From 2144d31a0455ba32a7a0b655afdef33632a8724d Mon Sep 17 00:00:00 2001 From: Karan Jayachandra Date: Fri, 31 Jul 2026 21:12:16 +0200 Subject: Hardened the server by blocking port 53 and added a deploy script --- modules/adguard.nix | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) (limited to 'modules/adguard.nix') diff --git a/modules/adguard.nix b/modules/adguard.nix index e66d072..35cafc3 100644 --- a/modules/adguard.nix +++ b/modules/adguard.nix @@ -2,12 +2,17 @@ # AdGuard Home - DNS resolver + optional network-wide ad blocker. # -# Plain DNS listens on port 53 (udp/tcp) directly on the public IP. -# DNS-over-TLS (853/tcp) and DNS-over-HTTPS (8443/tcp, path /dns-query) are -# also served directly by AdGuard itself, terminating TLS with their own -# independent Let's Encrypt cert (modules/acme.nix) - NOT via Caddy, since -# Caddy already owns port 443 for its own reverse-proxied vhosts and -# AdGuard's HTTPS/DoH listener needs its own port. +# Plain DNS (port 53, udp/tcp) is disabled (dns.port = 0 below): CERT-Bund/BSI +# flagged this host as an open DNS resolver, abusable for UDP reflection/ +# amplification DDoS since a spoofed source IP gets an amplified response with +# no handshake required. DNS-over-TLS (853/tcp) and DNS-over-HTTPS (8443/tcp, +# path /dns-query) are unaffected by this - both require a real TLS handshake +# with the real client IP, so they aren't spoofable the same way - and remain +# the only supported way to use this resolver. They're served directly by +# AdGuard itself, terminating TLS with their own independent Let's Encrypt +# cert (modules/acme.nix) - NOT via Caddy, since Caddy already owns port 443 +# for its own reverse-proxied vhosts and AdGuard's HTTPS/DoH listener needs +# its own port. # # AdGuard's HTTPS/DoH listener binds to the same host as the plain `http` # listener below (confirmed in AdGuardHome's source: both come from @@ -45,11 +50,11 @@ dns = { bind_hosts = [ "0.0.0.0" ]; - port = 53; - # Clients configure this server's public IPv4 address (not - # dns.karanj.com - that hostname only resolves to the HTTPS web UI - # via Caddy) as their plain DNS resolver, e.g. :53. - # For encrypted DNS, see the client setup notes in README.md. + # port = 0 disables the plain UDP/TCP:53 listener entirely; it does + # not affect the DoT/DoH listeners below, which are configured + # separately under `tls` and stay on. Clients use DoT/DoH exclusively + # - see the client setup notes in README.md. + port = 0; # Upstream DNS resolvers (privacy-respecting) upstream_dns = [ "https://dns.quad9.net/dns-query" -- cgit v1.3.1