Home or enterprise router-based secure domain name services
There is disclosed in one example a home router, including: a hardware platform including a processor and a memory; a local area network (LAN) interface; a data store including rules for domain name-based services; and instructions encoded within the memory to instruct the processor to: provision a certificate and key pair to provide domain name system (DNS) over hypertext transfer protocol secure (DoH) or DNS over transport layer security (DoT) services; receive on the LAN interface an encrypted DNS request; decrypt the DNS request; query the data store according to the DNS request; receive a rule for the DNS request; and execute the rule.
1. A home router, comprising:
a hardware platform comprising a processor circuit and a memory;
a local area network (LAN) interface; and
instructions encoded within the memory to instruct the processor circuit to:
receive from an external router management service a fully-qualified domain name (FQDN) for the home router, a domain validation certificate signed by a public certificate authority (CA), and key pair to provide domain name system (DNS) over hypertext transfer protocol secure (DoH) or DNS over transport layer security (DoT) services;
receive on the LAN interface an encrypted DNS request from an endpoint;
decrypt the encrypted DNS request using the key pair;
lookup a rule associated with a domain name of the encrypted DNS request; and
execute the rule.
2. The home router of claim 1 , wherein executing the rule comprises dropping the encrypted DNS request.
3. The home router of claim 1 , wherein executing the rule comprises serving a webpage that indicates a domain name for the encrypted DNS request is blocked.
4. The home router of claim 1 , wherein executing the rule comprises locating a domain name in a DNS cache.
5. The home router of claim 1 , wherein executing the rule comprises forwarding the encrypted DNS request.
6. The home router of claim 1 , wherein executing the rule comprises looking up a local domain name.
7. The home router of claim 1 , wherein the FQDN is derived at least in part from an internet protocol (IP) address of the home router.
8. The home router of claim 7 , wherein the IP address is an internet protocol version 6 (IPv6) address.
9. The home router of claim 1 , wherein the FQDN includes a user-selected subdomain.
10. The home router of claim 1 , wherein the home router includes logic to generate a key pair and certificate signing request (CSR).
11. The home router of claim 1 , wherein the home router further includes an automatic certificate management environment (ACME) client to receive a certificate from the public CA.
12. The home router of claim 11 , wherein the certificate is an IP address-based certificate.
13. A computer-implemented, comprising:
receiving from an external router management service a fully-qualified domain name (FQDN) for a home router, a domain validation certificate signed by a public certificate authority (CA), and a key pair to provide domain name system (DNS) over hypertext transfer protocol secure (DoH) or DNS over transport layer security (DoT) services;
receiving an encrypted DNS request from an endpoint;
decrypting the encrypted DNS request using the key pair;
looking up a rule associated with a domain name of the encrypted DNS request; and
executing the rule.
14. The computer-implemented method of claim 13 , wherein executing the rule comprises locating a domain name in a DNS cache.
15. The computer-implemented method of claim 13 , wherein executing the rule comprises forwarding the encrypted DNS request.
16. The computer-implemented method of claim 13 , further comprising providing an automatic certificate management environment (ACME) client to receive a certificate from the public CA.
17. One or more tangible, nontransitory computer-readable media having stored thereon executable instructions to instruct a processor circuit to:
receive from an external router management service a fully-qualified domain name (FQDN) for a home router, a domain validation certificate signed by a public certificate authority (CA), and a key pair to provide domain name system (DNS) over hypertext transfer protocol secure (DoH) or DNS over transport layer security (DoT) services;
receive an encrypted DNS request from an endpoint;
decrypt the encrypted DNS request using the key pair;
lookup a rule associated with a domain name of the encrypted DNS request; and
execute the rule.
18. The one or more tangible, nontransitory computer-readable media of claim 17 , wherein executing the rule comprises locating a domain name in a DNS cache.
19. The one or more tangible, nontransitory computer-readable media of claim 17 , wherein executing the rule comprises forwarding the encrypted DNS request.