DNS over TLS setup on Turris Omnia using Knot DNS Resolver

Information extracted from here.

Go to Forris DNS tab and make sure that “Use forwarding” is not checked, save.

Grab and convert the needed ssh certificate into Omnia. From /root :

Copy the pem file into /etc/ssl/certs

Create the configuration file /etc/kresd/custom.conf with content:

policy.add(policy.all(
policy.TLS_FORWARD({
{'1.1.1.1', hostname='cloudflare-dns.com', ca_file='/etc/ssl/certs/DigiCertECCSecureServerCA.pem'},
{'1.0.0.1', hostname='cloudflare-dns.com', ca_file='/etc/ssl/certs/DigiCertECCSecureServerCA.pem'}
})
))

The resolver needs to know where to find the rule, so edit /etc/config/resolver, adding the following line at the end of the config resolver ‘kresd’ section

option include_config ‘/etc/kresd/custom.conf’

Restart the resolver with the following command:

/etc/init.d/resolver restart

You are all done. You should be using dns over tls via Cloudflare’s 1.1.1.1

One can confirm this fact by testing for DNS leaks -> dnsleaktest.com