First, what is DNS?
DNS is the acronym for “Domain Name System”, which translated is Domain Name System. It is a human translator of Internet addresses, whether those of the old 32-Bit IPv4 protocol, or the more modern 128-Bit IPv6.
The domains have a very well defined structure. There is the TLD domain, the top level domain, which for example in “Geeknetic.es” is “.es”. This way, when we want to resolve a complete address, our DNS client knows where to go first and then ask for the rest of the data. In this case, the first thing your computer or mobile does is go to the main name resolution nodes, in Spain there is a very important one in Barcelona, and it asks the top domain “.es” where to find “Geeknetic.es”.
This is where SLD or second level domains come in. When the “server” that controls the “.es” finds out data about “Geeknetic.es” it forwards us to the appropriate servers to find out the complete final address, which would be the “www” subdomain when we try to access the website. These servers are always at least two, one main and one backup, but they can be more.
In summary: At the address www.geeknetic.es: “www” is a subdomain, “geeknetic” is the SLD and “.es” is the TLD.
In the end the result is that we obtain an IP address and our browser can initiate access to the server and negotiate the service. All this is not done every time, because it consumes a lot of resources, your DNS client and your DNS server, both, save cache data for some time so that the queries are reduced to the minimum possible, the closer the cache in this process , lower access latency.
If we manage our own DNS server we can control these caches and we can even restrict access: for security, parental control or whatever we think. We would have the local cache of the device or devices, but also the server cache much closer, all latencies are reduced.
Protected DNS management, and knowing how it works, It can also help us avoid many “Phishing” attacks by email and even “Spear Phishing” attacks. where the attack is much more personalized since personal information about us has previously been sought. Knowing how name resolution works is our main means of protection because attacks will always use unknown, unreliable domains or that try to simulate other recognized names by changing, for example, “O”s for “0” (zeroes).
Using Docker to install our own DNS Server on Windows
Although we are going to focus on Windows, you can use this same guide to install a DNS server on MacOS or Linux with the same method since Docker is a virtualization platform that runs on any recent operating system and the container that we will use will run on a layer of virtualization that is foreign to the machine that acts as the guest.
- The first step would be to install Docker, for that we have prepared this other complete guide that you can consult at this link, it is very simple and also introduces us to other technologies such as the Linux WSL2 subsystem or the Microsoft Hyper-V Hypervisor Windows 10 and Windows 11 .
- Once Docker is installed we have to look for the container that best suits our needs. We can search for it through the Docker Desktop, but here we will explore the command version, which introduces us to a more real use environment, where we will learn very basic notions that we can transfer to any system where Docker is installed.
- We verified that Docker was installed correctly by executing the command: Docker -v, in cmd or Windows Powershell, we have used the latter, as you can see in the screenshots.
- The container that we have chosen is Pihole, the official project, which allows us content control and web management of the DNS server. We will install it with this command: docker pull pihole/pihole, which brings the container to our local computer. If we search for Docker Desktop we will have something like you see in the screenshot. Basically it is to put it in the search engine, download and run, although I prefer to do it by command, as we would do on a Linux or Windows Server with only a command line interface.
- Now let's run the container with our proper configuration: docker run -d –name pihole -e TZ=”Europe/Madrid” -e ServerIP=”localhost” -p 53:53/tcp -p 53:53/udp -p 8082:80 pihole/piholewe mark the TZ in our appropriate location, for all of peninsular Spain Madrid would be appropriate, but we can use these others: Europe/Madrid (Central European Time), Europe/Andorra – for Andorra, Africa/Ceuta for Ceuta and Melilla and Atlantic/Canary for the Canary archipelago.
The rest are access ports to the service itself and the manager. Port 53 is the standard for DNS queries, we must use this or we will have to make a personalized configuration per machine and device and we are precisely looking for the opposite, simple management of both the server and the devices that consume it.
The mappings between ports, which we see in the run command, translate between the port of the host machine and the port of the container, that is why we use 8082:80 for the web interface, this will mean that we attack port 8082 from outside, but translates via NAT to port 80 of the container.
- Now we just have to enter the Pihole manager, with this address, which is the one we have configured when running the container: http://localhost:8082/admin/login.php.
It is an unprotected “url”, configuring https would give us additional guidance since we must establish the entire security scope of the container, we are not going to complicate things much more today, but for me it would be the next point, to maximize the security of our systems.
- To find out the Password that has been assigned during the installation, for the web manager, we can use this command: docker logs Pihole. In the “Assigning random password:” section we will find the Password that has been randomly assigned during the installation.
- If we want to do the same from Docker Desktop we can go to the container, click on the “three dots” menu and go to details. There we have access to the execution log and we can see the same information as by command.
- If we want information about which containers we have running in the system, we can access the Windows manager or also execute the command: “Docker ps” (without the quotes) in cmd or Powershell, there we will have information about all the running containers and we can also obtain detailed data.
The best way to use our new DNS server is on the router
- To configure all the devices on the network with the new server, it is best that we configure it as the DNS server at the DHCP level of our router. Thus, any device to which we assign dynamic IPs will use the new DNS server that we just created.
DHCP is a manager of the local IP pool that allows us to automatically configure local addresses and configurations such as DNS or gateway so that any device that we connect to the network, for example via Wi-Fi, has automatic configuration and completes all Internet access routes without the user having to do anything at all.
Each router has a different manager but basically it is to assign the fixed IP of the local server in the assignment of DNS servers, we will do it in the main one leaving the secondary one with some other external server, so as not to leave anyone without service in case we are the local server goes down.
- We apply and that's it, all computers and devices, such as mobile phones, will automatically pick up the new local DNS server. The result is that we will begin to receive information in the Pihole server manager. The information is very detailed, but also easy to access, we will be able to see all the network usage of our clients, from what services are used, the services blocked and enabled and the network traffic. The best thing is that we can quickly block or enable services with the push of a button.
- Pihole manages the cache, blocks advertising and allows advanced DNS management. It is perfect because the management is also completely through a web interface and also allows the configuration of domains and hosts that we want to be managed locally.
Additionally, this server has other advanced functionalities such as its own DHCP server to assign local network IPs, it also allows us to configure our header DNS servers and has an automatic block list that can be managed and updated with a single button. It is perfect for having completely effective parental control at home.
If we want a manual configuration of the devices we will have to add the IP of the DNS server to our Windows network interface, or do advanced and static configuration on mobile devices such as iOS or Android, that undoubtedly gives us another interesting guide although for me It makes no sense for us to go into manual configurations when we can automate everything at the router level.
End of Article. Tell us something in the Comments!
