yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] MrT69:
Expert question

A view weeks ago I have had the request about "Secure DNS Requests". At the very early days of keweon I was thinking about this and decided not to use it because of High Load of RAM and CPU.

In the meantime more and more users asking about Secure DNS requests but the current Technologie is not very helpful.

DNS over TLS is nice. It's working. But it's nonsens.

If you blow 25 to 50 MB per Day for just having a secure DNS communication on your Mobile device than this becomes at the end to expensive. An average size of 8kb per DNS request will also cause that DNS providers will have so high bandwidth only because of stupid DNS requests.

In summary and from my point of view DNS encryption is damn expensive, it's slow and it makes no sense at all. It's definitely a myth that this will prevent logging, you need in most cases a complicate client and the sense of a secure communication is not given.

But the idea to have an encrypted DNS communication is real damn cute.

I have had 3 sleepless days because of this idea I was searching a usefull solution within the Internet. May be I have misunderstood some examples about Secure DNS communication but I wasn't able to find something useable. So I decided to start to develope my something own thing and - it's working.

At the moment this solution is on the early earliest Alpha stage. It's currently working only on one of my test server. Not usable for public usage because it's only an Idea and to many users will cause that the DNS Server is not longer working. The router is a modified DD-WRT Firmware with OptWare. The DNS Server is my DNS Server with extended code. From this point of view everything is basic. No special needs.

The advantage:

The entire communication is encrypted. Although it is encrypted the Package size is far below 250 byte.

The clients behind the router don't need an extra software or an extra client for decryption.

It's woking on any OS - behind the router.

The disadvantage:

Currently I have no clue how I can make this available for other devices than DD-WRT. Of cause, Linux is Linux and Android is also some kind of Linux.

The communication behind the router runs decrypted. From my point of view it is an advantage. If someone wants to have it still encrypted after the router than I guess this guy have seriously problems. If someone don't trust his own Network than no encryption within the world will not help to solve this kind of problems.

Now my question:

Is such a solution already existing? Has someone more experience with DNS & SSL?

Is this something which might be an interesting solution?
[Android Software/Hacking General [Developers Only]] Ch4t4r:
To be fair, this highly depends on the server implementation. The best case would be to keep connections open for as long as possible - this would cut down the cost per packet to ~80B as no new connections has to be established with each packet. But currently this isn't implemented this way because then a server would only be able to take ~65000 requests at any given time (because there are only 65535 ports).

Well, encryption is always great but sure is not the only option. DNSSEC for example does it with signatures (which is asymmetric encryption the other way around, I know.)

Caching the answers at a common point is the first thing I came up with as well - I did the same in my app. Technically it does work but does require a router with root access.

I'm guessing public key pinning. This would have been my only addition to this as well ;)

Fritz.box here in Germany offers a rudimentary root access over telnet. Not sure about others though. Another option would be to use a linux-based board like the raspberry pi and hook it between the router and your network. However I doubt anyone would do that, the prior idea would be obstacle enough.

Well, here's my exit point. I've never heard of anything like that. I'm sure most routers don't even support DNS over TLS as an inbuilt feature otherwise one could use their router as DNS server, set the TLS server as upstream and hope the router caches the responses. This wouldn't be the solution for a mobile connection though. Not to mention your solution sound viable but requires heavy customization.
[Android Software/Hacking General [Developers Only]] MrT69:
That's not a problem. There are more than 65k connection possible. And I mean a lot of more ;)

DNSSEC is already working with my keweon solution. But I have not the resources to implement this. I have lowest RAM, CPU and traffic for the current system and with a better infrastructure this would become the very first thing which I want to implement.

That was the second thing after I have seen that it's working. How is it possible to run it on mobile devices. Of cause, rooted devices are not a problem. I would need an additional interface and some kind of client for the translation. For non rooted devices it's not possible.

I need to do additional tests and of cause I need to make sure that this is working for a bigger environment. At the moment I expect round about 1 year developement until I have a final and working code & solution.

I don't have a 20 head DevTeam and on top I have a job, family and a girly daughter ;)

Let's see what will happens. Important is that this kind of solution is actually not existing. :p
[Android Software/Hacking General [Developers Only]] edgarf28:
I have problems with Snapchat on my phone since 3 days, getting connection errors when using the Kaweon DNS.
[Android Software/Hacking General [Developers Only]] MrT69:
Thabks for this info. I will check it and putt it on the white list this evening.

If you ever see an error report it immediately.

?
[Android Software/Hacking General [Developers Only]] MrT69:
As far as I can see it's working on my test server. I have created the "keweon" account and it seems it's working on my test server.

Upload is scheduled and let me know if it's working again. Update is at 7 PM GMT +1 (GERMAN TIME) active.

Thanks a lot!
[Android Software/Hacking General [Developers Only]] MrT69:
Note

FOR ACTUAL REASONS - DNSMASQ within the right way

I have seen that a view people has wrong configured the DD-WRT Router. I also have seen within the Internet almost EVERY (!) manual is wrong about the change of external DNS Server on DD-WRT.

WHY?

Almost every manual will show you that you need to change the DNS Server within the DNS Scope Options. TOTALY WRONG!

When you are using this settings than you assign the client the public DNS Server IP Address. The entire caching which will be done from your SOHO Router is lost with this Scope settings. And the Router DNS caching will cause more performance and speed within the Internet. DNS change on DHCP Scope settings is not the best idea.

Set up your router within this way:

Now change to your favorite DNS Server on DD-WRT within this way if you don't want to use your ISP default DNS. This settings are also valid if you choose Google or Cloudlflare DNS Server. Even with the latest Version of DD-WRT you can't use DNSv6 settings within DNSMASQ. Don't ask me why.

If you are using DNSv6 on DD-WRT it would be helpfull if someone of you can provide the right settings based on all this info. To set the right settings for IPv4 please change to this settings:

Copy and paste this settings into the field "Additional DNSMasq Options" and reboot your DD-WRT Router. The settings below using CloudflareDNS. Any recommendations or additional settings are welcome.

DON'T FORGETT TO CHANGE TO YOUR DNS SERVER OF YOUR CHOICE!

Hope you enjoy this!
[Android Software/Hacking General [Developers Only]] MrT69:
EDIT:

Fixed the values above because this was copy & paste from my test System.

The former values are not helpfull for other DNSMASQ installations.
[Android Software/Hacking General [Developers Only]] dalepothen:
Mate ping me at drkangel in telegram lost your contact
[Android Software/Hacking General [Developers Only]] MrT69:
keweonDNS - Server Update

After I received a tiny donation I'm now able to order 2 physical Servers. Each of them will cost 130,- EUR per Month.

Both servers are located in Germany and have a 2 GBit Interent connect. The order process should be done tomorrow and I guess during the next week you are able to access them.

I want to have a test how fast it is and I hope I can keep the servers Online when they are done. Let's see and wait.

Stay tuned!!

Edit:

The Servers are Online and they are damn powerfull. 2 x 1265 Xeon on each server should be good enough. At the moment I feel as like as a kid at Christmas. I hope that HETZNER DATACENTER is world wide useable.
[Android Software/Hacking General [Developers Only]] lodk:
I don’t want to sound like an idiot but, i have read every post in this thread. I for the life of me cant figure things out.

I have a few problems.

One i cant find the website www.keweon.com and the links keep leading me back to the beginnings of this thread when i click it. I have however installed the ca cert.

The second is maybe not a problem but more of a "I dont know what i am doing" situation. I have a dns changer for my droid (override dns (for root)). I put in the dns of choice from the server list and apply. I see all went well and ads are blocked but, when i do a dns leak test it still shows my tmobile dns, And my isp is still the same (maybe its not suppose to even change). Some in site on this would be great.

Sorry for the noobie questions and thank you in advance for the hard work you have committed to this project.
[Android Software/Hacking General [Developers Only]] MrT69:
Hi!

First at all - there are never "idiots questions" ;) Every problem on your side will help to make a better instruciton when everythings is live.

CERTIFICATE

I guess you know what happens when you are using hosts files and visit HTTPS sites. You will get stupid error messages. To surpess all this nag messages you will need the certificate for this.

To get this certificate just visit this URL:

http://pki.keweon.center

and the download will aprears after 3 seconds. JUST THE DOWNLOAD! The installation needs to be done from the user.

On Android devices for some reasons you need to set a Device PIN bevore you are able to install the certificate. Don't know who have had this idea at Google but this guy should be fired asap.

On Apple do it with Safari. Double click the download and a few steps later it's done.

Here is a good instruction Website from GFI >> CLICK HERE << to do it in different operation systems.

THE WEBSITE

The website is still not ready. I will wait until the 25th of May - the official Date for the activation of the GDPR (EU General Data Protection Regulation). I'm pretty sure that this will become a big surprise for all of you.

That's the reason why everything is currently pointed to this thread.

STILL ADS

Thanks to Google and Apple that they have removed for some unknown reasons the options to change the default DNS Servers on the devices. It might be that this have something to do that Android is from Google and also that Google has paid round about 1 billion US-Dollar to Apple that they are still the default "search engine". But I also could be wrong.

I don't know which DNS changer u are using but I'm pretty sure that you need also to change your DNSv6 settings.

With this App:

https://play.google.com/store/apps/details?id=com.frostnerd.dnschanger

you easily can enable the v6 option. Change also the v6 DNS Servers and everything is fine.

ADDITIONAL THINGS

If you ever have any problems - than feel so free and ask. There are never stupid questions.

Hope you enjoy it and if something is not working as it should than ask. ;)
[Android Software/Hacking General [Developers Only]] problemathic:
edit: thank you bro.
[Android Software/Hacking General [Developers Only]] MrT69:
This is only for the reason if you want to use only this server. Using the same address as second IP Adress causes troubles e.g when you are using this within Windows.

Than this would make sense.

The second DNS is almost not working within most operation systems. The second one only acts if the entire Primary server is switched off. Even this will cause that you have set 2 different servers and your Internet is offline.

Change your primary DNS server to 10.0.0.1 (not working privat IP Adress) and the second DNS to 1.1.1.1 (Cloudflare) and test it. You will see you will stay offline on so many OS Systems.
[Android Software/Hacking General [Developers Only]] problemathic:
why still no connection bro? or is it only me? any servers i take.

edit: for months this happens the other day and today with the keweon module bro. used the app but yes its working. taking the primary dns using dns changer.
[Android Software/Hacking General [Developers Only]] MrT69:
I'm connected to the new server. It's working.

Which server you are using?
[Android Software/Hacking General [Developers Only]] problemathic:
tried amsterdam or london bro. just only my two favorite servers. and yes got no connection on them. tried also japan but same result. now im using Primary Dns with Dns Changer app mentioned in the OP. Its just that servers from the modules :(
[Android Software/Hacking General [Developers Only]] MrT69:
Oh. It seems the module is broken.

The firewall can't be the reason because than the DNS CHANGER APP would be also blocked.

No clue about Magisk.
[Android Software/Hacking General [Developers Only]] problemathic:
i think not bro. no update in magisk now. its just a script. been using it for months now. just tonight its stop i mean no internet connection.
[Android Software/Hacking General [Developers Only]] MrT69:
I don't know if you are alone with this. Would be helpful if you asking other users.
[Android Software/Hacking General [Developers Only]] problemathic:
sent blacklist.txt to you bro. check it out. is ad.fly blocked by default on Primary Dns? some sites link this one on ther uploaded file:(
[Android Software/Hacking General [Developers Only]] MrT69:
It's not me. Even GoogleDNS don't know this address anymore.

Uhhh...?!?!
[Android Software/Hacking General [Developers Only]] problemathic:
need to change to default dns for me to pass ad.fly :D anyways i kind bare with it.
[Android Software/Hacking General [Developers Only]] dalepothen:
Mate be active on telegram too
[Android Software/Hacking General [Developers Only]] levone1:
Using these values and started getting ads on XDA today.
[Android Software/Hacking General [Developers Only]] MrT69:
Will do a complete Server review during the weekend. Than a lot of troubles will be fixed.

Thanks a lot!!!

EDIT:

Saw the screenshots after this posting. That's Google crap. Damn!!!

You can be sure that this problem will be solved!!!
[Android Software/Hacking General [Developers Only]] MrT69:
Server Upgrade:

Will start right now to reboot and upgrade every Server.

Right now starting with Germany, France, Singapore & Sidney which are currently not public.

One by one will be offline for round about 15 to 20 Minutes.

I will not do all at the same time. If you have 2 different DNS entries than everything should be fine.

More facts will come when it's done.
[Android Software/Hacking General [Developers Only]] MrT69:
Tiny Update Status:

1. All Server in the DNS Server thread are now updated

2. Public Release of the France, Germany, Singapore and Silicon Valley DNS Server

3. Removed tripple IP check in the Firewall (double is enough)

4. Rebuild the kernels complete new for more troughput

5. Speed up the memory

6. Encreased the memory

7. Other nice tweaks to speed up the server

8. The SSL TERMINATION now run's complete stable (again). Sometimes it's better you do it from scratch.

9. I also adjusted the DNS TTL for performance. Please don't blame on me that this is not a typical value. I know this but I guess it's better at the moment that you have an average speed of the Internet. I hope you are with me.

I will add a daily reboot at 04:00 AM (local Time) on Monday but I want to see if the servers will act now faster.

As usual - all Servers are listed here:

https://xdaforums.com/showpost.php?p=73985083&postcount=6

For better performance I recommend to use the DNS Servers on a Router or something like that. This will cache your DNS request and this will also increase the performance. Any ideas are welcome.

Hope you enjoy this and have a lot of fun with this!!! Hava a nice weekend and enjoy the Internet with keweon!!!!!
[Android Software/Hacking General [Developers Only]] levone1:
Much better today...
[Android Software/Hacking General [Developers Only]] erayrafet:
Hey!

Google+ on my Android phone says no internet access with France and Germany servers.
[Android Software/Hacking General [Developers Only]] MrT69:
Ups... Will double check this. Thanks.
[Android Software/Hacking General [Developers Only]] Lefteris Fragiadakis (Frago):
What about Greece?
[Android Software/Hacking General [Developers Only]] MrT69:
I would - but on the one hand it is not for free for me and on the other hand the problem is to find a provider where I can host the DNS Servers. The problem is not keweon or what I do. The problem is to make DNS Servers safe for typical attacks. And if you ask a VPS provider for public DNS Server hosting you will be surprised which answer you will get.

That's also the reason why I was asking for different AZURE Server which are not in use. A lot of people has i.e. Microsoft Action Pack where is 1 Server is for free. Azure is safe and the speed is better than the current system.

If I would have 65 (!) peoples who will offer me this servers than the DNS Servers would have enogh power and I'm able to offer keweon for the entire world.

I'm was also dealing with Level3 and only for protect the Servers - no hardware, no Rack - nothing than just to protect the DNS Servers they will charge 4000 Euro per Month. Just to keep idiots away to run attacks against my DNS Servers.

Last week I have had received an offer from a Data Center because they have also seen the keweon Project on XDA.

46 Servers global shared, 2 x 10GBit connection - Full DDoS Protection, damn fast physical hardware with Xeon and 256RAM for 19.000 per Month. Not a typo - it's a 19 with 3 zero. Already tested it and up to 20 times faster than GoogleDNS. Uhhhh... that would be soooooo cute. You can believe to me, if I would have the money I would them order immediately within seconds and than even Greece would have enough DNS power. But this is just a wet dream...

At the moment I can only recommend to test every server one by one which one would be the fastest.

I can make you a different offer:

If you have found a hoster where you are able to host a DNS Server for your own usage and you are able to make this server available for public access I will grant you connection to the master system of keweon.
[Android Software/Hacking General [Developers Only]] MrT69:
On non server it was working. ;)

It's fixed, update in progress but it will take up to 3 hours until it's working.

Sorry & thanks for the Info!!
[Android Software/Hacking General [Developers Only]] erayrafet:
It's working now. Thanks a lot!
[Android Software/Hacking General [Developers Only]] MrT69:
You're welcome ;)
[Android Software/Hacking General [Developers Only]] Lefteris Fragiadakis (Frago):
Ok i will see what I can do,,, thanks
[Android Software/Hacking General [Developers Only]] MrT69:
Hi folks!

Are there realy no complains about false blocked sites? Until today I received only 12 complains about wrong blocked sites.

Can't belive this that my blacklists are realy so clean.

Keep in mind! This system is for you AND for the rest of the world. If you have seen a wrong blocked site than let me know this. If this site is on my whitelist database than this site stay's open.

It's quite easy. Copy the false blocked address or URL's into a TXT file and mail it to:

blacklist@keweon.center

and at the next day everything works fine.
[Android Software/Hacking General [Developers Only]] levone1:
Question about that - I've had issues loading certain pages, or downloading from certain links, but I think I've chalked it up to limitations of each browser, (each one is better in some things and worse in others). I usually keep Chrome or Firefox installed to run to, when a different, smaller browser can't handle something. The issues you're referring to - if a site is wrongly blacklisted, would no browser be able to access it, or could it be that a site is wrongly blacklisted, but if you use a certain browser, you can still go to it, because of how the browser works?
[Android Software/Hacking General [Developers Only]] MrT69:
I will not do a censorship of the Internet or something like that.

Just ads, tracker, virus... and so on.

I also will not enable Links and Sites for Countries when they are prohibited by Goverment and Law. (i.e. China) It's possible but on the other Hand it will take a week until my system will be blocked by the Great Firewall and this is not my goal. This will make no sense.

PM me a few Example URL's for this and I will do a check.
[Android Software/Hacking General [Developers Only]] Fdraco10:
Hey! This KeWeOn is just for ad-block or I can get free internet too?
[Android Software/Hacking General [Developers Only]] MrT69:
This is only Security, Adblock and all other annoying & poison crap within the Internet.

Free Internet with this keweon solution will never happens because it's not possible..

I have had developed a few things but it makes no sense to release it because the Government or Censors can easily see this and block the System within seconds.

I have no clue what will happens with keweon but I want to offer a secure and ad-free option to the entire Planet. But doing things like bypass Government restrictions will not work on a long term and on the other Hand they would Block the System.

If this System will ever grow my next step is to offer a Porn & Violence Free Internet just by changing the DNS. At home it is already running but from the current situation this solution is light years away from Release status.

As long as the Governments has control about the Systems and direct access to core Systems every try to offer a free Internet is only a short term Solution.

Sorry for the bad news but this is unfortunately reality.

If you are able to order a US based VPS anywhere I can hand you over a configuration where you are able to get a unlocked Internet. Therefore you need a local Linux and a quick EU or US Server outside with unlimited Traffic.

If you are allowed by law to have a VPN connection to the Server you can even hide this connection from the censors.

Really easy. PM me if you are interested about this.
[Android Software/Hacking General [Developers Only]] MrT69:
Usage Information & Server Status:

The current average CPU usage is between 1.5 and 2% on each of the Server.

The current Daily Data usage is round about 6 MB on each of the Server.

The last month Certificate Download is at 76.449 hits.

Thanks a lot to all keweon users!!!
[Android Software/Hacking General [Developers Only]] MrT69:
I have done a deeper look on this. Can you let me know your DNS Server which is still able to resolve ad.fly Domain?

I'm not able to resolve it and I was asking a lot of DNS Servers for this.

If they have switched off than I will add this domain to the Blacklist which will cause a faster termination than the stupid NXDOMAIN record. If they are only offline than I won't touch this domain.

If you try to register it than you will get an error message: invalid domain length - two letters domains are not longer possible at .fly TLD.

From my point of view it seems they are down. Forever! *YEAHHH!!*
[Android Software/Hacking General [Developers Only]] problemathic:
here bro. our default carrier dns in philippines.
[Android Software/Hacking General [Developers Only]] Ch4t4r:
You all do realize that .fly is not a valid TLD and that the before mentioned service is hosted at adf.(ly)?Just throwing my towel in here, maybe I've missed something as well.
[Android Software/Hacking General [Developers Only]] MrT69:
Oh damn...

It's embarrassing :p

But adf[.ly] is open on my servers.?