Cloudflared and 1.1.1.2 (malware blocking)

Zero Trust 1.1.1.1
1

Hello.

Running cloudflared as a DNS proxy on a Pi-4. All working fine except for look-ups to 1.1.1.2.

If I check https://phishing.testcategory.com/ I see the ‘!’ page - not the response I’d expect if things were working correctly.

Need to check that I’ve got this configured correctly as DoH works when tested via 1.1.1.1/help

Dumps of settings/look-ups etc follow.

Question is, when using the service at 1.1.1.2 (i.e. malware block) should the cloudflared configuration file specify

CLOUDFLARED_OPTS=--port 5053 --upstream https://security.cloudflare-dns.com/dns-query

rather than

CLOUDFLARED_OPTS=--port 5053 --upstream https://1.1.1.2/dns-query

Many thanks!

cloudflared.service - cloudflared DNS over HTTPS proxy
   Loaded: loaded (/etc/systemd/system/cloudflared.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2021-12-09 16:41:46 GMT; 1h 28min ago
 Main PID: 503 (cloudflared)
    Tasks: 10 (limit: 4915)
   CGroup: /system.slice/cloudflared.service
           └─503 /usr/local/bin/cloudflared proxy-dns --port 5053 --upstream https://1.1.1.2/dns-query --upstream https://1.0.0.2/dn

Dec 09 16:41:46 rpi4-1 systemd[1]: Started cloudflared DNS over HTTPS proxy.
Dec 09 16:41:50 rpi4-1 cloudflared[503]: 2021-12-09T16:41:50Z INF Adding DNS upstream url=https://1.1.1.2/dns-query
Dec 09 16:41:50 rpi4-1 cloudflared[503]: 2021-12-09T16:41:50Z INF Starting metrics server on 127.0.0.1:40959/metrics
Dec 09 16:41:50 rpi4-1 cloudflared[503]: 2021-12-09T16:41:50Z INF Adding DNS upstream url=https://1.0.0.2/dns-query
Dec 09 16:41:50 rpi4-1 cloudflared[503]: 2021-12-09T16:41:50Z INF Starting DNS over HTTPS proxy server address=dns://localhost:5053

$ dig @security.cloudflare-dns.com phishing.testcategory.com +short
0.0.0.0

dig @localhost -p 5053 phishing.testcategory.com +short
104.18.5.35
104.18.4.35
2

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.