Question NextDNS setups

[rashmi]

Hello NextDNS users, please help me with two confusions about NextDNS setups. Thanks.
1. Is IP linking required with all NextDNS setups? I used the DoH setup for Windows 11.
2. Does the NextDNS protection work with existing and new Wi-Fi connections?

 

[TairikuOkami]

1. Is IP linking required with all NextDNS setups? I used the DoH setup for Windows 11.

No, it is meant only for IPv4 and classic DNS (UDP via 53).

2. Does the NextDNS protection work with existing and new Wi-Fi connections?

Yes, if you have set automatic DNS. You can check on NextDNS webpage or via https://test.nextdns.io

 

[rashmi]

I used IPv6 addresses for DoH, and it worked without requesting IP linking. So, I cannot use both IPv6 and IPv4?
DNS is set to manual DNS. Because I used the manual setup instead of their app, I guess.
I couldn't find the remaining query info. Does the account show this information? I haven't created an account as I'm testing it.

 

[TairikuOkami]

I couldn't find the remaining query info. Does the account show this information?

NextDNS - Make sure to Enable Cache Boost, otherwise you will run out of queries within days. I have not even reached 100k after 20 days for 2 PCs.

 

[rashmi]

@TairikuOkami, The DoH setup with IPv6 doesn't require linking the IP. Do I have to disable IPv4 on the system?

 

[TairikuOkami]

The DoH setup with IPv6 doesn't require linking the IP. Do I have to disable IPv4 on the system?

Sorry, I have zero experience in this area, I disable IPv6 ASAP. I like privacy and reliability, but I do not think that NextDNS supports DNS64 yet, so you might have an issue connecting to IPv4 only services. But with zero support from NextDNS you can simply test via trial and error, it will either work or not.

Feature request: DNS64 option

Use case: I'm on an IPv6-only network that optionally provides outgoing IPv4 support through use of NAT64. There is no automatic route for that, but internal resolvers use DNS64 to map address…

help.nextdns.io

 

[rashmi]

@TairikuOkami, NextDNS and IPv6 DoH setup have been working well on Windows 11 and iPad 16. Thank you for your suggestions.

 

[rashmi]

The parental control software subscription on kids' systems will expire soon. I'm testing to see if NextDNS is a reliable alternative. I have the following problems.
1. My internet connection has both IPv4 and IPv6.
2. NextDNS DoH supports IPv4 only. I thought I'd add DoH for IPv4 and unencrypted IPv6 for IPv6.
3. Wi-Fi - Hardware Properties - DNS Assignment - I tested NextDNS DoH IPv4, but it didn't block adult sites. I then tried unencrypted IPv6, and it worked as expected.
4. I thought I'd use IPv6 only and disable IPv4, but some sites don't work, including the NextDNS website, if I disable IPv4.
5. All sites work if I use IPv4 and disable IPv6, but NextDNS DoH, which supports IPv4, doesn't work when added to Windows 11 23H2.
6. If I use IPv6 with NextDNS unencrypted IPv6 and keep IPv4 enabled, I could access adult sites sometimes and sometimes not.

 

[Brahman]

2. NextDNS DoH supports IPv4 only. I thought I'd add DoH for IPv4 and unencrypted IPv6 for IPv6.

No. It supports both. On the setup page select "windows" and you can see the IPV6 address for setting up IPV6. Like this "Replace the current addresses (if any) with 2a07:a8c0::74:3b4a and 2a07:a8c1::74:3b4a." In windows you need to

1. Open the Settings app.
2. Go to Network & internet.
3. Click on Wi-Fi (or Ethernet).
4. Click on Hardware properties, or ignore this step if you clicked on Ethernet.
5. Click the Edit button next to DNS server assignment.
6. Select Manual.
7. Enable IPv6 only if you need IPv6 alone functionality.
8. Enter 22a07:a8c0::74:3b4a as Preferred DNS, then select On (manual template) and enter
   https://dns.nextdns.io/743b4a.
9. Enter 2a07:a8c1::74:3b4a as Alternate DNS, then select On (manual template) and enter https://dns.nextdns.io/743b4a.
10. Click Save.

PS: replace underlined text with your own configuration. Even though it works for IPV6 I suggest you to use IPV4 alone, IPV6 doesn't provide any particular benefit when compared with IPV4.

Wi-Fi - Hardware Properties - DNS Assignment - I tested NextDNS DoH IPv4, but it didn't block adult sites. I then tried unencrypted IPv6, and it worked as expected.

It works better with DOH as the old unencrypted port 53 dns does leak as some dns queries are sent through port 5353 too. to disable such leaks you need to enable DOH and login to your nextdns account then go to "parental control" in nextdns page, enable "Block Bypass Methods".
To prevent any kind of DNS leak you need a wifi router that can support DOH or DOT natively ( like Mikrotik, routers that are installed with open/DD wrt). Normal routers do not filter port 5353 DNS queries. But if you donot want to invest money into it, you can enable DOH/DOT function in all your devices and use the parental control functions.

With windows, I have seen some dns leaks even after using builtin windows doh settings. So I suggest you to use Yogadns app. Detailed instructions are available here.

YogaDNS can run as a Windows Service. This mode provides two main features:

• YogaDNS can run in the background when no user is logged on to the machine which will prevent any dns leaks.
• Only the administrator can start/stop the service and change the configuration.

4. I thought I'd use IPv6 only and disable IPv4, but some sites don't work, including the NextDNS website, if I disable IPv4.
5. All sites work if I use IPv4 and disable IPv6, but NextDNS DoH, which supports IPv4, doesn't work when added to Windows 11 23H2.
6. If I use IPv6 with NextDNS unencrypted IPv6 and keep IPv4 enabled, I could access adult sites sometimes and sometimes not.

Use IPV4 alone. Most of the internet still functions on IPV4 alone.

 

[rashmi]

@Brahman, NextDNS DoH IPv6 works well when added to Windows 11, but DoH IPv4 doesn't. I don't want to install software for it to work. I renewed the parental control software subscription. The NextDNS DoH IPv4 didn't work on another Windows 11 system, either.

 

[TairikuOkami]

Once DoH is enabled (though you might need to have DNR enabled for the first time, so DOH can be verified)

reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableAutoDoh" /t REG_DWORD /d "2" /f
reg add "HKLM\Software\Policies\Microsoft\Windows NT\DNSClient" /v "DoHPolicy" /t REG_DWORD /d "3" /f
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters" /v "EnableDnr" /t REG_DWORD /d "0" /f

you can even set it up via registry by creating a template with your custom link and enabling it for your adapter's ID directly:

wmic nicconfig where DHCPEnabled=TRUE call SetDNSServerSearchOrder ("45.90.28.99","45.90.30.99")

reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters\DohWellKnownServers\45.90.28.99" /v "Template" /t REG_SZ /d "https://dns.nextdns.io/xxxxxx/LianLiPC-7NB" /f
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\Parameters\DohWellKnownServers\45.90.30.99" /v "Template" /t REG_SZ /d "https://dns.nextdns.io/xxxxxx/LianLiPC-7NB" /f

reg add "HKLM\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\{2fea24ab-7667-4d1c-87c9-220b61023550}\DohInterfaceSettings\Doh\45.90.28.99" /v "DohFlags" /t REG_QWORD /d "2" /f
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\{2fea24ab-7667-4d1c-87c9-220b61023550}\DohInterfaceSettings\Doh\45.90.28.99" /v "DohTemplate" /t REG_SZ /d "https://dns.nextdns.io/xxxxxx/LianLiPC-7NB" /f
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\{2fea24ab-7667-4d1c-87c9-220b61023550}\DohInterfaceSettings\Doh\45.90.30.99" /v "DohFlags" /t REG_QWORD /d "2" /f
reg add "HKLM\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\{2fea24ab-7667-4d1c-87c9-220b61023550}\DohInterfaceSettings\Doh\45.90.30.99" /v "DohTemplate" /t REG_SZ /d "https://dns.nextdns.io/xxxxxx/LianLiPC-7NB" /f

Windows also likes to use the default DNS (UDP via port 53), you might want to block it in the firewall, so it will not get used.

 

[Brahman]

@Brahman, NextDNS DoH IPv6 works well when added to Windows 11, but DoH IPv4 doesn't. I don't want to install software for it to work. I renewed the parental control software subscription. The NextDNS DoH IPv4 didn't work on another Windows 11 system, either.

What parental control software do you use?

 

[rashmi]

What parental control software do you use?

Those systems have Kaspersky Safe Kids with Microsoft Defender and Firewall. I created a system image with the backup software, removed Kaspersky, restarted the system, and tested NextDNS.

 

[rashmi]

NextDNS or DNS-based services cannot block a website if it is present in the browser's history/data?

 

[Brahman]

NextDNS or DNS-based services cannot block a website if it is present in the browser's history/data?

Not until you have cleared any dns cache in your system and in Nextdns settings.

 

[rashmi]

Not until you have cleared any dns cache in your system and in Nextdns settings.

View attachment 282650

NextDNS defaults have the cache boost option disabled. Do you mean to enable it? Anyway, the blocking works now. I don't know if it was an incompatibility with AdGuard Desktop. I removed it and reinstalled uBlock Origin. After that, NextDNS seems to block the websites already present in the browser's history or data.

 

[Brahman]

NextDNS defaults have the cache boost option disabled. Do you mean to enable it? Anyway, the blocking works now. I don't know if it was an incompatibility with AdGuard Desktop. I removed it and reinstalled uBlock Origin. After that, NextDNS seems to block the websites already present in the browser's history or data.

You can enable cache boot option if you want to reduce number of DNS queries, as the free account can only have 300K ( image 1) queries. It has nothing to do with your system DNS cache nor with your router. Its a cache system employed by Nextdns in their servers for your DNS queries that caches your queries for 3 or 4 minutes. The only issue is that if you get a block by nextdns and you want to unblock that and add that website to allow list, it will only get unblocked only after 3 or 4 minutes, ie after expiring the cache time (TTL) (See Image 2).

 

[rashmi]

@Brahman, Thank you for all your help. I had to clear browser data sometimes to block a website or allow a download, which is annoying. The parental control categories also missed or allowed websites they should block. I'll continue Kaspersky Safe Kids, as it's much more effective, reliable, and instantly syncs allow and block actions.

 

[LennyFox]

@rashmi

Have a look at AdguardDNS, thay have parental control and any user rule or filterlist the changes are applied immediatelly, also is is very easy from the logs to create allow or block rules

 

[rashmi]

@rashmi

Have a look at AdguardDNS, thay have parental control and any user rule or filterlist the changes are applied immediatelly, also is is very easy from the logs to create allow or block rules

I have tested AdGuardDNS, and its parental control is basic, with no category blocking. A parental control without category blocking is simply a normal family DNS server with added allow/block functions.