Messages

[Clients]

why is local dns resolution hard to configure?

It's not :)

why are there so many poorly documented (within the web ui) legacy features that do not explain when to use said legacy feature?

Not sure what you are talking about, but it's mainly a matter of understanding how OPNsense has everything built around Unbound even when you don't use ISC or KEA as the DHCP Server, so everyone using DNSmasqd gets confused easily...

is there a tutorial for opnsense 26.x.x that explains how to setup local dns resolution for unbound+dnsmasq

That is well documented @ https://docs.opnsense.org/

But this part :

so that pihole can see host names?

Is something you will have to figure out yourself by understanding how DNS in OPNsense works :

Clients => DNS Query to Local Gateway IP => Query goes to Unbound @ Port 53 => DNS Records are requested directly from the Root DNS Servers.

This is a problem when you are using DNSmasqd that also does DNS :

Clients => Request for DHCP IP Address => Query goes to DNSmasqd which runs on the Local Gateway IP => DNSmasqd sends the available DHCP IP Address to the Client and registers it's Hostname in it's DNS Database/Cache.

But...

Unbound doesn't know the Hostname of the Client unless you make sure it queries DNSmasqd @ Port 53053 Locally.

So this :

pi hole conditional forwarding has been enabled.

Does not work even when you (Correctly! Mind the syntax !!) ENABLE it and tell Pi-Hole to query the Local Gateway IP for DNS Records => They all go to Unbound and NOT DNSmasqd !!

any leads to help educate me on this matter are appreciated.

IMHO the best you can do is this :

(Personally I would not do this, I would just setup Unbound on the Pi-Hole and direct Pi-Hole to use the local Unbound resolver + then disable Unbound on OPNsense and point OPNsense Clients to Pi-Hole as its their DNS server)

I did the same right after installing OPNsense since I already had https://docs.pi-hole.org/guides/dns/unbound/ running for years! ;)

For Local DNS Resolution I have also been using the Local DNS Records option in Pi-Hole for many years.

But in your case you could change DNSmasqd Port 53053 to Port 53 after disabling Unbound on OPNsense and your Conditional Forwarding in Pi-Hole should then start to work :)

i have figured out how to tell dnsmasq to specify pihole as the dhcp advertised dns server.
so the dns flow is client -> pihole -> opnsense ip as the dns upstream on pihole

That will work, but is IMHO a mess and should not be the desired setup, because then you need to :
- Tell OPNsense Unbound about OPNsense DNSmasqd.
- Tell Pi-Hole that it's OK to send Local DNS Queries to the Upstream DNS Server.



Hope this all works for you as an explanation and if you need more help then let me know :)

this goes leaps and bounds towards my understanding. I very much appreciate you taking the time to post.

i appreciate everyone responding to me. yes I'm new. i am very likely mislead by old information and thus frustrated. i will review your helpful tips here and see what i can do to get my setup working. I particularly appreciate those who are breaking down the flow.

I realized I was dealing with unbound or dnsmasq not talking to each other in some way. so my frustration took over and I decided to post here and take a break.

-takes a deep breath-
-exhales-

why is local dns resolution hard to configure?  why are there so many poorly documented (within the web ui) legacy features that do not explain when to use said legacy feature?

is there a tutorial for opnsense 26.x.x that explains how to setup local dns resolution for unbound+dnsmasq so that pihole can see host names? pi hole conditional forwarding has been enabled.

any leads to help educate me on this matter are appreciated.

i have figured out how to tell dnsmasq to specify pihole as the dhcp advertised dns server.
so the dns flow is client -> pihole -> opnsense ip as the dns upstream on pihole

-inhales-
-exhales-

also got this error. did a health audit and everything checked out ok. be nice if a message like that gave us something to search for in the log.
only thing i noticed was i think it said 8 conflicts in the update log. wonder if that was related.