Any NextDNS users here?

Questions
43

@iluvprivacy Will attempt to answer as best as I can, although bear in mind that I am far from an expert.

  1. No, I don’t think having any custom DNS settings in the Mullvad Android app will be an issue. As far as I know, Android will always override that with its Private DNS setting.
  2. PTR = Pointer Record. Used for reverse DNS lookups. Basically, it’s used to map a domain to an IP address.
  3. Depending to which NextDNS server you’re assigned/anycasted to, you may get both IPv4 and IPv6 DNS servers. As long as the PTR points to a nextdns.io server(s), you’re good.
  4. I have never used AdGuard Home, so can’t offer much insight. My only suggestion is to add nextdns.io to its whitelists, or better still, exempt that Android phone from AdGuard Home filtering via MAC address or device IP, if possible.
  5. I do agree with @anon16234852 on your setup being overcomplicated. You seem to have too many “layers” all attempting to do the same thing. Try to streamlime stuff a bit. You know, K.I.S.S and all that.
  6. Rethink DNS/Firewall would indeed be a great solution since you can use multiple VPN configs each tied to different DNS resolvers and dedicate them to different apps if you desire, but it’s a convoluted application and I’m far from the best person to ask for guidance since I’m still learning it myself. Also, your issues with AdGuard Home are bound to overcomplicate things even further.

Hope this helps.

44

I agree that I will have to simplify things, but keep in mind how I got here with someone saying Android’s Private DNS. It’s not like I just experienced a problem all of a sudden. I just thought I would give what you said a try. Everything was working more or less perfectly.

Are you saying Rethink can use multiple VPNs simultaneously? I thought Android could only use one at a time?

45

image
image1381×433 77.8 KB

46

Correct, in advanced mode on ReThinkDNS you can enable more than one WG proxy to use multiple vpns at once.

An alternative would be to enable Android private space or a work profile. Each of those also gets you an additional VPN slot.

My current setup/use case on Android (Pixel with vanilla Android)

Primary profile - general use applications, uses Rethinkdns to:

  1. Enable per-app firewalling to prevent unnecessary network access for certain apps (system apps/calculator/locking down mobile data access)
  2. Enable per app domain firewalls. I noticed too many apps making calls to graph.facebook.comand was able to block those on a per app level with domain firewalls
  3. Block stealth DNS.
  4. Add on-device blocklists (Hagezi multi pro) and use NextDNS as a fallback
  5. Do all of this while using a WG VPN config.

Work Profile (no Google account added here) - streaming and self hosted services

  1. All streaming apps on this profile, plus web apps for my self hosted services (AdGuard, FreshRSS, Stirling PDF)
  2. Use Tailscale as always on VPN
  3. Use Zimaboard on home network as Tailscale exit node
  4. Set Tailscale DNS to use AdGuard Home on my Zimaboard

Android Private Space - again, no Google account here, mostly for browsing / Wikipedia rabbit holes, etc:

  1. Proton VPN always on with multi hop
  2. A few browser apps

Admittedly, this isn’t really a KISS approach but it’s what I’ve found works for me right now.

47

I’m noticing an issue with using a device identifying string and Android’s Private DNS. When I use this “Google–Pixel–7–xxxx.dns.nextdns.io”, it shows up as Google Pixel 7- in NextDNS. I used a double dash to represent a space. What’s going on?