Messages

That is just how it works and has nothing to do with any bug or something. You also don't seem to know much about DNS, Unbound or Dnsmasq, you are just brute-forcing some guides over another.

It is by design that it escapes the VPN tunnel and leaks your IP address to do the lookups? Interesting design decision.

Dnsmasq settings are:
DNSSEC: Checked

My Unbound settings are:
Enable DNSSEC Support: Checked

When you use Unbound as the Upstream DNS Provider it will do the DNSSEC stuff for you so there is no need to Enable it in your DNSmasqd config ;)

It shouldn't hurt to have it enabled in both so I did it just in case I switch my configuration up later.

So I just figured out how to make Unbound my primary DNS resolver and Dnsmasq just for DHCP and can confirm that the moment I uncheck my DNS over TLS entry for my upstream provider in Unbound, making it recursive, my IP is leaked. Re-checking solves the leak.

Actually I'm not sure why it didn't work when I first tested it - setting an Override in Unbound is working correctly now. 🥳

Thank you for the help everyone!

Thank you for the help! I followed the guide, ignoring guest.internal and just following the steps for lan.internal. Especially the tip about `If all PTR records for 192.168.0.0/16 should be handled by Dnsmasq, creating a single entry with 168.192.in-addr.arpa is enough.` helped. It seems to have worked, super painlessly! I thought I'd have to reconfigure my DHCP and IP reservations but it all reconnected as it was before and I can see device names in my Unbound stats as I was hoping!

The only snag being that I had a host setup in Dnsmasq to make the url tipi.lan work on my network, pointing to a local server, and that seems to no longer work after the transition. I tried setting an Override for it in Unbound but it also still doesn't work. I also tried setting a rule for it in Query Forwarding the same way I did for `168.192.in-addr.arpa` hoping it would forward the request to Dnsmasq and work like before but that also didn't work. What's the proper way to go about this?

https://docs.opnsense.org/manual/dnsmasq.html#configuration-examples

Are `lan.internal` and 'guest.internal' standard variable names for lan traffic or is that something I have to setup separately or if I've never done anything with those names can I just ignore that part? I just want DNS resolution in Unbound and DHCP in Dnsmasq, that isn't necessary for that right?

I migrated my config from the deprecated old DHCP and currently have Dnsmasq as my primary DNS on port 53 and Unbound as the upstream provider on port 53053. To my understanding, the new default config is Unbound as the primary and Dnsmasq just used for DHCP. I think I would rather this setup but when I try making Unbound the primary, my network breaks and DHCP stops working. I just want to restart my DNS and DHCP settings to the new default but have had difficulty finding references for the actual default settings. Does anyone have them that they can post or know of a way that I can just reset my Unbound and Dnsmasq settings to factory default and not my whole config? Thank you.

As a sidenote, I feel like having the default settings somewhere like as a third column on this page would be really helpful for when you bork something up https://docs.opnsense.org/manual/unbound.html

I've been wracking my brain getting things working and today I was able to at least get Dnsmasq DNS resolution to work on all of my devices with a 3rd party upstream DNS service, whether they are included in the Wireguard VPN or not. This is great so that my overrides are respected. However still, the moment I try to use Unbound as my upstream provider for Dnsmasq my public IP is leaked. My setup isn't as similar to the linked post as I thought so I will describe it in more detail here.

I use https://mullvad.net/en/check to check and when using Dnsmasq, it says there's a "leak" but I confirm that the servers listed are my 3rd party service's and not my public IP. However the real leak is confirmed on this page when using Unbound.

My general setup is a Wireguard VPN - I use Mullvad and made sure to go through the steps to get an address without DNS hijacking. I just discovered this today so this was probably why my VPN devices weren't using the local DNS settings. https://schnerring.net/blog/use-custom-dns-servers-with-mullvad-and-any-wireguard-client/

I just nuked most of my legacy configs and followed the Wireguard Road Warrior for Mullvad guide https://docs.opnsense.org/manual/how-tos/wireguard-client-mullvad.html

I have every device routed through the VPN except one, excluded in the VPN hosts alias, which I run a VPN app on so that I can change the servers more fluidly.

I have Dnsmasq listening on port 53 and use the Domains tab to point it to my preferred 3rd party DNS resolver. In System > Settings > General, I cleared out the DNS servers list and have `Allow DNS server list to be overridden by DHCP/PPP on WAN ` unchecked. Dnsmasq settings are:
Interface: LAN, VPN
DNSSEC: Checked
No hosts lookup: Unchecked
Do not forward to system defined DNS servers: Checked (To ensure that my rules in Domains are respected)

When trying to get Unbound working, I have it listening on port 53053. I replace the rule in Dnsmasq's Domains tab with one pointing to 127.0.0.1 on port 53053 with the * wildcard as the domain. Looking at the Unbound statistics, the queries appear to be correctly forwarded. The issue being that my public IP is being leaked by Unbound now. My Unbound settings are:
Network Interfaces: LAN
Enable DNSSEC Support: Checked
Outgoing Network Interfaces: VPN
Overrides: None
Advanced:
Hide Identity: Checked
Hide Version: Checked
Blocklists: AdGuard List and Ads Blocklist
Query Forwarding: None, and `Use System Nameservers` unchecked.

Does anything stick out that would cause leaked DNS requests? I also tried making a firewall rule to block DNS requests outside of the VPN but I already have a VPN Killswitch rule that I believe should cover it so I'm not sure how the public IP is being leaked.
The full table of my firewall rules is:
enabled   statetype   sequence   action   quick   interfacenot   interface   direction   ipprotocol   protocol   source_net   source_not   source_port   destination_net   destination_not   destination_port   gateway   allowopts   tag   tagged   description
1   keep   51   pass   1   0   lan   in   inet   any   Mullvad_Default_Hosts   0      RFC1918_Networks   1      VPN_Default   0   NO_WAN_EGRESS      From Wireguard Road Warrior
1   keep   26   reject   1   0   lan   in   inet   any   Internet_Blocked_Devices   0      lan   1         0         Block internet for specific devices
1   keep   351   pass   1   0   lan   in   inet   any   lan   0      any   0         0         Default allow LAN to any rule
1   keep   401   pass   1   0   lan   in   inet6   any   lan   0      any   0         0         Default allow LAN IPv6 to any rule
1   keep   501   pass   0   0      out   inet   any   opt1ip   0      opt1   1         1         From Wireguard Road Warrior
1   keep   88   block   1   0   wan   out   inet   any   any   0      any   0         0      NO_WAN_EGRESS   Kill Switch From Wireguard Road Warrior

According to this longstanding bug, you have to either choose using your VPN's DNS and not having options for local overrides or use Unbound's recursive DNS resolution and leak your public IP address. I was wondering if any recent developments might have made a best of both worlds where I can use Unbound for recursive DNS and have its requests routed through my Wireguard VPN so that my public IP isn't leaked.

I have successfully gotten Dnsmasq to use the upstream DNS providers I choose but the moment I forward the requests to Unbound, my public IP is leaked. Setting firewall rules and setting the `Outgoing Network Interfaces` to be my VPN interface does not help.

@marunjar there is a known bug where you cannot have a Wireguard VPN setup and use Unbound DNS without DNS leaks: https://github.com/opnsense/core/issues/7679

Thankfully I found that to save myself further headaches.

Unbound is a dns resolver and don't need any upstream dns.
see https://docs.opnsense.org/manual/unbound.html, you can even find someting about query forwarding and dns over tls there.

System > Settings > General is a little different, see https://docs.opnsense.org/manual/settingsmenu.html#general

If you chose mullvad instead of unbound this is totally fine, but as you found out it will bypass unbound depending on your settings.
To use unbound you don't need any dns server in general settings, just uncheck `Allow DNS server list to be overridden by DHCP/PPP on WAN` and uncheck `Do not use the local DNS service as a nameserver for this system`, thats it basically.
Or if you prefer check `Do not use the local DNS service as a nameserver for this system` and add 127.0.0.1 to servers explicitely.

Query forwarding or DoT should then be configured under services > unbound itself IMO.

I tried removing any DNS servers from Settings: General since the IP address you said to use was invalid and I now have DNS leaks where my IP address is revealed through DNS because it is resolving queries on its own I assume.

So to use Unbound as my local DNS resolver and Mullvad DNS as my upstream provider (to not have DNS leaks), you are saying that I should configure DNS over TLS in Unbound settings rather than Settings: General? I can give that a shot but I just want to make sure I am understanding you correctly.

@marunjar actually 127.0.0.1 is not a valid option for my DNS servers. It errors: You can not assign a gateway to DNS server "127.0.0.1" which is on a directly connected network. So that solution would not work even if that was the issue unfortunately.

Unbound is a dns resolver and don't need any upstream dns.
see https://docs.opnsense.org/manual/unbound.html, you can even find someting about query forwarding and dns over tls there.

System > Settings > General is a little different, see https://docs.opnsense.org/manual/settingsmenu.html#general

If you chose mullvad instead of unbound this is totally fine, but as you found out it will bypass unbound depending on your settings.
To use unbound you don't need any dns server in general settings, just uncheck `Allow DNS server list to be overridden by DHCP/PPP on WAN` and uncheck `Do not use the local DNS service as a nameserver for this system`, thats it basically.
Or if you prefer check `Do not use the local DNS service as a nameserver for this system` and add 127.0.0.1 to servers explicitely.

Query forwarding or DoT should then be configured under services > unbound itself IMO.

Hello, both of those settings have already been disabled as shown in my long list of settings (#'s 4 and 5). DISABLED means unchecked. So I guess my upstream provider isn't even being used which I might reconsider since I like the multiple layers of blocking.

And that must not be related to my issue then.

In System > Settings > General I have my upstream DNS server configured

This may be cause of your problem.
Why do you set any dns servers if you want unbound to be used?

Having set `Do not use the local DNS service as a nameserver for this system` is fine, but as long as you want unbound (aka the local DNS service) to be used you have to add 127.0.0.1 explicitely as your dns server then.

If you wanna force all dns request to your firewall, even if client wants to use something else, you may think about using nat
https://forum.opnsense.org/index.php?topic=9245.0

As far as I understand it, Unbound needs an upstream DNS server to get records from. Then it caches the results it gets and future lookups that it already has cached are served from Unbound instead of querying the upstream provider.

Edit: I see that you can choose to not do this. I believe I chose this to benefit from multiple layers of Ad/Tracker blocking. The upstream provider I chose has their own list of Ad and tracker records to block and I'm not concerned with Mullvad seeing the first time I request something. I use them as one of my VPN providers anyways so I inherently have to trust them. I have ad and tracker block lists setup with uBlock as well in my browser so I haven't actually seen a request come through yet that was blocked but I like having multiple layers in case one fails or isn't complete as another.

The one thing I would be concerned with that I hadn't thought of is if these upstream requests need to be configured to use DNS over TLS or not. My assumption for my use case was no because every device should be routed through a VPN in my setup. I have the whole router wireguard VPN setup for all of my devices except one. The exception is my PC which I use for gaming so I like to swap VPN servers more frequently on to reduce ping or change servers so it instead has a VPN client on it configured with a kill switch and "lockdown mode" where the VPN has to be connected to be able to reach the internet. I assumed this would protect my DNS lookups. Please let me know if this assumption is incorrect.

I can see that Unbound is working for the one device that it does work on because the "Source" for the records is listed as "Recursion" and "Cache" so the fact that it works in this case but not for my VPN makes me think that it is a different cause.

I will try the linked guide tomorrow though to see if it helps - thank you for the lead!

Referring back to https://docs.opnsense.org/manual/how-tos/wireguard-client.html

They say, "Peers can be generated using the new peer generator feature under VPN ‣ WireGuard ‣ Peer generator. If using the peer generator and require Unbound DNS to serve names, fill the DNS server with the tunnel address (eg 10.10.10.1 )."

I attempted this because there is no DNS section for a peer and it seems that the generator simply puts the DNS address you specify into the "Allowed IPs" field of a peer. My VPN already has me specify 0.0.0.0/0 which I believe includes every possible IP address from CIDR notation so this has no effect in my situation.