Messages

I think I have an answer to my own question:  I must PROPERLY turn on DNSMasq.

Out of the box, his seems to use Unbound for DNS and keeps DNSMasq from answering DNS queries by setting the port to 0.   0 does not mean "default" it means "disable DNS".   I changed it to blank and a message popped up about Unbound using the port so I disabled that and changed DNSMasq's port to blank.   Now it seems to work the same.

I want to replace my home OpenWRT router (on dedicated router hw) with OPNSense (on a generic Intel minipc).  I have setup routing but I want to setup the DHCP and DNS properly.  I thought I could use DNSMasq in OPNSense just like in OpenWRT but it seems OPNSense does not fully support both DHCP and DNS the same way.

On OpenWRT I can define static DHCP assignments and it automatically defines the DNS.  Non-static DHCP automatically does dynamic DNS.    And I can easily create a list of static DNS to be resolved.  I only need to put the base hostname in the list and it adds the domainnames automatically.

On OPNSense I just can't seem to get DNS to work at all.   I add an entry for "laptop" with domain "example.duckdns.org" and using dig from another system I get no responce when I query "laptop.example.duckdns.org" and querying "example.duckdns.org" just gets forwarded to the public DNS, which does respond, but does not have my private entries.  The OPNSense router should be authoritive and supply my private entries.

I have seen mention of setting up the DHCP to do updates to a DNS server (which could be running on the same router), but that seems overkill when DNSMasq seems to be designed to be a complete solution.   Do I have DNSMasq setup wrong on OPNSense?

Or do I need to use the dynamic DNS method?   But if so, how does the DNS stay updated if there has not been a recent DHCP?

For example, with DNSMasq handling it all, I can ping my laptop even if it has not been turned on in days, and I will find out that the name was resolved, but nobody responded to the ping.   With dynamic DNS, the DNS lookup should fail.  Then when I turn on my laptop, after the DHCP is done, the DNS would update, but I won't see it because any other DNS server between would still have to wait for the negative cache timeout.  Linux now has a local, caching server (systemd-resolvd) running on each system and it should honor the negative TTL.  I would be able to ping the laptop by IP, but not by name.

Ideally I could define my static DHCP entries and have it automatically add static DNS, or maybe I need to check a box.

Bottom line, what is the simplest way to define static DNS for my static DHCP but still have dynamic DNS for dynamic DHCP?