Topics

Hi, I'm running opnsense 26.7.1_1 as guest on proxmox

Since enabling Unbound DNS in Reporting I've noticed that the device is making a large number of A and AAAA DNS queries against itself (ie. the source is localhost) for whatever mirror is configured in System->Firmware->Mirror

At first I notice that www.mirrorservice.org was no. 1 in the top ten passed domains. When I changed this back to the default it was soon replaced with pkg.opnsense.org

Examining the Reporting->Unbound->Details I see that the device is querying whichever source is configured on average 5 times a second, with ~200k queries for the two mirrors I've had configured in the last 24hrs. The behaviour doesn't change if I select a different firmware mirror.

Example logging:

Code Select Expand

2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. Pass Cache  NOERROR 0ms 487
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 107
2026-08-06 14:50:19 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 487
2026-08-06 14:50:18 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 488
2026-08-06 14:50:18 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 108
2026-08-06 14:50:18 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 488
2026-08-06 14:50:18 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 108
2026-08-06 14:50:17 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 109
2026-08-06 14:50:17 localhost A pkg.opnsense.org. PassCache NOERROR 0ms 109
2026-08-06 14:50:17 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 489
2026-08-06 14:50:17 localhost AAAA pkg.opnsense.org. PassCache NOERROR 0ms 489

This doesn't seem right to me. Is this expected behaviour? It feels like some script to check for updates is stuck in a loop.

I'm running 26.1.11 as VM on proxmox. I've searched the forums and only found people asking specifically about this with respect to Zenarmour reports, and those threads didn't address my issue.

Is it possible to have OPNsense use local hostnames in reports such as Traffic and Unbound DNS?

I have static entries in dnsmasq for all the hosts I care about on my LAN, but the above reports only ever use their IP addresses (v4 and v6).

As I'm using RA to assign v6 addresses I don't expect to see those resolved, but the v4 addresses would be useful.

I'm using the standard Unbound on port 53, forwarding queries for my local domain (osx.ninja) to dnsmasq on 53053. Local name resolution works (i.e. I can ping pdu.osx.ninja and get 192.168.1.6), but I can't get reverse resolution (ie. dig -x 192.168.1.6 returns NXDOMAIN), except for the device itself (dig -x 192.168.1.1 correctly returns opnsense.osx.ninja).

Hi folks, first time poster. I've recently moved to OPNsense (26.1.10, running as a VM on Proxmox) from OpenWrt. The migration went really well for the most part, but there's one thing I can't figure out and would like help with please.

I have a PiHole running on my network (in docker on a different device to OPNsense), and use DHCP Option 6 to tell my clients to use it as their DHCP server, with Unbound on the OPNsense device as the fallback. This was all I had to do on OpenWrt to get all LAN client DNS queries to go via my PiHole and I replicated this in dnsmasq on OPNsense. My IPv6 clients didn't receive an IPv6 DNS server with OpenWrt.

Since moving to OPNsense I noticed that some of my devices had started showing ads again, but saw that PiHole was still serving (some) requests on the LAN.

OPNsense is configuring the IPv6 clients on the LAN to use it's Unbound service for DNS over IPv6, so I added DHCP Option 23 with the Pihole and Unbound servers' IPv6 addresses on dnsmasq hoping that would override whatever default setting was being applied.

My clients are acting on the DHCP Option 6 and configuring the PiHole and OPNsense as their IPv4 DNS servers, but ignoring the DHCP Option 23, and only configuring the OPNsense device for DNS over IPv6. Both DHCP Options are set to 'Force'.

Consequently:
a) IPv6 enabled devices prefer to use DNS over IPv6, and are only using Unbound on OPNsense (thus bypassing the PiHole)
b) IPv4 only devices are correctly using the PiHole as instructed via DHCP Option 6

I've tried both renewing DHCP leases and restarting my clients with no change in behaviour. I've checked that the PiHole is serving queries over IPv6.

How do I correctly tell my IPv6 clients to use the PiHole server?