Using DNS over TLS on openSUSE Linux in 4 easy steps, enable cloud firewall for free today!
Tags: tutorial, productivity, security, networking
Published: 2023-10-29 05:22:20

Even though we can have DNS over TLS (DoT) enabled easily **[since Android 9](https://android-developers.googleblog.com/2018/04/dns-over-tls-support-in-android-p.html)** with **Private DNS** option (all we need is a TLS address of the DNS resolver service we want to use), it's not as easy on Linux. There's already **[a request](https://gitlab.gnome.org/GNOME/gnome-control-center/-/issues/750)** to have this feature in the settings menu (GNOME). Until then, we'll have to do a little bit of CLI in a terminal. Therefore, I think it's worth writing here.

> What is DNS over TLS? Why is it so important? How would this help your system to be more secure (for free)? Basically, DNS protection means you block bad web addresses, hence significantly reducing the chance of malicious software/scams/etc. from entering your system, rather than let it get in first then (hopefully) fix it later. I recommend reading **[this link](https://www.cloudflare.com/learning/dns/dns-over-tls/)** for more info.

The main purpose of this post today is how to turn this feature on easily in just 4 steps. Without further ado, let's enable DNS over TLS (DoT) on openSUSE Tumbleweed in the easiest and straight forward way.

---

## 1. Install `systemd-network` package.

We need to install `systemd-network` package, which is not installed by default on openSUSE Tumbleweed. Because this package provides `systemd-resolved` that we'll use as our new resolver service.

```
sudo zypper install systemd-network
```

---

## 2. Edit `/etc/systemd/resolved.conf` file.

First, you have to decide whether you want to globally enable DNS over TLS on all connections from now on, or just per connection basis (useful if you want to use different DNS resolver services for your connections).
&nbsp;
### 2.1. Setting up DNS over TLS globally for all connections.

This is easy and I would recommend anyone to go with this route. So, we can set it and forget it. We will edit `/etc/systemd/resolved.conf` file by:

```
sudo nano /etc/systemd/resolved.conf
```

Inside the file, all lines are commented with `#` (have no effect) by default. We will change `DNS=` and `DNSOverTLS=no` by removing `#` in front of them first (uncommenting the lines).

```
[Resolve]
DNS=
DNSOverTLS=no
```

For `DNS=`, we will have to decide which DNS resolver service we want to use as our DNS resolver. I recommend **[Quad9](https://quad9.net/)**, as it also comes with anti-malware and other security features by default. The test result from [**Lawrence Systems**](https://www.youtube.com/@LAWRENCESYSTEMS) when comparing Cloudflare and NextDNS is pretty impressive. So, this will be our cloud firewall. Also, Quad9 does not collect identifiable data from the users, see from their **[privacy policy here](https://quad9.net/privacy/policy/)**.

`DNSOverTLS` is a switch. We can turn DNS over TLS on by `yes`, and off by `no`. Moreover, if we set this switch to `yes`, it's also a kill switch, i.e. If our DNS resolver is down or doesn't support encryption (your ISP's DNS resolver), we won't be able to connect to the internet at all. However, if by any chance, you want to connect to the internet even without DNS encryption/fallback to your current insecure connection, you can set this switch to `opportunistic` - **NOT RECOMMEND**.

Therefore, here's our setting in `/etc/systemd/resolved.conf`:

```
[Resolve]
DNS=9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
DNSOverTLS=yes
```
> For more options on Quad9 address, see **[here](https://quad9.net/service/service-addresses-and-features)**.

&nbsp;
### 2.2. Setting up DNS over TLS as per connection.

Open your connection settings in GNOME Settings. Then in **IPv4** tab, turn the Automatic DNS switch off, then fill in the IPv4 address of your preferred DNS resolver service - I recommend **[Quad9](https://quad9.net/)**, as shown in the screenshot below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c65krkh1pe77lzoxa165.png)

Also fill in the IPv6 address accordingly, as shown in the screenshot below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e6epow7ubz8gcqdliz6j.png)

Don't forget to hit **Apply** button to save the settings!

Then, open `/etc/systemd/resolved.conf` file by `sudo nano /etc/systemd/resolved.conf`. Then, in the file:

```
[Resolve]
DNSOverTLS=yes
```

> `DNSOverTLS` can be `yes` if you want a kill switch (you won't be able to connect to the internet by default, unless you set up DNS resolver address that supports DNS encryption), or `opportunistic` to connect to everything first, then set it later.

> For more options on Quad9 address, see **[here](https://quad9.net/service/service-addresses-and-features)**.

---

## 3. Make a necessary symlink.

In order to make use of `systemd-resolved` that we configured in the previous step, we'll have to make `/etc/resolv.conf` a symlink to `/run/systemd/resolve/stub-resolv.conf`. We can make this symlink by:

```
sudo ln -sf ../run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
```
- `ln` command is used to create links between files.
- `-sf` It's the combination of option `-s` for `--symbolic` and option `-f` for `--force`. We use this option to force make a symlink.

---

## 4. Enable `systemd-resolved`

```
sudo systemctl enable systemd-resolved.service
```

---

## 5. Restart the network to enable `systemd-resolved`, and finally enable DNS over TLS.

This is the last step! Before we can see our changes, we will need to restart both `systemd-resolved` and `NetworkManager` services by:

```
sudo systemctl restart systemd-resolved.service && sudo service NetworkManager restart
```

---

![Robot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4fd8pllje8mlzogn0l8z.jpg)

After all the steps above, now we should have our DNS over TLS enabled. We can check this by running in the terminal (see **[here](https://docs.quad9.net/Setup_Guides/Linux_and_BSD/Ubuntu_22.04_%28Encrypted%29/#:~:text=network-manager%20restart-,verify%20configuration,-Confirm%20that%20DNS)**):

```
dig +short txt proto.on.quad9.net.
```
If the response is `dot.`, then it is working! And we can check whether we've configured Quad9 properly on **[Quad9 test page here](https://on.quad9.net/)**.

Another page I would recommend for checking your DNS security is [**dnscheck.tools**](https://dnscheck.tools/).

> **Note:** DNSSEC feature in `systemd-resolved` is an experimental feature, but it hasn't been ducumented as such for some reasons, see **[systemd's PR #28386](https://github.com/systemd/systemd/pull/28386)**. Basically, no one should use this feature in their production and expect the feature to work correctly. That's why I don't enable DNSSEC in this walkthrough. Also, DNSSEC is implemented and enabled on Quad9's resolver by default. So, there's no need to enable it in your system.

I think this is it for today. I hope this helps, bye 💨

---

**Cover** Photo by **[Patrick Turner](https://unsplash.com/@redgreenblue?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash)** on **[Unsplash](https://unsplash.com/photos/yellow-and-white-electric-wires-YEoF12PgTtQ?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash)**

**Robot** Photo by **[Arseny Togulev](https://unsplash.com/@tetrakiss?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash)** on **[Unsplash](https://unsplash.com/photos/white-robot-MECKPoKJYjM?utm_content=creditCopyText&utm_medium=referral&utm_source=unsplash)**