I think that should be one thing to add as an option if you want to trick it into believing you're behind a captive portal.

I'm going totally free software, totally open source this year and I thought I'd start off with something I saw a need for, which I could also build relatively quickly. If my software helps you in anyway then you know what to do! Support my work and we can make some valuable and totally freedom based software that empowers instead of restricts people, or tries to hide it's functionality and how it works behind a wall. Then instead let's open it up! Let's expose it... This is how it works, it's not that complex it's not some big secret, just here's the code!

What else can we build that's fun? !!!

Thank you! Hope this helps!

Okay the directions for using with the switch or other use:

Two options:
[One]
To ensure you have the latest version you may want to compile it yourself for your desired platform (Either Linux, Mac, Windows, or Android) [iOS if you're jailbroken and feeling adventurous and know an iptables alternative, For Android your device must be rooted as well]

1. Download and install the free software license (non commercial) version of Qt version 5.10 or later
2. Download the source of the project which contains the .pro file(project file) that opens in Qt
3. Open it in Qt and configure it to be built for your platform (for android must have android sdk and ndk installed for linux,windows,mac it'll automatically let you load it)
(Optional: build the latest stable libsodium libraries for the platforms you’re building for, or you’ll be using my compiled ones of 1.0.16 for each platform I’ve built it for)
4. Do a Ctrl+B or Command+B to build the project! Done! Ready to run ->

[Two]
1. Download the whole project (git clone or download zip) and browse to the folder of your platform (Linux-x64 for linux, Mac-x64 for mac, etc...)
2. Copy the entire folder with all the supporting shared libraries to some location you like Done! Ready to run ->

Note: On Linux/Mac/Android It needs to be run as root, so it can bind and listen on udp port 53, and http port 80 that's the only reason it requires it.
Note2: On Windows I discovered it doesn’t need to be run as administrator/root you just have to accept the popup so it’s not blocked in windows firewall.
Also if you run it once and set the port to higher than 1024 that’s another way you can run it without being root (they won’t be on the default dns and http ports, but the servers will actually be running at least on your specified ports)


Now how to run it :
[Linux]
1. Browse to the directory containing it, right click and choose open terminal at this location.
2. Type sudo ./YourFriendlyDNS and enter your password for your user account (must have sudoer privileges or change to a user that does or to root user)
3. Configure it how you like and use an IP displayed on the GUI "Listening IPs: " text label as your DNS server from any device locally connected to the same network as you're running he DNS server on!

[Mac]
1. Browse to the directory containing it, open a terminal, and drag LaunchYourFriendlyDNSAsRoot.sh onto the terminal window.
2. Enter your password so it's granted root access
3. Configure it how you like and use an IP displayed on the GUI "Listening IPs: " text label as your DNS server from any device locally connected to the same network as you're running he DNS server on!

[Windows]
1. Browse to the directory containing it, and right click YourFriendlyDNS.exe and choose Run As Administrator
2. Okay the privilege escalation box, if it appears, so it''s granted Administrator/root access
3. Configure it how you like and use an IP displayed on the GUI "Listening IPs: " text label as your DNS server from any device locally connected to the same network as you're running he DNS server on!

[Android] (Make sure your device is actually rooted and you can run su with no issues and actually truly do have root)
1. Copy and install the apk to your device, use the one for your Android architecture, either ARM or x86. (You may need to enable installing packages from unknown sources if you haven't already)
2. Run the app and when the su root access prompt is displayed hit accept (you only have to do this once, unless you remove it's priviliges from your su app later)
3. Configure it how you like and use an IP displayed on the GUI "Listening IPs: " text label as your DNS server from any device locally connected to the same network as you're running he DNS server on!
[Note: For Android currently the application's GUI has to stay open and visible for DNS requests and responses to be handled, I'm going to fix this but right now I recommend setting your device to not ever sleep / turn off screen and keep it plugged it or be sure to plug it in when it's low so that your YourFriendlyDNS will remain working on your Android. For Devs: Is there a way I can keep it asynchronous while also running those asynchronous dns handlings from that separate thread from the gui/main thread? Make if I first create a new thread and then connect the signals from that thread instead of from the main thread it'll stay working even when backgrounded (as long as the app remains running) I'll look into it!]

[Usage]
Make sure to take it off of 'Initial Mode/Safe Mode' by unchecking that checkbox once you've configured your whitelist/blacklist and it's safe to do so (whitelist is safe immediately, blacklist should be safe immediately as long as those nintendo update servers have stayed the same)

1. Select Whitelist or Blacklist mode
2. Add domain names to whitelist or blacklist, * wildcards are supported, for example: "*gbatemp.net" matches www.gbatemp.net, gbatemp.net, or anything.anything.gbatemp.net
-> If in whitelist mode, a matched domain that's in the whitelist will be accessible, everything else will not be.
-> If in blacklist mode, a matched domain that's in the blacklist won't be accessible, everything else will be.
-> Things that aren't accessible/are blocked will be directed to 127.0.0.1/localhost by default, unless you have a server on that machine on the port for the service you're accessing (ex. trying to access filtereddomain.domain on a device with this dns server configured on a web browser will redirect to http://127.0.0.1 relative to that device the dns is configured to be used on (so that device itself)). You can change this is the settings so it goes to for example another computer on your local network instead.
-> If you add a hostname/domain and also fill in the custom mapping IP field, the IP in the settings is ignored and the mapped IP is returned for domains that match instead. That also changes the behavior of that item in the list and treats it as a special case, to just return that IP instead of any other (can be use in either whitelist/blacklist mode).
3. Change the settings to keep the cached IPs (for whitelisted/non blacklisted domains) treated as valid for longer or shorter (note: too long and your ips might get stale). The cache not kept between instances of the application (eg. If you restart it, it start's fresh.) You can also clear it forcefully at anytime by hitting the "Clear Cache Now" button. Also you can change the real dns servers to use, by default it uses open dns servers. You can add as many as you like and it randomly selects which one to use each time a request needs to be made.

4. Now you are running your own local caching and proxying dns server! You no longer have to worry about an online one going down, or not working properly, because you can always make sure your locally running one is working because you control when it runs and how it's configured!

[ALL DNSCRYPT PROTOCOLS SUPPORTED VERSION 2.1.1 UPDATE] ENCRYPTION ENABLED BY DEFAULT!
*Mac + Windows + Android platforms have been upgraded to version 2.1.1
*Features and improvements below:

{Version 2.1.1}
[LIST=1]
[*]DNS over TLS fixed and working properly now! -> The provided hostname doesn’t necessarily resolve to the right ip to use for DoTLS. Since QSSlSocket inherits from QTcpSocket, I can therefore use connectToHost rather than connectToHostEncrypted (which doesn’t take an ip, only a hostname) and use startEncryption function manually. Using the provided IP address in the stamp if there is one now correctly connects to the DoTLS provider! Also added the 2 byte length prefix that I forgot initially. So now both DNS over HTTPS and DNS over TLS work! :)
[*]Like noted in the dnscrypt stamp specification, if there is no IP address provided or its just a port, it’ll use the hostname instead (a stamp like this should indicate the hostname will resolve to the correct ip to use) and use the port from either place it’s located. So even in that edge case it’ll still work properly!
[*]Alright what else is there to do now? Perhaps have a list of DNSCrypt provider sources to auto download from (might as well since we have a TLS stack now) and let you easily select and add them not requiring manual copying and pasting anymore. Also an inbuilt stamp converter to create stamps from specified server info, or vice versa. (Like dnscrypt.info’s but also doing protocol v3 [I had to manually change the start to “sdns://Aw” (protocol version 3) in my testing of v3 servers])
[*]Looking good now! :)
[/LIST]

{Version 2.1}
[LIST=1]
[*]DNS over HTTPS / DoH support added!
[*]DNS over TLS / DoTLS support added! Note: If using DoH and/or DoTLS providers you should set a dedicated v1 DNSCrypt provider to use to resolve the hosts of DoH and DoTLS providers themselves! :)
[*]Props info now displayed as well for last used provider
[*]Look for the new version 2.1 on the releases page shortly and checkout the new code now! :)
[/LIST]
{==VERSION 2.0==} -> Major milestone!
1. DNSCrypt now supported! Very happy I made it this far!
You locally send it standard plaintext requests as usual and it transparently dnscrypts them for you using the dnscrypt providers you’ve specified.
Now your queries aren’t going over the wire as plaintext anymore! Enabled by default! No fallback (must disable DNSCrypt to use plaintext dns servers again)
2. Can enable new key pair per request otherwise a new key pair is made on every newly validated certificate for that provider.

Just add DNSCrypt stamps in settings to the list of dns servers and make sure enable DNSCrypt checkbox is checked to use them!
ex. "sdns://AQAAAAAAAAAADjIwOC42Ny4yMjAuMjIwILc1EUAgbyJdPivYItf9aR6hwzzI1maNDL4Ev6vKQ_t5GzIuZG5zY3J5cHQtY2VydC5vcGVuZG5zLmNvbQ"
Corresponds to:
Protocol version 0x0001 read -> DNSCrypt!
Provider using IPv4 address: "208.67.220.220"
Provider PubKey aquired... len: 32
Provider name: "2.dnscrypt-cert.opendns.com" len: 27

Currently protocol version 2 (DoH / DNS over HTTPS) isn’t implemented yet, so if adding them they won’t be used at the moment.
I do like how all the necessary information is all contained in the base64 encoded string, so I adopted the stamps as well. No auto sourcing them for now though, manually add them from here: https://github.com/jedisct1/dnscrypt-proxy/wiki/DNS-server-sources

3. IPv6 has been supported without me realizing it since I’ve supported every record type (not just A)! So now I’ve made it also listen on ipv6 addresses as well as ipv4 addresses so now you can not only get ipv4/ipv6 addresses connecting to the server over ipv4 but also connecting to it over ipv6 now as well. (You can set it as an ipv6 dns server)

4. Added a cache viewer
Mac + Windows + Android v2.0 builds are now available!
{Version 1.1.5}
1. Recursion flag now set, which eliminates the 'recursion requested but not available' warning from dig
2. Responding to NXDOMAIN immediately with injected ip / custom ip instead of delaying at all... (I'm interpreting NXDOMAIN response code now, to respond immediately to it)
3. Using the DNS_HEADER structure now when producing answer responses instead of manual offsets with constants
 ->1.1.5 is a beautiful version, I feel like everything is working correctly now.

{Version 1.1.4}
[Bugfix release]
1. Cache was only being triggered to be used after each second request for a certain domain, instead of after the first request.
(Ex. request github.com -> get ips for it cache them -> return response, request github.com -> get ips, cache them -> return response, request github -> return cached ips built response. (until it expires then it will do this again)
Now it will properly just do:
request github.com -> get ips for it cache them -> return response, request github -> return cached ips built response. (until it expires then it will do this again))
2. Added new blacklist default "*cdn.nintendo.net"
So yes nothing major this time, but still the cache should be working properly and now it is again!

{Version 1.1.3}
[Bugfix release]
1. Whitelist mode was broken in 1.1.2, it is now fixed and working again.
2. Instantly responding to requests was broken in 1.1.2, now it's working again too.
 ->That should be the last time anything major is broken at least until 1.2+ hopefully! :)
  ->1.1.3 is a needed update if you have 1.1.2, so make sure to upgrade to it for improved experience.

{Version 1.1.2}
[Features since 1.0]
 1. Inbuilt single file replayer http server (it just replays the same html you specify for any request)
   ->"index.html" file can be edited from the settings
   ->port of the http server can be customized, 0 is off, by default it's 80, which goes to port 8080 on android (and iptables 80 -> 8080)
   ->(port of the dns server can now be customized also, unlike it however, 0 is port 53 still :))
 2. Auto injects the servers first found listening ip by default (ip of dns and now http server) (OOB captive portal capturing)
 3. Upon loading of new version, auto blacklisting of known captive portal urls happens and it's an option in the settings
 4. Improved caching! Now caches and returns for all dns query types instead of just A records.
 [Android Specific]
 5. Event processing now moved to a background thread, allowing it to now entirely run both the dns and http server in the background on android!
   ->You can now minimize it, and it will stay working in the background (no longer depending on gui being visible). As long as the app stays running it'll stay working!
   ->Even though I'm creating some threads it's still ansynchronous. Those threads are to process the ansynchronous events, seperate from the main thread.
 6. Gui looks better on android and is more readable
 7. Now only inserts the iptables forwarding once, so it doesn't just keep inserting the same thing every new running instance into iptables
 8. Runs those iptables inserting with su privileges in it's own thread as well so it also doesn't block the main thread either.
[Bugfixes since 1.0]
 9. Crash on no ip addresses at all received from real dns server for A record
   (What it does now instead of crashing is a delayed not able to load, and then it redirects to the injected ip / server ip / custom ip)
 10. Don't allow blank entries in either lists or dns server box
 11. Improved handling of other dns types and of A records themselves too

V 2.1.1 Links ->

Linux Version: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032228/Linux-x64.zip

Mac Version: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032217/Mac-x64.zip

Windows: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032225/Windows-x64.zip

Android ARM: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032221/Android-armeabi-v7a.zip

Android x86: https://github.com/softwareengineer1/YourFriendlyDNS/files/2032220/Android-x86.zip

Source: https://github.com/softwareengineer1/YourFriendlyDNS/archive/2.1.1.zip

github: https://github.com/softwareengineer1/YourFriendlyDNS

Linux:

Android:
https://i.imgur.com/Y3aDcuJ
https://imgur.com/ApKlkBO

Windows:

 

[_______]

If the above is like your résumé layout, you won't even got an interview from where I'm from.

Also, as seems he provided the source code, I won't recommend anyone runs the pre-compiled binaries that requires admin privileges. Maybe shady stuff has happened before, like show you a clean source with malware integrated binaries provided.

Better off setup some open source Python DNS server script to be safe.

And this is under GPL...which is even worse than virus (or cancer).

 

[Joom]

If the above is like your résumé layout, you won't even got an interview from where I'm from.

Also, as seems he provided the source code, I won't recommend anyone runs the pre-compiled binaries that requires admin privileges. Maybe shady stuff has happened before, like show you a clean source with malware integrated binaries provided.

Better off setup some open source Python DNS server script to be safe.

And this is under GPL...which is even worse than virus (or cancer).

Burden of proof is on you then. Thanks for accepting the challenge. In all seriousness, fuck off with the paranoia and licensing memes.

 

[sweetlilmre]

Also, as seems he provided the source code, I won't recommend anyone runs the pre-compiled binaries that requires admin privileges. Maybe shady stuff has happened before, like show you a clean source with malware integrated binaries provided.

A valid point.

And this is under GPL...which is even worse than virus (or cancer).

An invalid point.

If the above is like your résumé layout, you won't even got an interview from where I'm from.

A nasty and unnecessary point.

The licence under which a stand alone program like this is released should be irrelevant to a user. In terms of contribution for an open source piece of software, GPL is a perfectly valid licence.

Perhaps you could channel your pre-coffee insta-hate into some more constructive feedback?

-(e)

 

[sweetlilmre]

@softwareengineer

I had a look at your code. I would suggest that you perform some range checking in your code, e.g. in initialresponse.cpp


char *ptr = dnsrequest.data();
ptr[2] |= 0x80; //Make It An Answer Response
Ptr is not range checked. Also the code would be a lot cleaner without magic indexes into the arrays.
Consider using constants for this to make your code more readable and maintainable.

-(e)

 

[Kazuma77]

Well, not to let the wind out of your sails or anything, but, I've seen some much closer things to this than a python script, myself. Namely DNSCrypt and pi-hole. Granted, pi-hole is Linux-only, but you can always run a VM. This probably won't replace Simple DNSCrypt as my primary local DNS server for now. Still, it has potential. What would be great is if you could integrate DNSCrypt's functionality into this so that nosy ISPs can't see what you're looking up.

 

[softwareengineer]

@softwareengineer

I had a look at your code. I would suggest that you perform some range checking in your code, e.g. in initialresponse.cpp


char *ptr = dnsrequest.data();
ptr[2] |= 0x80; //Make It An Answer Response
Ptr is not range checked. Also the code would be a lot cleaner without magic indexes into the arrays.
Consider using constants for this to make your code more readable and maintainable.

-(e)

Yes you're right I should check it right there on the spot where I'm writing to it.

when I was writing it, I figured it wouldn't ever make it there if the request was less than the size of a dns header, taken from the top of SmallDNSServer:arseRequest

if(dnsrequest.size() < 12)
{
dns.isValid = false;
return;
}

and in the while loop of SmallDNSServer:rocessDNSRequests


immediately afer parsing or trying to parse the request it does a continue to the next datagram if it's isValid variable is false. I should make the validation smarter though than just if it's at least as large as a DNS_HEADER.

"parseRequest(datagram, dns);
if(!dns.isValid) continue;"

Even though that's there though I should still not depend on code somewhere else to validate what's going on in this function, in case it's changed or there's an edge case I wasn't thinking of or someone just calls it from somewhere without checking it first or something like that.

EDIT: So I've made that part safer now and added the changed it again, making use of the DNS_HEADER structure I already had in place but wasn't using.

edited in dnsinfo.h ->

// DNS header structure : 12 bytes
struct DNS_HEADER
{
    unsigned short id; // identification number

    unsigned char rd :1; // recursion desired
    unsigned char tc :1; // truncated message
    unsigned char AUTHORITATIVE_ANSWER_FLAG :1; // authoritive answer
    unsigned char opcode :4; // purpose of message
    unsigned char QUERY_RESPONSE_FLAG :1; // query/response flag

    unsigned char rcode :4; // response code
    unsigned char cd :1; // checking disabled
    unsigned char ad :1; // authenticated data
    unsigned char z :1; // its z! reserved
    unsigned char RECURSION_AVAILABLE_FLAG :1; // recursion available

    unsigned short q_count; // number of question entries
    unsigned short ans_count; // number of answer entries
    unsigned short auth_count; // number of authority entries
    unsigned short add_count; // number of resource entries
};

edited in initialresponse.cpp ->

void morphRequestIntoARecordResponse(QByteArray &dnsrequest, quint32 responseIP, quint32 spliceOffset, quint32 ttl)
{
    if(dnsrequest.size() >= DNS_HEADER_SIZE) //Make sure there's at least a dns header here to write to
    {
        DNS_HEADER *header = (DNS_HEADER*)dnsrequest.data();

        header->QUERY_RESPONSE_FLAG = 1; //Change from query to response
        if(header->rd == 1) //Do this so there's not even a warning about about recursion requested but not available, let's say yes if it's requested.
            header->RECURSION_AVAILABLE_FLAG = 1;
        header->ans_count = qToBigEndian((quint16)1);
        header->rcode = RCODE_NOERROR;
        // DNS Answer
        unsigned char QAnswer[] = {
            0xc0,0x0c, // 1100 0000 0000 1100 -> offset = 12
            0x00,0x01, // Type  : A
            0x00,0x01, // Class : IN
            0x00,0x01,0x51,0x80, // TTL = 86400 -> 24h
            0x00,0x04, // RD Length
            0x00,0x00,0x00,0x00 // RDATA
        };
        QAnswer[12] = (responseIP & 0xff000000) >> 24;
        QAnswer[13] = (responseIP & 0x00ff0000) >> 16;
        QAnswer[14] = (responseIP & 0x0000ff00) >>  8;
        QAnswer[15] = (responseIP & 0x000000ff);

        QAnswer[6] = (ttl & 0xff000000) >> 24;
        QAnswer[7] = (ttl & 0x00ff0000) >> 16;
        QAnswer[8] = (ttl & 0x0000ff00) >>  8;
        QAnswer[9] = (ttl & 0x000000ff);

        // We add our answer containing our ip of choice! (localhost/127.0.0.1/injected server ip by default, change it in setings or adding a host with a custom ip to either list)
        if(spliceOffset < (quint32)dnsrequest.size()) //Make sure the splice offset / where the answer(s) should go is in bounds or don't use it
            dnsrequest.insert(spliceOffset, (char*)QAnswer, 16);
        else
            dnsrequest.append((char*)QAnswer, 16);
    }
}

Also did the same for the overloaded one that takes multiple ip addresses and builds the request with multiple answers instead of just one.

I've also improved much more areas since then, and it's pretty solid now and even includes dnscrypt encryption!

Well, not to let the wind out of your sails or anything, but, I've seen some much closer things to this than a python script, myself. Namely DNSCrypt and pi-hole. Granted, pi-hole is Linux-only, but you can always run a VM. This probably won't replace Simple DNSCrypt as my primary local DNS server for now. Still, it has potential. What would be great is if you could integrate DNSCrypt's functionality into this so that nosy ISPs can't see what you're looking up.

No wind lost, still sailing smoothly! Debbie downer that doesn't like freedom based software didn't even get me down! As for other things being closer to what I imagined already, I suppose I didn't look hard enough I just started writing code when I saw dns ips being handed out and got an idea. I'm looking into DNSCrypt now (it's apparently by the same people who do OpenDNS, my dns of choice and the default of this application! so I already like it!) It sounds like it encrypts your dns requests so even your ISP can't see what dns requests you're making, that's pretty neat! Is it similar to using port :443 appended to the dns server (for clients that support using a specified port for dns, often it's just assumed port 53) The openDNS ips with port :443 seem to work for example, that's dns over TLS transport, perhaps it isn't the same as dns crypt.

Thanks for seeing the potential! I definitely want to make it better and so DNSCrypt sounds like a nice addition to it, I'll see how I can integrate it.

I'll get to work

EDIT: DNS CRYPT ENCRYPTION NOW SUPPORTED!!!

 

[ScarletDreamz]

So it is like Charles?

 

[charlieb]

Thanks for working on this. good stuff. personally I use dnsmasq but it's great that you are developing this as an alternative.

 

[Mnecraft368]

I can't read any of this because its in bold. The thread doesnt help explain what this actually is either. Also, googling your github account and project name doesnt come up with anything :/
You need 10 posts to post links.

 

[Heatran5400]

For the lazy, https://github.com/softwareengineer1/YourFriendlyDNS

 

[vgmoose]

Cool project! I definitely see the need for an easy to use GUI for people to set this up for personal use, and also to discover what domains might need to be blocked. Also I hope you're not referring to my web-browsing DNS server (45.55.142.122) as one of the secretive ones.

For the captive portal, different devices use different domains to try to "phone home", and if they haven't authenticated yet then they display the page that they are trying to reach instead.

On Switch it (currently) uses the following domains to check whether or not it can get online:

ctest.cdn.nintendo.net
conntest.nintendowifi.net

On iOS it uses this domain:

captive.apple.com

Android appears to use different domains in every version, but here are some I found:

connectivitycheck.gstatic.com
clients3.google.com

When the content that it expects to be at the given domain name isn't there, it opens the domain inside of a mini registration-required browser applet, and then polls the connection URL to see if it does get the expected content (registration complete), and then dismisses the registration applet. In order to fully provide this then, you may need to have some landing page hosted over HTTP on 127.0.0.1 port 80 for the device/Switch to display. (our DNS's landing page HTML source code is here, but it can be anything).

Also if people hosting DNS servers appear to be secretive, it may be because they are hesitant to acknowledge what they are actually blocking out of concern that Nintendo will just add new domains in a new update, or create something to try to workaround it. I do think doing it out in the open has a lot of advantages for the actual potential users of such a service, however.

Currently these are the domains that I'm blocking, but I don't know if that's all of them (my DNS's primary focus isn't update blocking, but I am also interested in hearing what other potential update domains there are).

 

[softwareengineer]

Cool project! I definitely see the need for an easy to use GUI for people to set this up for personal use, and also to discover what domains might need to be blocked. Also I hope you're not referring to my web-browsing DNS server (snipped) as one of the secretive ones.

For the captive portal, different devices use different domains to try to "phone home", and if they haven't authenticated yet then they display the page that they are trying to reach instead.

On Switch it (currently) uses the following domains to check whether or not it can get online:

snipped

On iOS it uses this domain:

snipped

Android appears to use different domains in every version, but here are some I found:

snipped

When the content that it expects to be at the given domain name isn't there, it opens the domain inside of a mini registration-required browser applet, and then polls the connection URL to see if it does get the expected content (registration complete), and then dismisses the registration applet. In order to fully provide this then, you may need to have some landing page hosted over HTTP on 127.0.0.1 port 80 for the device/Switch to display. (our DNS's landing page HTML source code is here, but it can be anything).

Also if people hosting DNS servers appear to be secretive, it may be because they are hesitant to acknowledge what they are actually blocking out of concern that Nintendo will just add new domains in a new update, or create something to try to workaround it. I do think doing it out in the open has a lot of advantages for the actual potential users of such a service, however.

Currently these are the domains that I'm blocking, but I don't know if that's all of them (my DNS's primary focus isn't update blocking, but I am also interested in hearing what other potential update domains there are).

Yes thanks! Once I was no longer doing malformed responses (as reported by dig) and I was actually responding correctly to the requests and then it actually started working fast I thought it was so cool too that I had actually done it! I was so use to doing tcp stuff, that I didn't realize how awesome udp with it's datagrams can be. And no the secretive ones just give an ip and no details about anything, yours is cool

As for the captive portal, oh so that's how it works. I guess my application can already be used to do what's shown in this video I seen on the tube: "How To: Secret Browser on Nintendo Switch! (no PC method)" Which by chance appears to be you! with an accompanying webserver of course. I thought about also building in a simple http server into this project but maybe it should be a separate thing or is it easy to configure any web server to do it? I still might incorporate one and have it be an option in the settings "Enable captive portal trick to browse the web through". Can you really browse to any site though, I thought I heard it only accepts certain domains? Maybe because it believes that it is that domain it works. On computers though I noticed once you browse to the actual website unblocked because of browsers protection called HSTS ->
"It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure https connections,[1] and never via the insecure HTTP protocol"

It then won't work because it adds the https part which automatically means it's going to port 443 instead of 80, and so your webserver only on port 80 won't be accessed and if you run your own on port 443 your certificate won't be recognized as being trusted so it'll give a warning and you have to make an exception through clicking through the dialogs despite it warning you against it! It seems that clearing your browsing history and cache though will allow you to visit that url as http again. Maybe the switch handles it differently though, does switch's browser do HSTS?

So to implement it, I have to see what the expected 'registration complete' response is for that particular captive portal detection for that particular device or browser and first block it(so the switch is like here you gotta go to the captive portal first to access the web) and then instead of it actually being a captive portal, return the 'registration complete' response and redirect to whatever page you want to go to? So you could redirect to a search engine like you've done to basically get anywhere you want from there.

I also thought of another way it could be done, a kind of unusual proxy kind of thing(I dont think quite the same as an http proxy nor a socks5 proxy [but socks5 is closer]), where a custom webserver takes a request on port 80 retrieves all the content from the real page you want (since the switch doesn't have a url input field though it'd have to probably be a url field html inserted at the top of every proxied page!) either from port 80 or port 443 and then returns it as if that special webserver was actually where the content was hosted. I tried something like that before though and it was rather difficult, I mostly got it to return the html of the page but other content on it didn't appear properly... Well it's an idea, and that is really only a cool feature to have not absolutely necessary, and simpler is better I think as long as it works!

As for the switch relevant domains that are blocked, it looks like YourFriendlyDNS already blocks all of those out of the box. Since all of those end with the same ending and the wild card character in the beginning of the three entries in the default blacklist will match any domain of those (the default blacklist contains those three domain endings: *srv.nintendo.net, *d4c.nintendo.net, and *eshop.nintendo.net). Just add *google* and *gstatic* to it and basically all of googles stuff should be dealt with as well! xD

Yes definitely it's much nicer in my opinion to locally handle the filtering on one of your own local machines or devices, and I get that they might change something (can they do that without you updating the firmware, change where it updates from? In case they can->) it might be safer to actually use a whitelist instead of blacklist even though that's kind of more of a pain if you go to a lot of places. That way any new domain they might do will automatically be filtered unless you whitelist it. So that's why I included both options. The srv, d4c, and eshop prefixes are already public info though that they use those for updating and for eshop so including them is fine. Any new ones though maybe since people can easily run their own dns proxier now, can filtered by that person and be kept to themselves if they want and not share what they themselves have set to be filtered!

Glad you like the project, I'll see if I can get that captive portal trick to work!

I can't read any of this because its in bold. The thread doesnt help explain what this actually is either. Also, googling your github account and project name doesnt come up with anything :/
You need 10 posts to post links.

Thanks for the tip, I've updated the post with instructions on how to actually use it and now that it has the links and images it's much easier to understand! Now I feel like my project is well represented!

 

[Kazuma77]

I was not sure how easy, or even practical, it would be to implement DNSCrypt in your project when I requested it. But I see that you have persevered, and here it is. Very impressive. Thanks.

 

[softwareengineer]

Thanks Kazuma77! Guess what else? I also added support for v2 and v3 protocols... So now DNSCrypt, DNS over HTTPS, and DNS over TLS all work!

Premium Version 2.1.1 Released For All Platforms!

Get it here: (or above)
https://gbatemp.net/download/yourfr...upport-encrypting-caching-proxying-dns.33809/

 

[popy]

@softwareengineer: Thanks a lot for this cool project.
Running YourFriendlyDNS now as a service on windows 10.

I have two questions:

1)
When i blacklist the following:

• *.cdn.nintendo.net
• ctest.cdn.nintendo.net
• conntest.nintendowifi.net

The switch always tries to connect to the wifi with the following sequence:

• Try to connect
• can ping the switch from other PC in the same network
• disconnect
• ~15seconds
• can't ping the switch from other PC in the same network during this period
  
• Try to connect
• ... and so on until it gives up because it didnt reacht the ctest.cdn.nintendo.net
• Then, no ping to the switch is possible

So when i'll leave them out, the issue is gone.
System updates & eshop is blocked because the other default blacklist entries (*.srv.nintendo.net, *.d4c.nintendo.net & *eshop.nintendo.net).

My question is: Is it safe to let the ctest.cdn.nintendo.net pass?

2)
I'll know that this project is open source on github and respect the time you put into this.
Please dont get me wrong on this.
Virus total is comming up with the following files:

• opengl32sw.dll -> Bkav -> W64.HfsAutoA.79D3
• Qt5DBus.dll -> Cylance -> Unsafe

I think these are false positives, are they?

Thank you a lot
pOpY

 

[miniadri]

Hi, I'm trying to use this tool, if i understand the programm, i've to set the switch ip to the "Listening IP Address" showing in the programm, right?
The DNS in switch can be set to 90DNS or i have to set them to automatically?
Do i have to change anything more in the switch or programm?

Thanks

 

[Joom]

Hi, I'm trying to use this tool, if i understand the programm, i've to set the switch ip to the "Listening IP Address" showing in the programm, right?
The DNS in switch can be set to 90DNS or i have to set them to automatically?
Do i have to change anything more in the switch or programm?

Thanks

You would use this as your DNS server instead of 90DNS.

 

[miniadri]

You would use this as your DNS server instead of 90DNS.

So i manually add the network on Switch with Static Address shown on "Listening Address" and the other things in auto even DNS, right?

Is there an update list of url/domains to block or someone to add to the list?

Thanks for your answer

 

[Joom]

So i manually add the network on Switch with Static Address shown on "Listening Address" and the other things in auto even DNS, right?

Is there an update list of url/domains to block or someone to add to the list?

Thanks for your answer

No, you use the address provided by this for your DNS because it should be your PC's IP. Your PC is effectively a DNS server now, and will act as a resolver that you have control over. Everything else in your network settings should be set to auto.