OPNsense Forum

English Forums => Tutorials and FAQs => Topic started by: you on January 30, 2021, 01:00:23 pm

Title: (HowTo) Adblocking with recursive pihole-DNS-server incl. local name resolution
Post by: you on January 30, 2021, 01:00:23 pm
Summary

This is how I setup my DNS environment with pihole and OPNsense. With this I achieved the following:

Some additional remarks:


1) Example: Network Setup

2) pi-hole (Example: debian VM, all executed as root)

a) Installation

Check here for details: https://docs.pi-hole.net/main/basic-install/ (https://docs.pi-hole.net/main/basic-install/)

Code: [Select]
curl -sSL https://install.pi-hole.net | bash

b) Prepare pi-hole as recursive DNS server

Check here for details: https://docs.pi-hole.net/guides/dns/unbound/ (https://docs.pi-hole.net/guides/dns/unbound/)

Code: [Select]
apt install unbound
Code: [Select]
nano -w /etc/unbound/unbound.conf.d/pi-hole.conf 

Add the following text to pi-hole.conf (edit the end according to your networks):

Code: [Select]
server: 

    # If no logfile is specified, syslog is used
    # logfile: "/var/log/unbound/unbound.log"
    verbosity: 0

    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes

    # May be set to yes if you have IPv6 connectivity
    do-ip6: no

    # You want to leave this to no unless you have *native* IPv6. With 6to4 and
    # Terredo tunnels your web browser should favor IPv4 for the same reasons
    prefer-ip6: no

    # Use this only when you downloaded the list of primary root servers!
    # If you use the default dns-root-data package, unbound will find it automatically
    #root-hints: "/var/lib/unbound/root.hints"

    # Trust glue only if it is within the server's authority
    harden-glue: yes

    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
    harden-dnssec-stripped: yes

    # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
    # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
    use-caps-for-id: no

    # Reduce EDNS reassembly buffer size.
    # Suggested by the unbound man page to reduce fragmentation reassembly problems
    edns-buffer-size: 1472

    # Perform prefetching of close to expired message cache entries
    # This only applies to domains that have been frequently queried
    prefetch: yes

    # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
    num-threads: 1

    # Ensure kernel buffer is large enough to not lose messages in traffic spikes
    so-rcvbuf: 1m

    # Ensure privacy of local IP ranges
    private-address: 10.10.1.0/24
    private-address: 10.10.10.0/24

Code: [Select]
service unbound restart
Now let's test it:

Code: [Select]
dig pi-hole.net @127.0.0.1 -p 5335
==> Query should succeed. Takes longer first time. Less as of second time, because it's cached by pihole

Code: [Select]
dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335
==> Should output a SERVFAIL

Code: [Select]
dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335
==> Should output NOERROR plus an IP address.


c) pihole DNS Settings 

Edit only what is listed below and leave everything else empty:
and don't forget to save :)


d) Enable Local Name Resolution

Code: [Select]
nano -w /etc/dnsmasq.d/02-custom.conf
And add the following text:

Code: [Select]
server=/local_lan2.domain/10.10.1.1
server=/local_lan.domain/10.10.1.1
server=/10.10.10.in-addr.arpa/10.10.1.1
server=/1.10.10.in-addr.arpa/10.10.1.1

These settings have to be seen in conjunction with Use Conditional Forwarding in pihole's DNS settings. Due to them pihole forwards all queries concerning local devices from itself to pfsense's Unbound DNS (10.10.1.1 in my example). All other requests are either forwarded to corresponding Root-Server or blocked, due to pihole's blacklists.


2) OPNsense

a) Systems / Settings / General

Leave `DNS`empty (that's all  ;))


b) Services / DHCPv4 /  NETWORK

Add pihole IP - 10.10.1.254 as only DNS server and maintain static IP addresses as needed.


c) Services / Unbound DNS / General

Check Register DHCP leases and Register DHCP static mappings to enable local name resolution.



3) Final Tests

a) On any client with internet access

Code: [Select]
ping 8.8.8.8
==> this should confirm you have a working internet connection at all  ;)

Code: [Select]
ping www.google.com
==> this should confirm your DNS setup is working, external addresses are resolved

Code: [Select]
nslookup doubleclick.net
==> should output:

Code: [Select]
    Server: 10.10.1.254
    Address: 10.10.1.254#53

    Name: doubleclick.net
    Address: 0.0.0.0
Address: 0.0.0.0 indicates it has been blocked. If not, check settings.


b) On any client of your internal networks

Check internal name resolution with

Code: [Select]
nslookup 10.10.1.254
==> provides pihole.local_lan.domain (in my example)

Code: [Select]
nslookup pihole.local_lan.domain
==> provides IP 10.10.1.254 (in my example)
Title: Re: (HowTo) Adblocking with recursive pihole-DNS-server incl. local name resolution
Post by: fadern on March 30, 2021, 08:31:36 pm
Hi,

First of all, thank you for this great tutorial.


In section C you are using the wrong port. unbound are listening at 5335 and you are using 5353.
Title: Re: (HowTo) Adblocking with recursive pihole-DNS-server incl. local name resolution
Post by: you on April 07, 2021, 04:08:22 pm
Thanks, corrected :)
Title: Re: (HowTo) Adblocking with recursive pihole-DNS-server incl. local name resolution
Post by: spetrillo on October 21, 2021, 10:45:07 pm
Does this work for devices, like IoT, that have hardcoded DNS servers?
Title: Re: (HowTo) Adblocking with recursive pihole-DNS-server incl. local name resolution
Post by: opnfm on November 17, 2021, 10:51:17 am
Hi,
thanks for your tutorial!
I've got a question regarding the following point of your workflow:
Quote
1) Example: Network Setup

    LAN:     10.10.1.0/24    - local_lan.domain
    LAN2:   10.10.10.0/24  - local_lan2.domain
    sense:  10.10.1.1
    pihole:  10.10.1.254

Beside the subnet ip-ranges you used the names local_lan and local_lan2. What must be inserted here if I use VLANs?
E.g.
vlan1: 10.10.1.0/24
vlan2: 10.10.10.0/24

Would I have to replace local_lan.domain with vlan1.domain?



Thanks and best regards!