FluxerServer — DNS Control

Dashboard

Real-time view of DNS activity across this node

Query activity

Top blocked domains

Top resolved domains

Top clients

Query types

Cache

Query Log

Every DNS request handled by this node

⬇ Export CSV

Time	Client	Domain	Type	Action	Resolver	ms

Filtering

Ad & tracker blocking, blocklists and custom rules

Blocking enabled

Safe Search

Force safe results on Google, Bing, DuckDuckGo & YouTube

Block lists

Custom blocked domains

One domain per line. Subdomains are blocked too.

hosts / AdGuard / domain-per-line

Allowlist (overrides blocks)

Advanced blocking

Block IPv6 (AAAA)

Force IPv4 — answers AAAA with NODATA

Block HTTPS/SVCB records

Disables Encrypted Client Hello (ECH) discovery

Block WebRTC (STUN/TURN)

Reduces WebRTC IP leaks by blocking common STUN servers

Blocked TLDs (one per line — blocks every domain under them, e.g. ru, zip, xyz)

💡 Git links & remote .txt lists: add them under Block lists above — paste any raw URL (e.g. https://raw.githubusercontent.com/<user>/<repo>/main/list.txt); they're fetched and refreshed automatically.

VPN — IKEv2 / IPsec

Native VPN for iOS, Android, Windows & macOS (strongSwan) — no app needed on Apple/Windows

Server

Enable VPN

Manage IKEv2/IPsec (strongSwan)

Authentication Server host (public hostname/IP)

Client IP pool Push DNS

Pre-shared key

VPN CA

— not generated —

⬇ swanctl.conf ⬇ CA cert

Users (username / password)

Certificate clients

Connect your devices

Apple profile for user

Ad & Tracker Filters

One-click blocking of ad networks, trackers & widgets (Google Ads, Intercom…)

⚠️ About "CSS Bait" tests (ad-banner, adsbox, advert, adsbygoogle…): those check whether a page element is hidden — that's cosmetic filtering, which only a browser content blocker (uBlock Origin / AdGuard extension) can do. A DNS blocker can't hide page elements, so those test rows stay "Not Blocked" with any DNS server. The categories below block the matching ad/tracker domains (the network side), and fully block widget services like Intercom.

Blocked Services

Block apps & sites like YouTube, TikTok, Google with one click

DNS Rewrites

Override any domain with a local answer (hosts-style). Use *.domain for wildcards.

Domain	Type	Answer	TTL	On

Authoritative Nameserver

Host your own DNS zones and records

Cluster & Offloading

Replicate policy and distribute query load across nodes

This node

Node name Cluster shared secret

Auto-replicate config to peers

Push on every change

Offload resolution to peers

Spread upstream load across the cluster

Peers

DNS Lookup

Manually resolve any name — through this server or any resolver

Domain Type Resolver

Custom resolver (ip[:port])

History

No lookups yet this session

Tools

Configuration backup and maintenance

Backup & restore

Download the full configuration, or restore it from a previously exported fluxer.toml / JSON.

⬇ Export config

Maintenance

Settings

Resolver and network configuration

Upstream resolvers

One ip:port per line. Queried in round-robin.

Blocking response

When a domain is blocked, reply with

Network binds restart required

DNS listen address Web interface address

Response cache

Enable caching

Serve repeat queries instantly

Max entries Min TTL (s) Max TTL (s)

🔒 Encrypted DNS (TLS 1.3) — use on phones

Enable DoT & DoH

DNS-over-TLS (Android Private DNS) + DNS-over-HTTPS

Public hostname DoT bind (port 853) DoH/HTTPS bind (port 443)

Certificate (PEM fullchain) Private key (PEM)

TLS 1.3 only

Leave OFF to also support TLS 1.2 for older devices (recommended)

🌍 DNS provider — auto-configure your domain

Manage DNS automatically

Point your hostname at this server & keep it updated

Provider Zone (root domain) Record name

API token Secret API key (Porkbun)

Auto-update (Dynamic DNS)

Re-point to the current public IP every 5 min

Proxied DoH via Cloudflare

Publishes a separate orange-cloud hostname for DoH (443) — hides your origin IP & adds DDoS protection. DoT/plain DNS keep using the direct record.

Proxied DoH hostname

📜 Automatic certificate (ACME / Let's Encrypt)

Request a trusted certificate automatically

DNS-01 challenge via the DNS provider above — no port 80 needed; phones trust it

Contact email Environment Domains (comma-separated; defaults to hostname)

Security

Set an admin password to require login. Leave blank and save to disable auth.

New admin password

🛡️ Bot & flood protection

Enable abuse protection

Per-IP rate limiting for DNS & the web UI

DNS queries/sec per IP DNS burst

Web requests/sec per IP Web burst

Flood traffic above these limits is dropped, and repeated failed logins lock the offending IP out. Tune higher for busy networks.

⏱️ Schedules

Blocklist refresh interval (hours)

OS auto-update every 24h

Run deploy/auto-update.sh on the server to install the systemd timer

🕶️ Client-IP masking

Fake "what is my IP"

Intercepts ipify / ifconfig.me / ip-api & co. and returns a fake IP restart required

Fake IP to report Redirect IP (this server's reachable IP) Responder bind

How it works: IP-check domains resolve to this server, whose responder returns the fake IP. Works for HTTP checkers (ifconfig.me, icanhazip.com, ip-api.com). HTTPS-only checkers will fail the cert check (which also hides the real IP). Needs port 80 open in the firewall.

About

FluxerServer blocks ads & trackers, caches responses, serves authoritative zones & rewrites, enforces Safe Search, exposes a DNS-over-HTTPS endpoint at /dns-query and Prometheus metrics at /metrics, and clusters with offloading. Upstreams may be plain (1.1.1.1:53) or DoH (https://…/dns-query).