Skip to content

Commit

Permalink
Merge pull request #42 from f5devcentral/develop
Browse files Browse the repository at this point in the history
Merge from Dev ahead of AppWorld
  • Loading branch information
bvanlieu authored Jan 29, 2024
2 parents b02e5bc + dbea354 commit d44338f
Show file tree
Hide file tree
Showing 368 changed files with 500 additions and 4,216 deletions.
Empty file modified buildhtml.bat
100644 → 100755
Empty file.
8 changes: 5 additions & 3 deletions containthedocs-build.sh
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,14 @@

set -x

COMMAND=(/bin/bash -c "sudo pip install -r requirements.txt -U ; make -C docs clean html")
COMMAND="make -C docs html"

. ./containthedocs-image

exec docker run --rm -t \
rm -rf docs/_build

exec podman run --rm -it \
-v "$PWD":"$PWD" --workdir "$PWD" \
${DOCKER_RUN_ARGS} \
-e "LOCAL_USER_ID=$(id -u)" \
${DOC_IMG} "${COMMAND[@]}"
${DOC_IMG} ${COMMAND}
2 changes: 1 addition & 1 deletion containthedocs-clean.sh
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ COMMAND="make -C docs clean"

. ./containthedocs-image

exec docker run --rm -it \
exec podman run --rm -it \
-v "$PWD":"$PWD" --workdir "$PWD" \
${DOCKER_RUN_ARGS} \
-e "LOCAL_USER_ID=$(id -u)" \
Expand Down
2 changes: 1 addition & 1 deletion containthedocs-cleanbuild.sh
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ COMMAND="make -C docs clean html"

. ./containthedocs-image

exec docker run --rm -it \
exec podman run --rm -it \
-v "$PWD":"$PWD" --workdir "$PWD" \
${DOCKER_RUN_ARGS} \
-e "LOCAL_USER_ID=$(id -u)" \
Expand Down
6 changes: 4 additions & 2 deletions docs/class5/class5.rst
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
Class 5 - DNS over HTTPS/DNS over TLS
=====================================
Class 5 - DNS over HTTPS/DNS over TLS (Pre TMOS 16.1)
=====================================================

Introduction
~~~~~~~~~~~~

**NOTE: This lab is deprected for Class 6 and the native DoH/DoT support in TMOS, and is kepts for informational purposes only.**

In this lab, you will see DNS over HTTPS (DoH) and DNS over TLS (DoT) queries proxied in both directions. That is, traditional DNS queries will be proxied to backend DoT/DoH servers, as well as DoH/DoT queries being proxied to traditional DNS servers.

DoT is "simpler" to proxy as the original DNS protocol is simply encapsulated in TLS using client-SSL (DoT-to-DNS) or server-ssl (DNS-to-DoT) profiles.
Expand Down
1 change: 0 additions & 1 deletion docs/class5/topology.rst
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ This lab consists of a single BIG-IP that is proxying the various DNS
packet types. A single Windows jump host sits in the client segment
while an Ubuntu jump server sits in the server segment.

|image2.png|

.. |image2.png| image:: _images/image2.png
:width: 7.5in
Expand Down
Binary file removed docs/class6/_figures/0001.jpg
Binary file not shown.
Binary file removed docs/class6/_figures/1.jpg
Binary file not shown.
Binary file removed docs/class6/_figures/1.png
Binary file not shown.
Binary file removed docs/class6/_figures/10.jpg
Binary file not shown.
Binary file removed docs/class6/_figures/10.png
Binary file not shown.
Binary file removed docs/class6/_figures/100.png
Binary file not shown.
Binary file removed docs/class6/_figures/100_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/101.png
Binary file not shown.
Binary file removed docs/class6/_figures/101_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/102.png
Binary file not shown.
Binary file removed docs/class6/_figures/102_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/103.png
Binary file not shown.
Binary file removed docs/class6/_figures/103_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/104.png
Binary file not shown.
Binary file removed docs/class6/_figures/104_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/105.png
Binary file not shown.
Binary file removed docs/class6/_figures/106.png
Binary file not shown.
Binary file removed docs/class6/_figures/106_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/107.jpg
Binary file not shown.
Binary file removed docs/class6/_figures/107.png
Binary file not shown.
Binary file removed docs/class6/_figures/107_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/108.png
Binary file not shown.
Binary file removed docs/class6/_figures/108_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/109.png
Binary file not shown.
Binary file removed docs/class6/_figures/10_updated.png
Binary file not shown.
Binary file removed docs/class6/_figures/11.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/11.png
Diff not rendered.
Binary file removed docs/class6/_figures/110.png
Diff not rendered.
Binary file removed docs/class6/_figures/111.png
Diff not rendered.
Binary file removed docs/class6/_figures/112.png
Diff not rendered.
Binary file removed docs/class6/_figures/113.png
Diff not rendered.
Binary file removed docs/class6/_figures/114.png
Diff not rendered.
Binary file removed docs/class6/_figures/115.png
Diff not rendered.
Binary file removed docs/class6/_figures/116.png
Diff not rendered.
Binary file removed docs/class6/_figures/117.png
Diff not rendered.
Binary file removed docs/class6/_figures/118.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/118.png
Diff not rendered.
Binary file removed docs/class6/_figures/118_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/119.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/119.png
Diff not rendered.
Binary file removed docs/class6/_figures/119_B.png
Diff not rendered.
Binary file removed docs/class6/_figures/119_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/11_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/12.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/12.png
Diff not rendered.
Binary file removed docs/class6/_figures/120.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/120.png
Diff not rendered.
Binary file removed docs/class6/_figures/121.png
Diff not rendered.
Binary file removed docs/class6/_figures/121_1.png
Diff not rendered.
Binary file removed docs/class6/_figures/121_2.png
Diff not rendered.
Binary file removed docs/class6/_figures/121_3.png
Diff not rendered.
Binary file removed docs/class6/_figures/122.png
Diff not rendered.
Binary file removed docs/class6/_figures/122_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/123.png
Diff not rendered.
Binary file removed docs/class6/_figures/123_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/12_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/13.png
Diff not rendered.
Binary file removed docs/class6/_figures/13_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/14.png
Diff not rendered.
Binary file removed docs/class6/_figures/14_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/15.png
Diff not rendered.
Binary file removed docs/class6/_figures/16.png
Diff not rendered.
Binary file removed docs/class6/_figures/16_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/17.png
Diff not rendered.
Binary file removed docs/class6/_figures/17_B.png
Diff not rendered.
Binary file removed docs/class6/_figures/17_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/18.png
Diff not rendered.
Binary file removed docs/class6/_figures/18_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/19.png
Diff not rendered.
Binary file removed docs/class6/_figures/19_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/2.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/2.png
Diff not rendered.
Binary file removed docs/class6/_figures/20.png
Diff not rendered.
Binary file removed docs/class6/_figures/200.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/202.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/20_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/21.png
Diff not rendered.
Binary file removed docs/class6/_figures/21_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/22.png
Diff not rendered.
Binary file removed docs/class6/_figures/221.png
Diff not rendered.
Binary file removed docs/class6/_figures/22_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/23.png
Diff not rendered.
Binary file removed docs/class6/_figures/23_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/24.png
Diff not rendered.
Binary file removed docs/class6/_figures/24_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/25.png
Diff not rendered.
Binary file removed docs/class6/_figures/25_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/26.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/26.png
Diff not rendered.
Binary file removed docs/class6/_figures/26_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/27.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/27.png
Diff not rendered.
Binary file removed docs/class6/_figures/28.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/28.png
Diff not rendered.
Binary file removed docs/class6/_figures/29.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/29.png
Diff not rendered.
Binary file removed docs/class6/_figures/29_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/29_updated2.png
Diff not rendered.
Binary file removed docs/class6/_figures/2_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/3.png
Diff not rendered.
Binary file removed docs/class6/_figures/30.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/30.png
Diff not rendered.
Binary file removed docs/class6/_figures/300.png
Diff not rendered.
Binary file removed docs/class6/_figures/300_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/301.png
Diff not rendered.
Binary file removed docs/class6/_figures/301_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/302.png
Diff not rendered.
Binary file removed docs/class6/_figures/302_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/31.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/31.png
Diff not rendered.
Binary file removed docs/class6/_figures/32.png
Diff not rendered.
Binary file removed docs/class6/_figures/33.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/33.png
Diff not rendered.
Binary file removed docs/class6/_figures/34.png
Diff not rendered.
Binary file removed docs/class6/_figures/35.png
Diff not rendered.
Binary file removed docs/class6/_figures/36.png
Diff not rendered.
Binary file removed docs/class6/_figures/37.png
Diff not rendered.
Binary file removed docs/class6/_figures/38.png
Diff not rendered.
Binary file removed docs/class6/_figures/39.png
Diff not rendered.
Binary file removed docs/class6/_figures/4.png
Diff not rendered.
Binary file removed docs/class6/_figures/40.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/40.png
Diff not rendered.
Binary file removed docs/class6/_figures/41.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/41.png
Diff not rendered.
Binary file removed docs/class6/_figures/42.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/42.png
Diff not rendered.
Binary file removed docs/class6/_figures/43.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/43.png
Diff not rendered.
Binary file removed docs/class6/_figures/44.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/44.png
Diff not rendered.
Binary file removed docs/class6/_figures/45.png
Diff not rendered.
Binary file removed docs/class6/_figures/46.png
Diff not rendered.
Binary file removed docs/class6/_figures/47.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/47.png
Diff not rendered.
Binary file removed docs/class6/_figures/48.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/48.png
Diff not rendered.
Binary file removed docs/class6/_figures/49.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/49.png
Diff not rendered.
Binary file removed docs/class6/_figures/4_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/5-6.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/5.png
Diff not rendered.
Binary file removed docs/class6/_figures/50.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/50.png
Diff not rendered.
Binary file removed docs/class6/_figures/51.png
Diff not rendered.
Binary file removed docs/class6/_figures/52.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/52.png
Diff not rendered.
Binary file removed docs/class6/_figures/53.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/53.png
Diff not rendered.
Binary file removed docs/class6/_figures/54.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/54.png
Diff not rendered.
Binary file removed docs/class6/_figures/55.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/55.png
Diff not rendered.
Binary file removed docs/class6/_figures/56.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/56.png
Diff not rendered.
Binary file removed docs/class6/_figures/56_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/57.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/57.png
Diff not rendered.
Binary file removed docs/class6/_figures/58.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/58.png
Diff not rendered.
Binary file removed docs/class6/_figures/59.png
Diff not rendered.
Binary file removed docs/class6/_figures/6.png
Diff not rendered.
Binary file removed docs/class6/_figures/60.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/60.png
Diff not rendered.
Binary file removed docs/class6/_figures/61.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/61.png
Diff not rendered.
Binary file removed docs/class6/_figures/62.png
Diff not rendered.
Binary file removed docs/class6/_figures/63.png
Diff not rendered.
Binary file removed docs/class6/_figures/64.png
Diff not rendered.
Binary file removed docs/class6/_figures/65.png
Diff not rendered.
Binary file removed docs/class6/_figures/66.png
Diff not rendered.
Binary file removed docs/class6/_figures/67.png
Diff not rendered.
Binary file removed docs/class6/_figures/68.png
Diff not rendered.
Binary file removed docs/class6/_figures/68_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/68_updated2.png
Diff not rendered.
Binary file removed docs/class6/_figures/68_updated3.png
Diff not rendered.
Binary file removed docs/class6/_figures/69.png
Diff not rendered.
Binary file removed docs/class6/_figures/7.png
Diff not rendered.
Binary file removed docs/class6/_figures/70.png
Diff not rendered.
Binary file removed docs/class6/_figures/71.png
Diff not rendered.
Binary file removed docs/class6/_figures/72.png
Diff not rendered.
Binary file removed docs/class6/_figures/73.png
Diff not rendered.
Binary file removed docs/class6/_figures/74.png
Diff not rendered.
Binary file removed docs/class6/_figures/75.png
Diff not rendered.
Binary file removed docs/class6/_figures/75_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/76.png
Diff not rendered.
Binary file removed docs/class6/_figures/77.png
Diff not rendered.
Binary file removed docs/class6/_figures/78.png
Diff not rendered.
Binary file removed docs/class6/_figures/78_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/78a.png
Diff not rendered.
Binary file removed docs/class6/_figures/79.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/79.png
Diff not rendered.
Binary file removed docs/class6/_figures/8.png
Diff not rendered.
Binary file removed docs/class6/_figures/80.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/80.png
Diff not rendered.
Binary file removed docs/class6/_figures/81.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/81.png
Diff not rendered.
Binary file removed docs/class6/_figures/82.png
Diff not rendered.
Binary file removed docs/class6/_figures/82_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/83.png
Diff not rendered.
Binary file removed docs/class6/_figures/84.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/84.png
Diff not rendered.
Binary file removed docs/class6/_figures/85.png
Diff not rendered.
Binary file removed docs/class6/_figures/85_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/86.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/86.png
Diff not rendered.
Binary file removed docs/class6/_figures/86_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/87.png
Diff not rendered.
Binary file removed docs/class6/_figures/87_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/88.png
Diff not rendered.
Binary file removed docs/class6/_figures/89.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/89.png
Diff not rendered.
Binary file removed docs/class6/_figures/9.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/9.png
Diff not rendered.
Binary file removed docs/class6/_figures/90.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/90.png
Diff not rendered.
Binary file removed docs/class6/_figures/91.png
Diff not rendered.
Binary file removed docs/class6/_figures/92.png
Diff not rendered.
Binary file removed docs/class6/_figures/92_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/93.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/93.png
Diff not rendered.
Binary file removed docs/class6/_figures/93_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/94.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/94.png
Diff not rendered.
Binary file removed docs/class6/_figures/94_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/94_updated2.png
Diff not rendered.
Binary file removed docs/class6/_figures/95.jpg
Diff not rendered.
Binary file removed docs/class6/_figures/95.png
Diff not rendered.
Binary file removed docs/class6/_figures/95_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/96.png
Diff not rendered.
Binary file removed docs/class6/_figures/96_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/96_updated2.png
Diff not rendered.
Binary file removed docs/class6/_figures/97.png
Diff not rendered.
Binary file removed docs/class6/_figures/97_updated.png
Diff not rendered.
Binary file removed docs/class6/_figures/97_updated2.png
Diff not rendered.
Binary file removed docs/class6/_figures/98.png
Diff not rendered.
Binary file removed docs/class6/_figures/99.png
Diff not rendered.
Binary file removed docs/class6/_figures/Auction.png
Diff not rendered.
Binary file removed docs/class6/_figures/Diagram.png
Diff not rendered.
Binary file removed docs/class6/_figures/postman-udf.png
Diff not rendered.
Binary file added docs/class6/_images/Chrome-DOH-enable-disable.png
Binary file added docs/class6/_images/DNS-Lab-Components.png
Binary file added docs/class6/_images/DOT-to-DNS-KDIG-command.png
Binary file added docs/class6/_images/DOT-to-DNS-tcpdump.png
Binary file added docs/class6/_images/DOT-to-DNS-vs-statistics.png
Binary file added docs/class6/_images/HTTP2-POST-example.png
Binary file added docs/class6/_images/dns-configuration.png
Binary file added docs/class6/_images/f5-app-world-2024_og.png
Binary file added docs/class6/_images/firefox-trr-about-config.png
Binary file added docs/class6/_images/kdig-example.png
Binary file added docs/class6/_images/kdig-tls-DOT-screenshot.png
Binary file added docs/class6/_images/ltm-nodes-shown.png
Binary file added docs/class6/_images/ntp-configuration.png
Binary file added docs/class6/_images/pool-statistics-image.png
Binary file added docs/class6/_images/pools-configuration.png
Binary file added docs/class6/_images/rdp-login-screen-example.png
Binary file added docs/class6/_images/resource-provisioning.png
Binary file added docs/class6/_images/tcpdump-doh-testing.png
Binary file added docs/class6/_images/vlans-screen-twoshown-n.png
Binary file added docs/class6/_images/windows-rdp-desktop.png
64 changes: 58 additions & 6 deletions docs/class6/class6.rst
Original file line number Diff line number Diff line change
@@ -1,12 +1,64 @@
Class 6 - F5 DNS Cloud Service & F5 DNS Load Balancer Cloud Service
===================================================================
Class 6 - Native DNS over HTTPS/DNS over TLS
============================================

This class will cover the following topics:
Introduction
~~~~~~~~~~~~

DNS over HTTPS (DoH) & DNS over TLS (DoT) are protocols for performing Domain Name System (DNS) resolution via the HTTPS protocol or via TLS (Transport Layer Security) encryption. The goal of both DoH and DoT is to provide increased security and end-user privacy on an otherwise open and transparent DNS query and response. It is worth noting that DoH is NOT DNS protocol – it uses the HTTP/2 protocol.

BIG-IP DNS decrypts and resolves DNS queries over HTTPS (DoH) without affecting RPS. DNS over TLS (DoT) ensures that DNS requests and responses are not tampered with or forged via on-path attacks.

Starting in BIG-IP 16.1, F5 now includes profiles that support DNS over HTTPS. These DoH profiles are included with the Local Traffic Manager + DNS license. The BIG-IP supports DoH in the following modes:

- BIG-IP DoH Proxy—A passthrough proxy that proxies the client’s DoH request to a backend DoH server and the backend DoH server’s response back to the DoH client. In “F5-speak”, this is a full HUDCHAIN with DoH support on both the client and server sides of the connection.

- BIG-IP DoH server— In this method, BIG-IP terminates the DoH connections and all subsequent DNS requests are handled by the DNS profile on the BIG-IP.

- The DoH-Server translates the client’s DoH request into a standard DNS request and forwards the DNS request using TCP or UDP to the configured DNS server or pool, such as the BIG-IP named process or the BIG-IP DNS cache feature. When the BIG-IP system receives a response from the configured DNS server, it translates the DNS response into a DoH response before sending it to the DoH client.

.. note::
F5 has support for DNS over HTTPS on BIG-IP versions prior to 16.1.0 via an iRuleLX implementation (Link here: https://clouddocs.f5.com/training/community/dns/html/class5/class5.html). This iRulesLX method will still be supported, but BIG-IP’s native LTM and DNS profiles created for DoH are the preferred method for implementation

DoH, on its own, is somewhat complex and is not DNS from a protocol perspective, meaning that traditional DNS tools cannot understand it. It is done with either HTTP GET or HTTP POST and uses tcp/443 along with TLS1.3 and encrypted SNI. Using the BIG-IP DNS, we can convert either method from DoH to a standard DNS query (DoH to DNS). For the HTTP GET method, we must take the DNS request, encode the URL with base64url, and then encapsulate it into a binary HTTPS payload, as seen here:

.. image:: _images/HTTP2-binary-payload-example.png
:width: 7.5in
:height: 4.6875in

For the HTTP POST method, we must take the DNS request, encode the DNS message in DNS Wire Format, and then encapsulate it into the HTTPS payload, as seen here:

.. image:: _images/HTTP2-POST-example.png
:width: 7.5in
:height: 4.6875in

We can also do the same thing in reverse by converting a standard DNS request into a DoH formatted/encapsulated request (DNS-to-DoH), so that standard DNS clients can communicate with DoH Servers.

.. note::
In this lab, we will configure DoH-SERVER (DoH to DNS) objects for testing.

DoT, on the other hand, is “simpler” to proxy as it is considered DNS from a protocol perspective, with an added TLS wrapper for transport security. In fact, in its simplest terms, the original DNS protocol is simply sent on tcp/853 and encapsulated in TLS using client-SSL (DoT-to-DNS) or server-SSL (DNS-to-DoT) profiles. This allows for remarkably simple lookups using standard DNS utilities, such as ‘kdig’, with the ‘+tls’ directive:

.. image:: _images/kdig-example.png
:width: 7.5in
:height: 4.6875in

Lab Overview
~~~~~~~~~~~~

This lab consists of two primary sections:

- Proxying DNS queries over HTTPS to traditional DNS servers

- In this section, you will use Mozilla Firefox as a DoH client to browse the web using encrypted DNS through the BIG-IP using DNS over HTTPS

- Proxying DNS queries over TLS to traditional DNS servers

- In this section, you will use the kdig utility as a DoT client to perform queries through the BIG-IP using DNS over TLS

.. toctree::
:maxdepth: 1
:glob:

intro
labinfo
lab*/lab*
topology
components
configuration
54 changes: 54 additions & 0 deletions docs/class6/components.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
Components
~~~~~~~~~~

The lab consists of the following items:

- Subnets

- Management: 10.1.1.0/24

- DNS VIPs: 10.1.10.0/24

- DNS Servers: 10.1.20.0/24

- Hosts

- Windows Jump Host

- Credentials: user / user

- Management IP: 10.1.1.4

- Ubuntu Jump Host – for Attacks

- Credentials: user / f5agility!

- Management IP: 10.1.1.7

- External IP: 10.1.10.7

- Ubuntu DNS server – “Victim” server

- Credentials: user / f5agility!

- Management IP: 10.1.1.6

- External IP: 10.1.20.6

- F5 BIG-IP Proxy:

- Credentials: admin / default \| root / default

- Management IP: 10.1.1.8

- External Subnet IP: 10.1.10.5/24

- Internal Subnet IP: 10.1.20.5/24

- DNS VIPs

- DoT-to-DNS: 10.1.10.6 (TCP/853)

- DoH-to-DNS: 10.1.10.6 (TCP/443)

- DNS-traditional (TCP/53 and UDP/53)
Loading

0 comments on commit d44338f

Please sign in to comment.