Messages

I have the same issue.  Plugin will not start AdguardHome at boot, have to start it manually.

Has anybody here been able to successfully configure Wireguard on opnsense to connect to Cloudflare Warp plus pseudo VPN ?  If so, would you kindly share your experience and steps ?  I've generated the necessary WG config with the wgcf script and tried to create the config on the gui , but handshake never happens.  Works on PC and Mac with the same config.  Tried following theMullvad guide (which I've also tried and failed at), but it Di's not work either.  I mean this with all the respect in the world :  those instructions are awful.  They make no sense at all.  And, occasionally, the people in the know answer with what amount a to "sound bites" without context, which does not really help much.  I realize that WG is not the easiest, and that support under BSD for it is timid at the moment, but it would be nice to have a decently documented client config that actually works.  Thanks.

Sweet, thanks.

What is the best way to add custom DOH servers to the dnscrypt-proxy configuration, and make it persistent?

server:
      tls-cert-bundle: "/etc/ssl/cert.pem"

Sorry about the delay.  Life kinda got in the way.  In any case, I meant traditional in the sense that I am not using the extracted certificates from the gateway, which I do have, to do a full bypass, ie., ont to opnsense.
The only other thing I might point to is that at some point within the last upgrade the devs stopped loading the netgraph modules by default, so you have to ensure that you are adding them to your loader.conf or loader.conf.local .

Are you using the original script by aus or the one from MonkWho or others? If you're using the original script and it is working for you = then it's just a matter of seeing why the newer ones aren't working (changed locations for files and binaries perhaps?)

I am using the original script, or rather the last one I downloaded directly from aus's github before it evaporated.

Sorry about the delay.  Life kinda got in the way.  In any case, I meant traditional in the sense that I am not using the extracted certificates from the gateway, which I do have, to do a full bypass, ie., ont to opnsense.
The only other thing I might point to is that at some point within the last upgrade the devs stopped loading the netgraph modules by default, so you have to ensure that you are adding them to your loader.conf or loader.conf.local . 

I successfully upgraded to r1 and then to release, with no issues.  I am using pfatt in traditional mode, not with eap certs, though.

[very bottom of the page]

trying to get this to work with nextdns or blockerdns, but although stubby runs, when I try to dig the server to test it I get  "WARNING: recursion requested but not available".
Running latest production 20.1.5.

Any help would be appreciated.

Dear mrancier,
Hello and I hope that you are both safe and well. Forgive me for not getting back to you earlier. My main router is OpenWRT and I use both nextdns and blockerdns. I just ran the dig commands for both of these with no issues. Now - to be transparent, I am running getdns stubby and unbound on localhost ( 127.0.0.1 ) on my OpenWRT router. So try changing to that setup and test it ( you know troubleshooting ). Here below for how to : https://forum.opnsense.org/index.php?PHPSESSID=k6ivse7g94849ga6nk9r8kg9g5&topic=13487.0

The other possibility could involve how you are configuring blockerdns and nextdns respectively.  See here for nextdns demo and illustration : https://nextdns.io/ - Click on " Try It Now For Free "
you must append your own prefix to the DNS OVER TLS endpoint ( see this entry at the very bottom of the page ) :

DNS-over-TLS
Prepend the name to the provided domain (the name should only contain a-z, A-Z, 0-9 and -). Use -- for spaces.
For "John Router", you would use John--Router-f7fc55.dns.nextdns.io as your DNS-over-TLS endpoint.

That may solve your issue on nextdns. As for blockerdns - Tambe recently changed his IP addresses - use the following command line entry to determine them for yourself:

dig +short abcdefgh.blockerdns.com  ( where abcdefgh is your blockerdns "username" ) see here  : https://blockerdns.com/overview read the section here :

Do I get a username and/or password to use blockerDNS? How do you know I'm actually a user if all I'm doing is putting in a DNS server in my settings?
If you're accessing our service via DNS over TLS or DNS over HTTPS, the way we handle authentication is by giving you a unique URL to put as your setting. It'll be something like asdfghjkl.blockerdns.com. The first portion is what serves as your "username".


You must be careful and precise when entering server - address_data: tls_auth_name: and value: for SPKI key - hope this helps and stay safe

I've setup things in copy/paste fashion from your instructions and it will resolve, exactly, one query correctly and then changes to SERVFAIL.  If I restart stubby it does the same thing :  First query works, every subsequent query fails.  Again, this is with the exact same config you posted, save for the LAN address.  Not sure what is going on.  Any help is, naturally, appreciate it.

What is the syntax for whitelisting domains ?  tried adding one, but it did not seem to work.

Thanks.

Thank you for the reply.  I do know that using the Customs options box is able to work around this issue.  I was hoping to be able to keep the DoT config separate...for OCD reasons.  Thanks, though.

The funny thing is, I sent the exact the same feedback to @mimugmail via Twitter. As the form doesn't accept "#" or hostnames into the field.

At the moment I've workedaround it by modifying the config file directly: (to be honest I don't know if that's persistent across reboots)

Code Select Expand


# cat /var/unbound/etc/dot.conf
server:
  tls-cert-bundle: /etc/ssl/cert.pem
forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 45.90.28.0#xx.dns1.nextdns.io
  forward-addr: 2a07:a8c0::#xx.dns1.nextdns.io
  forward-addr: 45.90.30.0#xx.dns2.nextdns.io
  forward-addr: 2a07:a8c1::#xx.dns2.nextdns.io


Soooo....yeah, it does not survive a reboot...oh well.

The funny thing is, I sent the exact the same feedback to @mimugmail via Twitter. As the form doesn't accept "#" or hostnames into the field.

At the moment I've workedaround it by modifying the config file directly: (to be honest I don't know if that's persistent across reboots)

Code Select Expand


# cat /var/unbound/etc/dot.conf
server:
  tls-cert-bundle: /etc/ssl/cert.pem
forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 45.90.28.0#xx.dns1.nextdns.io
  forward-addr: 2a07:a8c0::#xx.dns1.nextdns.io
  forward-addr: 45.90.30.0#xx.dns2.nextdns.io
  forward-addr: 2a07:a8c1::#xx.dns2.nextdns.io


I figured this would be the case, if momentarily, but I would rather do this then send naked queries or having to use their NexDNS cli client, which is still in its infancy.  Thank you so much.  Hope @migmugmail gets around to adding this functionality to the plugin.

Is there a way to add a hostname to the configuration of DoT servers ?  This is necessary for TLS authentication for NextDNS.io or BlockerDNS.com.  It also enables the ability to configure blacklists and whitelist on NextDNS.io.

trying to get this to work with nextdns or blockerdns, but although stubby runs, when I try to dig the server to test it I get  "WARNING: recursion requested but not available".
Running latest production 20.1.5.

Any help would be appreciated.