DoH not working, it says "not found"

[Turab]

I have setup a docker environment behind nginx proxy (on Caprover to be more specific). Port forwardings are ok, I can login to the Web UI. I have set my router to use the IP of this instance and traditional DNS queries work very well by this way. (Confirming reverse proxy is also working.) Domain and SSL are also working very well. When it comes to using DoH, AdGuard Home responds with "Not Found" to this URL: https://dns.example.com/dns-query

Therefore I can't use it on Android (neither natively nor with a DNS changer app). For example go to any DoH URL (including AdGuard's public one; you will see "dns parameter is missing" error, which is the expected response. But my instance says "Not Found" responding with 404 I guess.

What could be the problem here and how can I solve it?

Edit: Forgot to mention I have added docker network as CDR in trusted_proxies

[ananthu-kurup]

Facing the same issue. Looking to find a solution as DoH is the main reason I wanted to set this up on a cloud VPS so I can use macOS/iOS profiles

[xd003]

Can confirm that DOH is broken for me as well

[ananthu-kurup]

I managed to get this fixed, but completely forgot about this thread.

What worked for me was changing the proxy_pass from http to https. Could you give that a try and see if it fixes the issue.

So, the NGINX config file would look something like:

    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        
        server_name example.org www.example.org'
        
        # SSL certificates managed by the certbot container in docker-compose
        ssl_certificate /etc/nginx/ssl/live/example.org/fullchain.pem;
        ssl_certificate_key /etc/nginx/ssl/live/example.org/privkey.pem;
        
        location / {
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header                   Host $host;
            proxy_set_header                   X-Real-IP $remote_addr;
            proxy_pass  http://adguardhome:80;
            proxy_redirect                     / /;
            proxy_cookie_path                  / /;
        }

        location /dns-query {
            proxy_set_header Host            $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_bind 192.168.0.5;

            proxy_pass https://adguardhome:443/dns-query;
        }
    }

[xd003]

Thanks for the heads up, i am using traefik to reverse proxy my domain, will see how to change the same the same over there. Also on another note, have you also changed the option allow_unencrypted_doh to true in the config file ? Asking because in the past i had to do that to make DOH work. Ref here . Unfortunately atm, even with that set to true, it is still broken

[ananthu-kurup]

I just checked my config file and allow_unecrypted_doh is set to true. I don’t remember if I ever had it set to false.

[xd003]

Ah well all is good now, there was a error in my agh docker compose traefik labels, fixed it DOH works now
For anyone reading this, i didn't needed to touch anything for proxy pass with traefik atleast
So conclusively just needed to change the allow_unecrypted_doh to true as always :)
Also this option is false by default from what i know, i always have to change it manually to true

[Turab]

Ok, setting allow_unecrypted_doh to true made it work for me but what is actually allow_unecrypted_doh and what is the point of DoH if it is unencrypted? Am I missing something here? I don't find this directive documented anywhere.

[ananthu-kurup]

I'm not an Adguard engineer or a networking engineer, but the basic premise of my reasoning should be sound.

You have NGINX as a reverse proxy in a docker container that is attached to port 80 & 443 of the server, to which HTTPS traffic comes, encrypted using the SSL certificate you setup. NGINX will then decrypt the request and pass it to Adguard service that's on a different docker container.

The encryption & decryption is handled in the NGINX container. The communication between the NGINX & Adgaurd containers is internal and doesn’t leave the host at all. But the Adguard container itself won’t get the encrypted request and default Adguard setup expects that and also actually handles the encryption and decryption part. Since we offload that portion to NGINX, we need our Adguard service to process unencrypted requests.

But the primary purpose of DoH is met, the DNS request is encrypted and unreadable until it reaches your server and then the NGINX container. From there the data travels in internal, virtual, network stack and thus is assumed to be safe and private.

[Turab]

Ok sounds sound. But isn't this the expected default case already? I mean doesn't AdGuard always need a web proxy already? Or is it like AdGuard needs a proxy web server to serve its web UI but it doesn't need it when it comes to handle DNS requests? By the way in my case, Firewall is proxying the DNS requests and not NGIN; but I get your point.

[ananthu-kurup]

Glad I could help. I have glanced through the other installation methods and don't see any use of a reverse proxy in the other scenarios. They all use port 3000 for installation setup, 80 for the web interface and the other ports for DNS requests as applicable, all directly 'captured' by the AdGuard Home service.

I personally went this route because the VPS I am running this on is not just for AdGuard Home and if my AdGuard Home service takes over port 80 and 443, I don't think there would be any options available to me to host other services on another subdomain for example.

By allowing a system like NGINX or Apache to bind to the system port, you open up a very flexible deployment scheme to enable multiple services to run off of the same system as the reverse proxy would be able to orchestrate the requests based on domain.