[Android Software/Hacking General [Developers Only]] MrT69:
Using keweon DoH on Windows - the easy way

One of my personal goals is to provide keweonDNS without any client and this is for security reasons. On the one hand no one can provdide a fake installation which contains malware and on the other its because of the Certificate. No Client means no communication.

Windows becomes now some kind of tricky because there exists no real client except the one for "Cloudflare". Big surprise - you can use this client and its working. Its not a problem to build such a client for Windows but I seriously have no spare time to support this. I'll show you now how to do it with the Cloudflare DoH Client.

So... Let's rock!

What do you need?

You would need a few things to get this running. Any Windows Box is 100% fine but not sure if this will still work with XP. If you still use this OS you have other problems then encrypted DNS communication.

1. XCA for Certificates > click here

2. Something to unzip the attached files below

3. Make sure you know you can edit the Windows hosts file (C:\Windows\System32\drivers\etc\hosts)

4. The "Cloudflare DoH 64Bit Client" > click here

5. The "Cloudflare DoH 32Bit Client" > click here

6. You need 5 to 10 Minutes time & a cup of coffee

How to install?

Quite easy. First at all download all the things.

Open a command prompt with Administator privileges and you need to open the Explorer to copy a few files. Now do exactly copy & paste the commands below and you are fine to go.

1. Create the installation directory within the command prompt:

mkdir C:\Windows\System32\config\systemprofile\.cloudflared

2. Copy the "cloudflared.exe" into this directory

3. Copy the "cert.pem" file to the directory

4. Copy the "config.yml" file into the directory

5. This should be now your directory:

6. Go back to the command line and change to the directory with this command prompt:

cd C:\Windows\System32\config\systemprofile\.cloudflared

7. Now again within the command line box install the Cloudflare.exe as Service

cloudflared.exe service install

8. Because of the fact that LetsEncrypt do not support IP Adresses you need now add the keweonDoH DNS Server to your HOSTS file. Just do it by copy & paste.

2a01:4f8:c2c:e25::207 doh.asecdns.com
2a01:4f9:c010:1cbd::29 doh.asecdns.com
2a01:4f8:1c17:6fc7::250 doh.asecdns.com
159.69.49.250 doh.asecdns.com
116.203.126.207 doh.asecdns.com
95.216.165.29 doh.asecdns.com

9. Save the HOSTS file and reboot your Computer. I have written reboot and this means reboot. Don't complain it's not working when you don't do it.

At this point when the reboot is done you can test now that the DoH DNS Service is working. Open a Command prompt again. Type now "nslookup" and press return.

Now type "server 127.0.0.1" and hit return again.

Now type a Url or a domain and press return. The answer should be an IP address. Tadaaaa - its working.

10. After the reboot everything is fine & now it's time to change the Network Adapter.

11. Open your network card settings and set the IP Address 127.0.0.1 as DNS Server

12. Save it & happy surfing!

Why do you need XCA?

Within the download you will find a XCA Database which contains the LetsEncrypt Root Certificates. If you don't trust my downloads you can do it by yourself. Add the Certificates to XCA and export them by yourself.

Why do you need the Certificate things?

The cloudflare client actually don't use the default Certificate store of windows. To connect to any other DoH Server you will need in addtion the Certificate chain to validate the DoH Server certificate. For this you can easy export the Certificates from the Website of the DoH Server, import them into XCA and Export them as a valid certificate chain which you can now use within the config file.

How can I export certificates from a Website?

Open the website of the DoH Server by the DoH Server address. As example here I use "https://doh.asecdns.com/nebulo"

Here you can see now how to export a Certificate. Seems to be complicate but after the second try it's very easy.

If you want to import in XCA just select the exportet Certificates and drag & drop it to XCA when you have the Database open.

How to do it with XCA?

1. Open the LetsEncrypt Database (the file below has the Password "a" without the quotes) and export Certificate CHAIN (!)

2. Now export it within the right format:

3. Now you can easily change the config file (config.yml) and use any other DoH Server of your choice.

4. Don't forget to add the Address within HOSTS file because without this settings it will not work.

NOTE:

If you have better or faster settings for the config file (config.yml) then let me know this. This are only setting which are working. Let's do it better - together.

Have fun with it!