DNS questions and settings

[MoonDragon-MD]

Hi, I just recently came to know about this app, I found it by browsing f-droid, I find it very interesting but
there are a few things I didn't quite understand:

1. is it possible to use/choose between Doh and dot with your DNS, currently what do you use?
2. is it possible to enable (that bypasses list-blocklists rules) a site with all subdomains?
3. if the answer to question 2 was no: is it possible to override a specific list rule?
4. if the answer to question 3 was no: is it possible to exclude a single domain and pass it directly to DNS without rules?
5. I saw that at DNS > Configure > Rules there is Allow or deny individual domains, would this be what I need?
   I tried to use network Logs and then on the second option (Block,bypass this IP for this app) to put "Bypass App Rules" then I went to Firewall "IP & PORT RULES" and added the corresponding IP, but I have the impression that it is filtered anyway, because streaming to a particular site is not seen.
   For me the integration with Orbot is very important, I thank you for including this possibility, in this regard I would like to ask:
   (a) how do you determine that Orbot is installed? Though I installed it at first it told me to install it, then instead starting the tor service, it saw it
   b) I would like to know if there is a difference between enabling it from "Setup SOCKS5Proxy" or from "Setup Orbot".
   Thanks in advance

[ignoramous]

is it possible to use/choose between Doh and dot with your DNS, currently what do you use?

On the app? Yes, you can choose any upstream DoH, DNSCrypt, or plain-old DNS (including network / OS DNS).

[MoonDragon-MD]

I'll try to explain better: if I set RethinkDNS > RDNS Plus can I add a DoH DNS or does it automatically go with my carrier's DNS or as it says below it only does with Cloudflare? It would be interesting to also be able to choose on RethinkDNS the DNS on which to connect outbound

[ignoramous]

would be interesting to also be able to choose on RethinkDNS the DNS on which to connect outbound

That isn't possible today, but planned: serverless-dns/serverless-dns/issues/9

Btw, max (hosted on Fly) is a recursive resolver. There is no upstream needed to connect to. sky (hosted on Cloudflare) is a stub resolver which needs upstream (today, that's 1.1.1.1 and 8.8.8.8 over DoH).

[ignoramous]

is it possible to enable (that bypasses list-blocklists rules) a site with all subdomains?

There's no way to add domain names to a bypass. This is in the works: /issues/18 You can "exclude" app entirely from the VPN, though. "Excluded" apps aren't subject to Firewall or DNS rules.

if the answer to question 2 was no: is it possible to override a specific list rule?

You can only add or remove DNS blocklists. These are applied to all "un-excluded" apps.

if the answer to question 3 was no: is it possible to exclude a single domain and pass it directly to DNS without rules?

Not yet. We are working on it. This feature will be available in v054.

I saw that at DNS > Configure > Rules there is Allow or deny individual domains, would this be what I need?

Yep. /issues/279

[ignoramous]

I tried to use network Logs and then on the second option (Block,bypass this IP for this app) to put "Bypass App Rules" then I went to Firewall "IP & PORT RULES" and added the corresponding IP, but I have the impression that it is filtered anyway, because streaming to a particular site is not seen.

Do you mean you blocked an IP in "IP & PORT RULES" but yet that IP was allowed? If so, Network Logs should show you that.

If not, it could be that the app that's working despite the IP block may be using another IP for the same service (again, this should be evident from the Network Logs).

[MoonDragon-MD]

Yes it's true that it connects with other IPs, I didn't notice it

[ignoramous]

(a) how do you determine that Orbot is installed? Though I installed it at first it told me to install it, then instead starting the tor service, it saw it

We ask the Android PackageManager if it org.torproject.android is installed and accessible. If not, we prompt an install. I see that the TV and Mini Orbot apps for Android have a different app-id... Where have you installed Orbot from and what flavour?

I would like to know if there is a difference between enabling it from "Setup SOCKS5Proxy" or from "Setup Orbot".

It is the same. Except in (Orbot integration) Tor-as-a-proxy's case only TCP SOCKS5 is set (it sets UDP too, but Orbot doesn't it support yet, it simply discards all UDP packets). Also, HTTP Proxy may be set if the user so chose when setting up Tor-as-a-proxy. And DNS Proxy too (which doesn't work as expected).

[MoonDragon-MD]

I installed Orbot from F-droid repo Guardian Project, the installed version is 16.6.1-RC-3. (Also because I did not install Google Play Services). Thanks for all the other answers, you were very clear, I will wait for the next version, I wish you good work !!!