Adguardhome (dns only, not admin interface) through cloudflare tunnels (cloudflared) ?

[Waldorf3]

Cloudflare tunnels are a kind of reverse VPN from cloudflare to a home network. It is a more secure alternative to the traditional problems accessinging a home network with DDNS and port forwarding.

I have a working setup with wildcard DNS+cert tunnelling traffic to a (docker) nginx-proxy-manager ingress from where I manage which services I will allow access from the public internet, and which automatically handles letsencrypt certificates. By and large this is a close to zero-maintenance, highly secure access method.

My problem now is I'd like to access the adguardhome server on my home network. I've eventually managed to have it setup and working perfect from within the home network, and now would like to extend this so I can use it when I am on the public network as well - I just can't get it to work.

I think it is a matter of setting up cloudflare right, so I'm wondering if anyone has got this working and can provide hints to how the tunnel needs to be setup for dns to work through this tunnel.

I've tried setting up a second public hostname of adguard.mydomain.com pointing to the local IP address of the server running adguardhome, using both http, https and tcp, and port 853, but clients on the public net fails to connect to it.

I think it is a matter of setting up cloudflare right, so I'm wondering if anyone has got this working and can provide hints to how the tunnel needs to be setup for dns to work through this tunnel.

[Waldorf3]

No interest, huh? Am I the only person in the world wanting to use adguardhome from both my home and the global internet?

[arihid]

Just discovered that you can do just that!
Try to connect with Intra (Android, idk about iOS, didn't use them), and set the DNS server to yourdomain.com/dns-query,
You'll need to enable HTTPS in your ADH instance.

172.* comes from cloudflare network.

[iwannet]

How did you do this ? I did this but it just doesnt work.

[iwannet]

Now i set my config like this and it gives Bad gateway Error code 502

And when i do the config but http instead of https i can access the admin-page but not the dns

[arihid]

Try to disable no-tls-verify.

[iwannet]

where ?

[iwannet]

it think its because my certificate is only for my domain and not for the ip adress. because i get this error

Websites` prove their identity through certificates. LibreWolf does not trust this website because it uses a certificate that is not valid for 192.168.178.105. The certificate is only valid for the following names: domain
Error code: SSL_ERROR_BAD_CERT_DOMAIN

[arihid]

Yes, it might be. And no-tls-verify will skip certificate check, allowing you to connect from origin with any certificate installed.

[iwannet]

Bro thanks it finally works. One question though, how can i disable the access to the adminpage and only allow the use of the dns ?

[arihid]

I don't know. I don't even know if Adguard had any rule for that. I guess you can do something with page rule in Cloudflare, you should start there.
One thing for sure is use a good user and password combinantion, bla bla bla, you know, the usual account security lecture.

[Ankitd013]

@iwannet You have to add “login.html” in Access -> Applications -> Application domain -> path, and In the firewall rule, add your email address or group (if you have any). Then you can access DNS without authentication but Adguard home protected with Cloudflare auth.

[iwannet]

Ow, i just enabled the proxy only for the path https://dns.server/dns-query and it works fine to.

[Ankitd013]

I am stating that if you wish to disable the admin page while still wanting access to the DNS server, you can do so.

[Gauvino]

Hello, can someone please explain me how you did it cause the image cannot be rendered and I don't understand how you did everything, seem's like this issue is missing some info to make the DNS-over-TLS possible with cloudflared

[arihid]

You just need to enable HTTPS on your ADH instance and set the hostname in Cloudflare Tunnel like you would. Don't forget to either disable tls verify or install the Cloudflare Edge certificate to avoid 502 error.