Topics

I migrated my config from the deprecated old DHCP and currently have Dnsmasq as my primary DNS on port 53 and Unbound as the upstream provider on port 53053. To my understanding, the new default config is Unbound as the primary and Dnsmasq just used for DHCP. I think I would rather this setup but when I try making Unbound the primary, my network breaks and DHCP stops working. I just want to restart my DNS and DHCP settings to the new default but have had difficulty finding references for the actual default settings. Does anyone have them that they can post or know of a way that I can just reset my Unbound and Dnsmasq settings to factory default and not my whole config? Thank you.

As a sidenote, I feel like having the default settings somewhere like as a third column on this page would be really helpful for when you bork something up https://docs.opnsense.org/manual/unbound.html

According to this longstanding bug, you have to either choose using your VPN's DNS and not having options for local overrides or use Unbound's recursive DNS resolution and leak your public IP address. I was wondering if any recent developments might have made a best of both worlds where I can use Unbound for recursive DNS and have its requests routed through my Wireguard VPN so that my public IP isn't leaked.

I have successfully gotten Dnsmasq to use the upstream DNS providers I choose but the moment I forward the requests to Unbound, my public IP is leaked. Setting firewall rules and setting the `Outgoing Network Interfaces` to be my VPN interface does not help.

Hello, it appears that my Unbound DNS is only being used by the router and not being used by my devices. Looking at `Reporting > Unbound DNS`, the top passed domains are:
1. 3.opnsense.pool.ntp.org. 
5248 (12.13%)

2. 1.opnsense.pool.ntp.org. 
5234 (12.10%)

3. 0.opnsense.pool.ntp.org. 
5225 (12.08%)

4. 3.opnsense.pool.ntp.org.localdomain. 
5221 (12.07%)

5. 2.opnsense.pool.ntp.org. 
5219 (12.06%)

6. 1.opnsense.pool.ntp.org.localdomain. 
5186 (11.99%)

7. 0.opnsense.pool.ntp.org.localdomain. 
5185 (11.98%)

8. 2.opnsense.pool.ntp.org.localdomain. 
5169 (11.95%)

9. forum.opnsense.org. 
465 (1.07%)

10. forum.opnsense.org.localdomain. 
457 (1.06%)

In System > Settings > General I have my upstream DNS server configured. Unbound is enabled. I do have a wireguard VPN setup in Opnsense - is there a special configuration I have to do to get that to use Unbound? All of my troubleshooting has changed nothing. Also my devices are getting the correct DNS server advertised to them - they show my opnsense IP address as the DNS server in network settings and `nslookup` returns `Server: 127.0.0.53  Address: 127.0.0.53#53` so the devices appear to be correctly configured, it is just Opnsense that is not utilizing Unbound correctly.

Edit: Forgot to mention, I made sure that `Allow DNS server list to be overridden by DHCP/PPP on WAN` and `Do not use the local DNS service as a nameserver for this system` are *not* enabled.

Hello, I scoured every resource I could find and they all seem to say the same thing but my firewall rule is not working. I want to block internet access for devices 192.168.86.200-192.168.86.255.

I setup an alias for that IP range. I setup a block rule on the LAN interface with a direction of in and source being my alias. Screenshots of everything are attached.

I made sure that the rule is the top on the list so that another doesn't match first. I also tried setting the block rule to `Single host or Network` and `192.168.86.200/32` as the host in case some how my alias just wasn't catching the device.

In my DHCP leases, the device has a a status of online there and displays the IP address of `192.168.86.200` so the static IP is correctly being set.

I made sure to apply my changes.

Any ideas? Is the fact that I have a wireguard VPN setup interfering with the rules? I thought that the rules would still apply but cannot figure out why the rule is doing nothing.

I have my Wireguard Proton VPN working well with my default config of Coaxial > ISP Modem > ISP Router (Not in bridged mode as other residents use the ISP provided network) > Protectli Vault > My Router.

It's not ideal for me but double NAT isn't as much of an issue as I don't want the devices on the ISP router to interact with my devices and vice versa at all.

I do find it odd though that when testing removing the ISP Router and just plugging the Protectli Vault into the modem, after some rebooting, I get green status dots on all 3 of my gateways including the VPN one, but when checking my IP address on https://ip.me, it shows my real public IP and location rather than the VPN.

Any ideas why this would happen? Seems like odd behaviour to me, especially because I have the killswitch enabled so connections that aren't through my VPN shouldn't be allowed at all and this works correctly when I am plugged into the ISP router. (Confirmed by not having internet for a few days because I had no idea Proton changed the endpoint address on me 🤦)

I got my Protectli Vault setup and have been trying to get ProtonVPN working on it as a whole router VPN. As far as I can tell, I have followed this guide to the letter. I went through it three times with no success - nothing on the network works unless I actually turn on the VPN from a specific device through Proton's app so not how it is supposed to be. Even when I try to check for updates under System > Firmware > Status, I get `No address record found for the selected mirror.` when it was working before all of the VPN shenanigans.

In the VPN: WireGuard: Status dashboard, it says the status is `up` and I have ~200MB sent and ~4GB received I assume from the videos I was watching on a device with my workaround of still using the Proton VPN app. Also reassuringly, under System: Gateways: Configuration and the gateway I made for the VPN, it has a RTT of 140ms, RTTd of 2.1ms, Loss of 0.0%, and Status is a green online plug.

On step 7 of the part two of the guide, I did some inferring as it is a bit vague which is maybe where I went wrong? Before I get more complicated, I just want every device on the network to use the selected VPN by default. With that in mind, I decided to select `Network(s)` from the "Type" dropdown of the alias and for "content", I chose `__lan_network` because I assume that means I am targeting all LAN devices for the alias group to be routed through the VPN. Am I misunderstanding this menu?

This is what my RFC alias looks like:


This is an overview of my Firewall: Rules: LAN page to show that I payed attention to the ordering of the rules:


And my floating rules overview as well:


My outbound NAT rules:


I did follow the instructions for preventing DNS leaks from guide part 1 and enabling the kill switch as well. I'm pretty sure there's a mistake in the kill switch part - it says to edit the firewall rule from step 7 but step 7 was creating an alias so I assumed they were actually referencing the rule from step 8 so I added `NO_WAN_EGRESS` into the "Set local tag" field of my Firewall: Rules: LAN rule that is seen at the top of the list in my second screenshot. I then put the second rule that catches those tagged packets from the bottom of screenshot 3.

Any ideas where I'm going wrong? I tried to include enough context and images to be helpful but not overly detailed - if any deeper screenshots or details are needed for a specific field, please let me know. Thank you!