Topics

I'm trying to implement the advice from one of my previous posts, but how to do the below?

In Dnsmasq / Domains, create a global override and enter the IP address of the ISP's DNS server.

I tried entering nothing, . or ~., or *. Only * worked.

A value is required.

Labels must be 1–63 characters, start with a letter or digit, and may contain only letters, digits, '-' or '_'.

Is specifying * as the domain the right way to add custom upstream DNS to dnsmasq?

I have dynamic ipv6 host set to the address of my device, but ddclient still updates the record with the router's IP6. Unfortunately because my domain is in porkbun I have to use the ddclient backend.
Is there a way to make dynamic ipv6 host work?

How to set up DNSmasq (or Kea if needed) such that some devices will have a static IPv6 address?
I want most of my devices to use SLAAC (possibly with privacy extension), but for some I want them to have stable static addresses, so that I can register them with a dynamic DNS client. It doesn't matter if they have SLAAC addresses as well.

I could achieve this via DHCP ranges ::1000 ~ ::2000, but that makes all the devices DHCPv6 (Managed).
If I use :: as range, the leases are not offer to the devices, as the M bit in Router Advertisement is 0. Even if I explicitly enable DHCPv6 solicitation in clients, the router does not respond with a reply, even though static leases are present.
Is it possible to somehow only make only those devices do DHCPv6?
Or can I not offer addresses in DHCPv6 except for those devices?

I need to have 2 DNS servers on 2 IPs:

• One for other members of the family, run by DNSmasq forwarding to ISP DNS servers, which are very fast, but have no DNSSEC support and probably have some poisoning (e.g. Tiktok videos doesn't load unless they use the other DNS).
• One for myself and OPNsense, run by dnscrypt-proxy with DNSSEC support but has higher latency, which is unacceptable for others (web page opens too slowly).

It needs to be on another IP and standard port due to DHCP option and NetworkManager's nm-dns-systemd-resolved plugin not supporting port (tested).
What's the best way to approach this problem? Is there a way to augment ISP's DNS answers so that we can use just 1 server with DNSSEC enabled? (I'm guessing no...)

Currently I have a virtual IP 192.168.1.53 with "Deny service binding" for dnscrypt-proxy to listen on (plus 127.0.0.1), and DNSmasq is on "port 53" (so the wildcard address 0.0.0.0). However, sometimes when I switch off the VPN on my laptop, I get DNS reply without RRsig as if it's from DNSmasq instead dnscrypt-proxy, but packet cap shows it's indeed from the virtual IP. I don't know if it's an OS bug or if DNSmasq is fighting with dnscrypt-proxy for the virtual IP.
Unbound (instead of DNSmasq) just refuses to start or produce any log if dnscrypt-proxy is listening on 192.168.1.53.

Is there a way to fix ISP's DNS poisoning? For NO-DATA I can add dnscrypt-proxy to system DNS so DNSmasq forwards to it as well, for fake IP I'm guessing no...
Is there a way to not have ISP's DHCP DNS in OPNsense's system DNS but still let DNSmasq forward to them?

The timezone in dashboard is always GMT-08 no matter what I set in System - Settings - General - Timezone. How to fix it?

When packet capturing my WAN physical interface, I saw Router Advertisements from my router, even though I have set interface to LAN in Dnsmasq (both General - Default and DHCP ranges). How to fix this?

My WAN interface is PPPoE for IPv4 and DHCPv6 for IPv6 on igb1 (I packet captured igb1). The igb1 port is connected to the ISP ONU in bridge mode. However the ONU is also plugged into my switch (with a LAN port) because the modem also has AP functionality. The ONU port that connected to igb1 is bound to the bridge mode connection.

p.s. Although I don't remember this happening in 25.7, I now suspect the bridge port was not excluded from LAN during ISP configuration. I'll reply to this post if I manage to get the modem's admin account.

When I refresh the WAN connection in Interfaces - Overview, sometimes Router Solicitation is not sent, which caused the router to have no IPv6 address for itself. Why and can I fix this somehow?

My ISP expects routers to configure its address with SLAAC and request prefix through DHCPv6-PD, no address can requested via DHCPv6 or the gateway will reply with an error with no prefix given. The gateway also sends Router Advertisement very infrequently but responds to Router Solicitation.