Ability to completely disable plain DNS

[ammnt]

Hello,

please add an option to completely disable incoming queries via 53 ports to prevent DDoS-attacks. For example:
https://forum.adguard.com/index.php?threads/spam-pizzaseo-com.38335/

I know it can be done with a firewall. And that 's what I did, but it seems reasonable to me if there is a separate function in the AGH itself for that.

Thank you.

Cheers!

[devinslick]

@ammnt @ameshkov ,
We might also want to consider extending this feature request to changing the default DNS port OR disabling it entirely. There are valid use-cases for both situations.
Here's one that applies to me.
I have 2 AGH instances supporting a split DNS config. My external clients connect using DNS over HTTPs and do not need port 53. While as OP suggested, we could simply not open 53 to the firewall (or into docker NAT), this is still wasting cycles running a service that isn't being used. Further, if you aren't using Docker (or are using docker host networking for both) then you can't change the ports, so you wouldn't be able to run both AGH instances on the same hardware.

IMO, disabling or changing default DNS ports should have a very explicit warning, but be allowed in the config.

What do you think?

[ammnt]

@devinslick, i like it 🤟

[ameshkov]

@devinslick

changing the default DNS port

Changing the default DNS port is already possible, but you need to do it when you go through the initial AG Home setup screens, there's no option to do it after that.

Alternatively, you can do it later by editing AdGuardHome.yaml

[devinslick]

@ammnt , You could use a firewall rule or just stop exposing port 53 to AGH and just expose the ports you need. v102 introduced rate limiting. Doesn't that address your concern about DDOS?

[ammnt]

@ainar-g, FYI:

Zero port when unencrypted DNS is disabled via conf file🤭

[ainar-g]

@ammnt, just to be clear, what do you mean by “disable incoming queries via 53 port”? Do you mean serving plain DNS on a different port—which is already available—or completely disabling plain DNS on any port?

[ammnt]

@ainar-g, i want AGH to stop processing unencrypted queries through 53 port (serving plain DNS, yeah), stop listening to 53 port completely, and free up 53 port for other applications.

To solve this problem, I suggest adding the variable false or null for bind_port. For example, I specified the values of 0 for DoQ and DoT ports and so turned them off completely. If this is not possible, then I propose another solution - some mode to stop processing unencrypted queries through 53 ports from external networks, but only loopback, localhost, link-local etc. Thank you😗

[ainar-g]

If you only need to free up port 53, why not just move AGH to another port, say 5353? We'll introduce the ability to completely disable plain DNS eventually, but why not use this workaround until then?

[ammnt]

If you only need to free up port 53, why not just move AGH to another port, say 5353? We'll introduce the ability to completely disable plain DNS eventually, but why not use this workaround until then?

I do not need unencrypted plain DNS and I have already done this by specifying a zero port. I just want users to be able to manage this and there was no zero port in this case😅

[ainar-g]

Ah, I see, thanks. We'll probably be able to do this either during or after the API refactoring, so approximately v0.108 or early v0.109 cycles.

[user9931]

before looking for the issue, i'm just guess and tried to put "0" instead of "53" and its somehow works, but a little unexpected way - its set high random port on every restart, like 34555 or 36788. but complete disable will be better