How to Set Up FirewallDNS on Linux
By [FILL IN], [FILL IN] · Last updated
Most desktop Linux distributions manage DNS with NetworkManager and systemd-resolved. This guide shows how to set FirewallDNS with both, and how to enable DNS-over-TLS in systemd-resolved.
Requirements
- A FirewallDNS account with your public IP address registered in the dashboard
- Your FirewallDNS addresses, shown under [VERIFY: dashboard menu name where these values are shown]
- sudo access
- A distribution using NetworkManager and/or systemd-resolved (Ubuntu, Fedora, Debian and most others)
No account yet? See pricing.
Step by step
1.List your connections with nmcli connection show and note the name of the active one.
Image placeholder: screenshot of step 1 on Linux [VERIFY] 2.Set DNS on that connection: sudo nmcli connection modify "<name>" ipv4.dns "[VERIFY: FirewallDNS primary DNS address] [VERIFY: FirewallDNS secondary DNS address]" ipv4.ignore-auto-dns yes
Image placeholder: screenshot of step 2 on Linux [VERIFY] 3.If you use IPv6, do the same with ipv6.dns and ipv6.ignore-auto-dns yes, using the FirewallDNS IPv6 addresses.
Image placeholder: screenshot of step 3 on Linux [VERIFY] 4.Apply the change: sudo nmcli connection up "<name>".
Image placeholder: screenshot of step 4 on Linux [VERIFY] 5.Optional, for DNS-over-TLS: edit /etc/systemd/resolved.conf and set DNS=[VERIFY: FirewallDNS primary DNS address]#[VERIFY: your personal DoT hostname from the dashboard] and DNSOverTLS=yes.
Image placeholder: screenshot of step 5 on Linux [VERIFY] 6.Restart the resolver: sudo systemctl restart systemd-resolved.
Image placeholder: screenshot of step 6 on Linux [VERIFY] 7.Flush caches: sudo resolvectl flush-caches.
Image placeholder: screenshot of step 7 on Linux [VERIFY]
How to verify it works
- Run resolvectl status and check Current DNS Server.
- Run dig example.com and check the SERVER line (127.0.0.53 means systemd-resolved, which forwards to FirewallDNS).
- Open the query log in your FirewallDNS dashboard and confirm that new lookups from your network appear within a few seconds.
How to revert
- sudo nmcli connection modify "<name>" ipv4.dns "" ipv4.ignore-auto-dns no, then bring the connection up again.
- Remove the DNS and DNSOverTLS lines from /etc/systemd/resolved.conf and restart systemd-resolved.
Troubleshooting
- /etc/resolv.conf keeps changing
- It is managed by systemd-resolved or NetworkManager. Configure those instead of editing the file.
- DoT fails to connect
- Check the hostname after the # sign and that outbound port 853 is allowed.
- Containers use another DNS
- Docker and similar tools may set their own DNS; configure their daemon DNS settings.
FAQ
Does this work on servers?
Yes, but a server's public IP must be registered, and server DNS changes should be tested carefully.
What about distributions without systemd-resolved?
Use NetworkManager or set nameserver lines in /etc/resolv.conf if nothing manages it.
Is DNS-over-TLS required?
No, but it protects lookups on untrusted networks.
Can I use the GUI instead?
Yes, GNOME and KDE network settings let you set DNS servers manually.
How do I check for leaks?
Watch the FirewallDNS query log while browsing; missing lookups suggest another resolver is used.