eduroam and DNS encryption - authenticaiton issues

[knods3k]

Hello folks!

I'm aware this might not be the ideal place to ask this, but I'm expecting you people to be infinitely more competent than the IT support at my university, so I'm asking here.

Naturally, eduroam doesn't like encrypted DNS. But I do. So I would like to have some clean workaround to allow eduroam do its authentication shenanigans and then let me encrypt my DNS traffic once the authentication succeeded.

My Ideas are as follows:

1. Try to get hold of the addresses needed for authentication and then introduce forwarding rules. (Unsure if I there's a way to do this on my own, or if that requires ITs collaboration)

2. Write a script that sets DNS to 127.0.0.1:53 once I'm on the www and resets it to "empty" once I'm disconnected.
   (Not sure how to do this without wasting unreasonable amounts of compute/bandwitdh)

Is there anyone here who has found a neat way to work around networks requiring DHCP and the like?

I'm on macOS and barely literate when it comes to the technicalities of the internet.

All the best and thanks in advance :)

[dodmi]

• You may try to use forward rules, that forward to the "DHCP DNS"
  https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Forwarding#forwarding-to-the-default-local-dns-server
• You can find out, which names to forward by enabling the query log, and see, what your computer tries to resolve on connecting to the network:
  https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Logging#query-log

But I don't know how eduroam works and this will lead to success.

[knods3k]

good to know that forwarding to DHCP is an option, thanks for that :)