Commit 8759d00e authored by Miek Gieben's avatar Miek Gieben Committed by GitHub

forward doc update (#4254)

* forward: add example with multiple DoT upstreams

Remove Bugs section as this is a nice work around.

h/t https://twitter.com/mholt6/status/1284250606673080321Signed-off-by: default avatarMiek Gieben <miek@miek.nl>

* Actually remove bugs section
Signed-off-by: default avatarMiek Gieben <miek@miek.nl>
parent a136b712
...@@ -157,7 +157,7 @@ Proxy everything except `example.org` using the host's `resolv.conf`'s nameserve ...@@ -157,7 +157,7 @@ Proxy everything except `example.org` using the host's `resolv.conf`'s nameserve
} }
~~~ ~~~
Proxy all requests to 9.9.9.9 using the DNS-over-TLS protocol, and cache every answer for up to 30 Proxy all requests to 9.9.9.9 using the DNS-over-TLS (DoT) protocol, and cache every answer for up to 30
seconds. Note the `tls_servername` is mandatory if you want a working setup, as 9.9.9.9 can't be seconds. Note the `tls_servername` is mandatory if you want a working setup, as 9.9.9.9 can't be
used in the TLS negotiation. Also set the health check duration to 5s to not completely swamp the used in the TLS negotiation. Also set the health check duration to 5s to not completely swamp the
service with health checks. service with health checks.
...@@ -184,10 +184,25 @@ Or with multiple upstreams from the same provider ...@@ -184,10 +184,25 @@ Or with multiple upstreams from the same provider
} }
~~~ ~~~
## Bugs Or when you have multiple DoT upstreams with different `tls_servername`s, you can do the following:
The TLS config is global for the whole forwarding proxy if you need a different `tls_servername` for ~~~ corefile
different upstreams you're out of luck. . {
forward . 127.0.0.1:5301 127.0.0.1:5302
}
.:5301 {
forward . 8.8.8.8 8.8.4.4 {
tls_servername dns.google
}
}
.:5302 {
forward . 1.1.1.1 1.0.0.1 {
tls_servername cloudflare-dns.com
}
}
~~~
## See Also ## See Also
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment