diff --git a/DnsServerCore/www/index.html b/DnsServerCore/www/index.html index 596c5c0d..e7ad3453 100644 --- a/DnsServerCore/www/index.html +++ b/DnsServerCore/www/index.html @@ -223,27 +223,32 @@
Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:
openssl pkcs12 -export -out "example.com.pfx" -inkey "privkey.pem" -in "cert.pem" -certfile "chain.pem"
Note! These optional DNS server protocol changes will be automatically applied and so you do not need to manually restart the main service. The DNS-over-TLS, DNS-over-QUIC, and DNS-over-HTTPS protocols will be enabled only when a TLS certificate is configured.
These optional DNS server protocols are used to host these as a service. You do not need to enable these optional protocols to use them with Forwarders or Conditional Forwarder Zones.
-For DNS-over-HTTP, use http://localhost:8053/dns-query with a TLS terminating reverse proxy like nginx. For DNS-over-TLS, use tls-certificate-domain:853, for DNS-over-QUIC, use tls-certificate-domain:853, and for DNS-over-HTTPS use https://tls-certificate-domain/dns-query to configure supported DNS clients.
For DNS-over-HTTP, use http://localhost:8053/dns-query with a TLS terminating reverse proxy like nginx. For DNS-over-TLS, use tls-certificate-domain:853, for DNS-over-QUIC, use tls-certificate-domain:853, and for DNS-over-HTTPS use https://tls-certificate-domain/dns-query to configure supported DNS clients.
When using a reverse proxy with the DNS-over-HTTP service, you need to add X-Real-IP header to the proxy request with the IP address of the client to allow the DNS server to know the real IP address of the client originating the request. For example, if you are using nginx as the reverse proxy, you can add proxy_set_header X-Real-IP $remote_addr; to make it work.
DNS-over-QUIC protocol support is not available on all platforms. On Windows, it is available only on Windows 11 (build 22000 or later) and Windows Server 2022. On Linux, it requires libmsquic and openssl v1.1.1 to be installed.
Use the following openssl command to convert your TLS certificate that is in PEM format to PKCS #12 certificate (.pfx) format:
@@ -1268,6 +1275,7 @@Enter block list URL one below another in the above text field or use the Quick Add list to add known block list URLs.
-Add ! character at the start of an URL to make it an allow list URL. Domain names in such an allow list URL are prevented from being added to the block list zone.
Add ! character at the start of an URL to make it an allow list URL. This option must not be used with allow lists that use Adblock plus format.