Messages

Hi there,

Am running into the issue with unbound + wildcard host overrides.

Basically, I want the wildcard domain *.abc.com to be forwarded to 192.168.123.1 where I got a traefik instance running, which serves as a reverse proxy and then routes traffic to internal / external services.

I want my opnsense (opnsense.abc.com) to work with the above rule too.

Problem is, unbound would not start if I set up my opnsense to be part of the abc.com domain in System Settings. Unbound would throw an error

Code Select Expand


error: local-data in redirect zone must reside at top of zone, not at opnsense.abc.com A 192.168.0.1


Id have to point opnsense to a separate domain, e.g. abc.com.arpa .

On the traefik end I would then set up a rule to forward request @ opnsense.abc.com to its IP. It kind of works but opnsense would complain that there's a possible DNS rebinding attack. I'd have to disable the check in system settings.

So sadly right now the set up would only work with a workaround present. My question is - can I set my opnsense to the domain I desire while also enabling the wildcard host overrides rule in unbound?

Thanks!

Ended up adding AGH IP to System settings. I was wary of the warning it may impact "DHCP servers" and all, but we'll see if it indeed breaks stuff.

Hi there,

Just set up opnsense as my main router / FW in a virtualized fashion, and it's working fine, until recently.

Did 2 things today which might have broken opnsense host's own DNS settings - from time to time /etc/resolv.conf would be emptied, leaving no DNS nameservers left. I would have to manually append nameservers to get opnsense's own internet connectivity back.

These 2 things were
- set up Wireguard selective routing over a subnet / VLAN (for a guest SSID), which I think is unlikely
- followed https://windgate.net/setup-adguard-home-opnsense-adblocker/ < this tutorial to set up AGH on one of the VLANs to use Unbound as the sole resolver (higher chance)

What differs from the tutorial is that my AGH instance lives on another VM in Proxmox. Still, it seems to work fine and I followed the tutorial and changed Unbound's listening port. The plan is to hardcode public DNS on other DHCP servers while the main net would use AGH as DNS.

I kind of want to do the same just for opnsense itself, but I don't know if there's an option in WebUI.

Please advise. Thanks!