Messages

Well, whatever the cause was, the update to 26.7.2 fixed it ¯\_(ツ)_/¯

Hi, I'm running opnsense 26.7.1_1 as guest on proxmox

Since enabling Unbound DNS in Reporting I've noticed that the device is making a large number of A and AAAA DNS queries against itself (ie. the source is localhost) for whatever mirror is configured in System->Firmware->Mirror

At first I notice that www.mirrorservice.org was no. 1 in the top ten passed domains. When I changed this back to the default it was soon replaced with pkg.opnsense.org

Examining the Reporting->Unbound->Details I see that the device is querying whichever source is configured on average 5 times a second, with ~200k queries for the two mirrors I've had configured in the last 24hrs. The behaviour doesn't change if I select a different firmware mirror.

Example logging:

Code Select Expand

2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. Pass Cache  NOERROR 0ms 487
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:18 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 488
2026-08-06 14:50:18 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 108
2026-08-06 14:50:18 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 488
2026-08-06 14:50:18 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 108
2026-08-06 14:50:17 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 109
2026-08-06 14:50:17 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 109
2026-08-06 14:50:17 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 489
2026-08-06 14:50:17 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 489

This doesn't seem right to me. Is this expected behaviour? It feels like some script to check for updates is stuck in a loop.

I understand that it's nothing to do with proxmox, thanks, but I like to give plenty of detail about the opnsense instance I'm requesting assistance with, as it's traditional to criticise people for not doing so.

As stated, I'm already forwarding requests for osx.ninja to dnsmasq. I'll do the same for 1.168.192.in-addr.arpa

Time passes...

Thanks that worked perfectly! Reverse resolution works, and reporting is now using hostnames👍

I'm running 26.1.11 as VM on proxmox. I've searched the forums and only found people asking specifically about this with respect to Zenarmour reports, and those threads didn't address my issue.

Is it possible to have OPNsense use local hostnames in reports such as Traffic and Unbound DNS?

I have static entries in dnsmasq for all the hosts I care about on my LAN, but the above reports only ever use their IP addresses (v4 and v6).

As I'm using RA to assign v6 addresses I don't expect to see those resolved, but the v4 addresses would be useful.

I'm using the standard Unbound on port 53, forwarding queries for my local domain (osx.ninja) to dnsmasq on 53053. Local name resolution works (i.e. I can ping pdu.osx.ninja and get 192.168.1.6), but I can't get reverse resolution (ie. dig -x 192.168.1.6 returns NXDOMAIN), except for the device itself (dig -x 192.168.1.1 correctly returns opnsense.osx.ninja).

RFC 2132 states that:

Servers SHOULD be listed in order of preference

So yeah, it's down to the client whether or not it respects the preference/order.

I believe macOS, Windows and Linux all respect the order given by the DHCP server, trying them in order, not parallel. I don't know about others, like iOS and Android. My PiHole is an adblocker, for convenience, not for filtering/blocking/censoring any other content, so I'm happy with this.

Thanks for the tips, I now have a system I'm happy with after:
- changing the 'IPv6 Configuration Type' back to 'Identity Association'
- adding a Router Advertisement entry in 'Unmanaged' mode with DNS disabled (you have to enable 'advanced mode' to make this tick box visible)

NB. with DNS enabled, but no DNS servers specified, it still sends out the OPNsense device's IPv6 address as a DNS server. You have to explicitly disable DNS in the RA entry to stop this. Not a helpful default in my case.

My clients are now only receiving the IPv4 addresses for my PiHole and OPNsense Unbound, in that order, and will fallback to the OPNsense server if the PiHole goes away for whatever reason.

Thanks folks, to echo @nero355's response, allowing all clients to query OPNsense, then forwarding those to PiHole breaks my setup in two ways:
- I do client/group specific filter lists on pihole, so need to know who's making the query
- like to have two different DNS servers configured on all clients in case one fails. Pihole has failed a few times for me, so having the DNS service on my router available to clients as a fallback is important to me

Thank you, that's gone some way to explaining a previous problem I had.

When I initially set the OPNsense device up I tried setting my 'LAN IPv6 Configuration Type' to 'Identity Association' (as per some docs I found), but my LAN clients didn't receive an IPv6 configuration. Changing that to 'Track Interface (legacy)' "just worked", so I left it at that. It seems that this automatically configures a DHCPv6/RA for the LAN, and I suspect this ignores any changes made in the dnsmasq settings UI.

I assume, then, that I need to manually configure an RA or DHCPv6 range when using 'Identity Association'? I'll have a detailed read of your article you linked to and have a go at that. Thanks again.

Hi folks, first time poster. I've recently moved to OPNsense (26.1.10, running as a VM on Proxmox) from OpenWrt. The migration went really well for the most part, but there's one thing I can't figure out and would like help with please.

I have a PiHole running on my network (in docker on a different device to OPNsense), and use DHCP Option 6 to tell my clients to use it as their DHCP server, with Unbound on the OPNsense device as the fallback. This was all I had to do on OpenWrt to get all LAN client DNS queries to go via my PiHole and I replicated this in dnsmasq on OPNsense. My IPv6 clients didn't receive an IPv6 DNS server with OpenWrt.

Since moving to OPNsense I noticed that some of my devices had started showing ads again, but saw that PiHole was still serving (some) requests on the LAN.

OPNsense is configuring the IPv6 clients on the LAN to use it's Unbound service for DNS over IPv6, so I added DHCP Option 23 with the Pihole and Unbound servers' IPv6 addresses on dnsmasq hoping that would override whatever default setting was being applied.

My clients are acting on the DHCP Option 6 and configuring the PiHole and OPNsense as their IPv4 DNS servers, but ignoring the DHCP Option 23, and only configuring the OPNsense device for DNS over IPv6. Both DHCP Options are set to 'Force'.

Consequently:
a) IPv6 enabled devices prefer to use DNS over IPv6, and are only using Unbound on OPNsense (thus bypassing the PiHole)
b) IPv4 only devices are correctly using the PiHole as instructed via DHCP Option 6

I've tried both renewing DHCP leases and restarting my clients with no change in behaviour. I've checked that the PiHole is serving queries over IPv6.

How do I correctly tell my IPv6 clients to use the PiHole server?