Upstream Providers Configuration
Relevant source files
The following files were used as context for generating this wiki page:
The Upstream Providers Configuration is a critical component of the DNS hardening project, designed to ensure that all recursive DNS queries leaving the local system are encrypted, authenticated, and resilient. This system transitions the host from relying on unencrypted ISP resolvers to using professional-grade, encrypted upstream providers via DNS over TLS (DoT).
The configuration primary focuses on three layers of provider interaction: the primary hardened resolution via Unbound, the system-level nameserver redundancy in resolv.conf, and emergency restoration endpoints. By utilizing multiple diverse providers like Cloudflare and Quad9, the system protects against BGP hijacking and provider-specific outages while maintaining a "Top 1-2%" global security posture.
Sources: README.md:3-12, DNS_Hardening_Complete_Guide.md:329-335, UNBOUND_TLS_STATUS.md:7-14
Hardened Upstream Resolution (Unbound)
Unbound acts as the primary gateway to upstream providers. It is configured to forward all queries (designated by the name: "." zone) to specific encrypted endpoints using port 853.
Encrypted Forwarding Logic
The system uses the forward-zone directive to define how Unbound communicates with the outside world. Key settings include:
- forward-tls-upstream: Set to
yesto mandate that all upstream communication uses TLS encryption. - forward-first: Set to
yes, allowing the resolver to attempt forwarding first but providing a mechanism to fall back to recursive root hints if necessary (though strictly governed by security policies). - tls-cert-bundle: Points to
/etc/ssl/certs/ca-certificates.crtto verify the identity of the upstream TLS certificates.
Sources: configs/unbound.conf:29-30, configs/unbound.conf:77-88
Primary and Secondary TLS Providers
The configuration prioritizes two major privacy-focused providers. Each provider is defined by its IP address, the DoT port (853), and its authenticated TLS hostname to prevent impersonation.
| Provider | IP Address | TLS Hostname | Role |
|---|---|---|---|
| Cloudflare | 1.1.1.1, 1.0.0.1 | cloudflare-dns.com | Primary Upstream |
| Quad9 | 9.9.9.9, 149.112.112.112 | dns.quad9.net | Secondary Upstream |
Sources: configs/unbound.conf:81-84, UNBOUND_TLS_STATUS.md:11-14
The diagram shows the flow of a local DNS query being processed by Unbound and forwarded to authenticated upstream providers over encrypted channels.
System-Level Nameserver Redundancy
While Unbound handles the encrypted heavy lifting, the system's resolv.conf is configured to ensure connectivity even if the local service experiences issues. This file is protected with an immutable flag to prevent unauthorized changes by services like NetworkManager or Portmaster.
Nameserver Hierarchy
- 127.0.0.1: The primary target, directing traffic to the local hardened Unbound instance.
- 1.1.1.1 / 1.0.0.1: Secondary fallbacks to Cloudflare.
- 9.9.9.9: Tertiary fallback to Quad9.
Sources: scripts/dns_harden.sh:34-40, README.md:113-118
Redundancy Parameters
The configuration applies specific options to manage how the system interacts with these providers:
- timeout:2: Limits the wait time for a response to 2 seconds.
- attempts:3: Retries a query up to 3 times before moving to the next provider.
- trust-ad: Instructs the system to trust the Authenticated Data (AD) flag provided by the upstream (crucial for DNSSEC).
Sources: scripts/dns_harden.sh:41-44, TEST_RESULTS.md:14-22
Emergency Restoration Endpoints
In the event of a total system failure where hardened configurations block access, an emergency restoration script (dns_restore.sh) resets the system to use a broad set of reliable public providers. This ensures the user can regain internet access to troubleshoot the hardened setup.
Restoration Provider List
The restoration script populates /etc/resolv.conf with a wide array of providers to maximize the chance of a successful handshake:
- Cloudflare (1.1.1.1, 1.0.0.1)
- Quad9 (9.9.9.9, 149.112.112.112)
- Google DNS (8.8.8.8, 8.8.4.4)
Sources: scripts/dns_restore.sh:62-69, DNS_Hardening_Complete_Guide.md:73-80
The sequence diagram illustrates the difference between the standard hardened path through Unbound/DoT and the emergency path used during restoration.
Connectivity Monitoring
The project includes specific monitoring for upstream provider health, particularly focusing on the status of TLS connections.
TLS Connection Verification
The system monitors active connections to port 853 to ensure that the "Upstream Providers" are actually communicating over encrypted channels.
- Command:
sudo ss -tupn | grep 853is used to verify established TLS sessions. - Expected State: Multiple ESTABLISHED connections to the IPs of Cloudflare and Quad9.
- Alerting: The
dns_tls_monitor.shscript triggers an alert if Unbound is running but no port 853 connections are detected after active queries are performed.
Sources: UNBOUND_TLS_STATUS.md:8-14, scripts/dns_tls_monitor.sh:26-34, README.md:195-201
Summary of Configuration Values
The following table summarizes the key upstream configuration parameters found across the project files.
| Configuration Element | Value | Purpose |
|---|---|---|
| Upstream Port | 853 | Standard port for DNS over TLS communication. |
| TLS Bundle Path | /etc/ssl/certs/ca-certificates.crt | Verifies upstream provider certificates. |
| Primary IPs | 1.1.1.1, 1.0.0.1 | High-performance encrypted resolution. |
| Secondary IPs | 9.9.9.9, 149.112.112.112 | Security/Malware-blocking resolution. |
| Forward First | yes | Allows fallback if forwarding fails. |
Sources: configs/unbound.conf:30-88, README.md:104-106
The Upstream Providers Configuration ensures that DNS traffic is not only encrypted but also distributed across geographically and organizationally diverse entities, providing a robust defense against localized failures and surveillance.