Hacker News Reader

The "more effort" part was what I was going for -- no nation state or warrant-holding organization is going to be stymied by this, but as a personal/home user, I'd rather DoH resolvers not be able to tie my lookups to my personal IP which is doubtless held in many other cross-referencable locations (in my case, home-network wide proxying or Tor isn't feasible).

View on HN

I wonder if it'd be feasible to proxy only the DNS requests over Tor. Maybe set up your network-level DNS proxy to route upstream queries through a Tor tunnel to a different DNS-over-HTTPS resolver. Perhaps even have the DNS proxy cache DNS records and proactively revalidate commonly used ones to avoid most of the latency overhead of Tor.

Unbound does prefetch [0]. Not sure abt the tor split tunnel, but is easy to setup one over WireGuard.

[0] https://en.m.wikipedia.org/wiki/Unbound_(DNS_server)#Feature...

It's definitely feasible. Old hardware + 2 network cards + pfsense makes a router that can do network-wide VPN. Even a lot of prosumer routers can do VPNs now, but I'm not sure how well it works.

Reply on news.ycombinator.com