Messages

That IPv6-specific error is the big clue here — Unbound trying to reach an IPv6 nameserver for up.railway.app and failing while the direct-to-AT&T-modem path works fine strongly points to broken IPv6 connectivity or DNS resolution specifically inside OPNsense's network, not a blocklist or plugin issue. Worth checking if Unbound has "Prefer IPv4 for outgoing queries" available under Unbound's advanced settings, since forcing it to skip that broken IPv6 path entirely would confirm the theory fast. CrowdSec and the DHCP services are almost certainly red herrings here given the error is happening at the DNS resolution layer itself, pointing straight at Unbound's IPv6 handling.