Like 0
Fork 0

Last active 2 weeks ago

Das ist die Zusammenfassung, für einen Hetzner VPS mit Adguard Home und Unbound

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

1 file changed, 5 insertions

walkthrough.md

@@ -211,4 +211,9 @@ Name: VPS WireGuard
211 211 Destination: 10.66.66.0/24
212 212 Interface: wgclt1
213 213 Distance: 1
214 + ```
215 +
216 + ```
217 + http:
218 + adress: 10.66.66.1:3000 # Wireguard Adressen von AdGuard
214 219 ```

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

1 file changed, 3 insertions, 3 deletions

walkthrough.md

@@ -1,8 +1,8 @@
1 1 # AdGuard Home + Wireguard + UDM pro
2 2
3 - Nach einer Anleitung von TheMorpheus
4 - https://www.youtube.com/watch?v=0cBZR4wy3ec
5 - https://www.patreon.com/posts/157177525
3 + - Nach einer Anleitung von TheMorpheus
4 + - https://www.youtube.com/watch?v=0cBZR4wy3ec
5 + - https://www.patreon.com/posts/157177525
6 6
7 7 ## Server config
8 8 - CX 23

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

1 file changed, 12 insertions

walkthrough.md

@@ -200,3 +200,15 @@ ufw reload
200 200 - credentials offen lassen und ui von der udm öffnen
201 201
202 202
203 + ```
204 + ip route add 10.66.66.0/24 dev wgclt1
205 + dig @10.66.66.1 google.com
206 + ```
207 +
208 + UniFi Konsole Settings -> Routing policy -> new route
209 + ```
210 + Name: VPS WireGuard
211 + Destination: 10.66.66.0/24
212 + Interface: wgclt1
213 + Distance: 1
214 + ```

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

1 file changed, 4 insertions, 4 deletions

walkthrough.md

@@ -194,9 +194,9 @@ ufw allow 49777/udp
194 194 ufw reload
195 195 ```
196 196
197 - nano /etc/default/ufw
198 - DEFAULT_FORWARD_POLICY="ACCEPT"
199 - nano /root/wg0-client-udm.conf
200 - credentials offen lassen und ui von der udm öffnen
197 + - nano /etc/default/ufw
198 + - DEFAULT_FORWARD_POLICY="ACCEPT"
199 + - nano /root/wg0-client-udm.conf
200 + - credentials offen lassen und ui von der udm öffnen
201 201
202 202

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

1 file changed, 99 insertions, 1 deletion

walkthrough.md

@@ -100,5 +100,103 @@ DNSStubListener=no
100 100 EOF
101 101 ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
102 102 systemctl restart systemd-resolved
103 + ```
104 +
105 + ```
106 + curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v
107 + ```
108 +
109 + ```
110 + ssh -i ~/.ssh/dns_hurler -L 3000:localhost:3000 root@128.140.58.16
111 + ```
112 + Ab durch den Wizard, danach
113 + ```
114 + nano /opt/AdGuardHome/AdGuardHome.yaml
115 + http:
116 + adress:
117 + - 127.0.0.1:3000
118 + ```
119 +
120 + ```
121 + apt install -y certbot
122 + certbot certonly --standalone --non-interactive --agree-tos --email du@example.com -d dns.example.com
123 + ```
124 +
125 + Datei Pfad hat nicht geklappt, deshalb in den AdGuard Settings den Inhalt aus den fullchain und privkey kopieren
126 + ```
127 + /etc/letsencrypt/live/dns.example.com/fullchain.pem
128 + /etc/letsencrypt/live/dns.example.com/privkey.pem
129 + ```
130 +
131 + Weiter in den Settings
132 + - Upstream DNS servers: 127.0.0.1:5335 (das andere löschen, damit zeigt AdGuard auf lokales Unbound)
133 + - Boostrap DNS: Adguard möchte da was deshalb
134 + ```
135 + 1.1.1.1
136 + 9.9.9.9
137 + ```
138 + - Rest erstmal so lassen
139 + Encryptions Settings
140 + - Encryption anschalten
141 + - server name: dns.example.com
142 + - https port lassen
143 + - DNS-over-TLS port: 853 löschen
144 + - certificate mit fullchain.pem füllen
145 + - private key mit privkey.pem füllen
146 +
147 + ```
148 + apt install -y caddy
149 + ```
150 +
151 + nano /opt/AdGuardHome/AdGuardHome.yaml
152 + ```
153 + tls
154 + port_https: 8443
155 + ```
156 + systemctl restart AdGuardHome
157 +
158 + nano /etc/caddy/Caddyfile
159 + ```
160 + dns.example.com {
161 + @doh {
162 + path /dns-query*
163 + method GET POST
164 + }
165 + handle @doh {
166 + reverse_proxy 127.0.0.1:8443 {
167 + transport http {
168 + tls
169 + tls_server_name dns.example.com
170 + }
171 + header_up X-Real-IP {remote_host}
172 + }
173 + }
174 + handle {
175 + respond "Not found" 404
176 + }
177 + }
178 + ```
179 +
180 + ```
181 + systemctl disable --now certbot.timer
182 + ```
183 +
184 + ```
185 + wget https://raw.githubusercontent.com/Angristan/wireguard-install/master/wireguard-install.sh
186 + chmod +x wireguard-install.sh
187 + ./wireguard-install.sh
188 + ```
189 +
190 + durch den wizard klicken, dabei port merken
191 + ```
192 + ufw allow in on wg0
193 + ufw allow 49777/udp
194 + ufw reload
195 + ```
196 +
197 + nano /etc/default/ufw
198 + DEFAULT_FORWARD_POLICY="ACCEPT"
199 + nano /root/wg0-client-udm.conf
200 + credentials offen lassen und ui von der udm öffnen
201 +
103 202
104 - ```

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

1 file changed, 83 insertions, 2 deletions

walkthrough.md

@@ -11,7 +11,7 @@ https://www.patreon.com/posts/157177525
11 11 - Ubuntu 24.04
12 12
13 13 ## Walkthrough
14 - '''
14 + ```bash
15 15 apt update && apt install -y ufw
16 16 ufw default deny incoming
17 17 ufw default allow outgoing
@@ -20,4 +20,85 @@ ufw allow 80/tcp comment "HTTP-01 ACME (Cert-Erneuerung)"
20 20 ufw allow 443/tcp comment "DoH"
21 21 ufw --force enable
22 22 ufw status verbose
23 - '''
23 + ```
24 +
25 + ```
26 + apt install -y unbound dns-root-data
27 + nano /etc/unbound/unbound.conf.d/custom.conf
28 + ```
29 +
30 + ```
31 + server:
32 + # Nur auf Loopback lauschen, auf einem nicht-Standard-Port (NICHT 5353 — das ist mDNS).
33 + interface: 127.0.0.1
34 + port: 5335
35 + do-ip4: yes
36 + do-ip6: no # nur auf yes, wenn dein VPS funktionierendes IPv6 hat, dann echt geil, kann nochmal deutlich schneller sein
37 + do-udp: yes
38 + do-tcp: yes
39 + # Nur Anfragen von localhost akzeptieren
40 + access-control: 127.0.0.0/8 allow
41 + access-control: 0.0.0.0/0 refuse
42 + access-control: ::0/0 refuse
43 + hide-identity: yes
44 + hide-version: yes
45 + # Hardening
46 + harden-glue: yes
47 + harden-dnssec-stripped: yes
48 + harden-below-nxdomain: yes
49 + harden-referral-path: yes
50 + qname-minimisation: yes
51 + use-caps-for-id: no # yes für 0x20-Randomisierung; bricht ein paar Sites
52 + # Der DNSSEC-Trust-Anchor wird vom Default-Snippet des Pakets gesetzt,
53 + # auto-trust-anchor-file hier NICHT erneut deklarieren.
54 + # Schutz gegen DNS-Rebinding / Antworten mit privaten Adressen.
55 + # Für eigene interne Zonen zusätzlich local-zone / private-domain konfigurieren.
56 + private-address: 10.0.0.0/8
57 + private-address: 172.16.0.0/12
58 + private-address: 192.168.0.0/16
59 + private-address: 169.254.0.0/16
60 + private-address: fd00::/8
61 + private-address: fe80::/10
62 + # Cache (auf VPS-RAM anpassen; das hier ist konservativ für ~1 GB)
63 + msg-cache-size: 64m
64 + rrset-cache-size: 128m
65 + msg-cache-slabs: 4
66 + rrset-cache-slabs: 4
67 + infra-cache-slabs: 4
68 + key-cache-slabs: 4
69 + # Performance
70 + prefetch: yes
71 + prefetch-key: yes
72 + num-threads: 2 # an deine vCPU-Anzahl anpassen
73 + so-rcvbuf: 1m
74 + unwanted-reply-threshold: 10000000
75 + edns-buffer-size: 1232 # vermeidet Fragmentierung auf den meisten Pfaden
76 + remote-control:
77 + # Aktiviert "unbound-control" (für Stats und Live-Befehle, später nützlich)
78 + control-enable: yes
79 + control-interface: 127.0.0.1
80 + ```
81 +
82 + ```
83 + unbound-control-setup
84 + unbound-checkconf
85 + systemctl restart unbound
86 + systemctl enable unbound
87 + ```
88 +
89 + ```
90 + systemctl status systemd-resolved --no-pager
91 + resolvectl status 2>/dev/null | head -5
92 + ss -tulpen | grep ':53'
93 + ```
94 +
95 + ```
96 + mkdir -p /etc/systemd/resolved.conf.d
97 + cat > /etc/systemd/resolved.conf.d/disable-stub.conf <<EOF
98 + [Resolve]
99 + DNSStubListener=no
100 + EOF
101 + ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
102 + systemctl restart systemd-resolved
103 +
104 + ```

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

No changes

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

No changes

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

No changes

mathias.hurler's Avatar mathias.hurler revised this gist 2 weeks ago. Go to revision

1 file changed, 23 insertions

walkthrough.md(file created)

@@ -0,0 +1,23 @@
1 + # AdGuard Home + Wireguard + UDM pro
2 +
3 + Nach einer Anleitung von TheMorpheus
4 + https://www.youtube.com/watch?v=0cBZR4wy3ec
5 + https://www.patreon.com/posts/157177525
6 +
7 + ## Server config
8 + - CX 23
9 + - 2 VCPU
10 + - 4 GB RAM
11 + - Ubuntu 24.04
12 +
13 + ## Walkthrough
14 + '''
15 + apt update && apt install -y ufw
16 + ufw default deny incoming
17 + ufw default allow outgoing
18 + ufw allow 22/tcp comment "SSH"
19 + ufw allow 80/tcp comment "HTTP-01 ACME (Cert-Erneuerung)"
20 + ufw allow 443/tcp comment "DoH"
21 + ufw --force enable
22 + ufw status verbose
23 + '''
Newer Older

Powered by Opengist ⋅ Load: 36ms⋅

English