Topics

Hello.
I have just built my first proper router and firewall with opnsense, replacing a router running DD-WRT.
This is an introduction and request for friendly assistance.
I am familiar with linux and freebsd but not with the subsystems OPNSense uses. I am on a learning curve.

My goal is to have functionally the setup I had before, sending LAN clients for their DNS lookups to a pi-hole, which in turn sends the allowed queries onward to the router, which in turn uses getdns stubby to go to public TLS enabled resolvers for DNSoverTLS.

I am introducing the parts one by one and testing instead of all at once. Currently I want to get stubby and unbound to work, leaving pi-hole out. The pi-hole ip is 192.168.5.154

My problem appears as soon as I change unbound for the setup.

I have read and followed the various posts on this subject on this forum but either I am missing a step or OPSense has changed enough since they were written that I need to start from scratch.

I am using OPNSense version OPNsense 21.1.5-amd64. The host is a PC Engines APU4D2.
The steps so far taken:
1. Install getdns stubby by pkg install on OPNSense. The version is getdns-1.5.2_4. The router ip is static 192.168.5.160
It is configured to run on 127.0.0.1@8053 with only two upstream resolvers until the setup is working. The config is this:

Code Select Expand


root@OPNsense:/usr/local/etc/stubby # cat /usr/local/etc/stubby/stubby.yml

resolution_type: GETDNS_RESOLUTION_STUB

dns_transport_list:
  - GETDNS_TRANSPORT_TLS

tls_authentication: GETDNS_AUTHENTICATION_REQUIRED

tls_query_padding_blocksize: 128

edns_client_subnet_private : 1

round_robin_upstreams: 0

idle_timeout: 10000

tls_ca_path: "/etc/ssl/"

tls_cipher_list: "EECDH+AESGCM:EECDH+CHACHA20"

tls_ciphersuites: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"

tls_min_version: GETDNS_TLS1_2

tls_max_version: GETDNS_TLS1_3

listen_addresses:
  - 127.0.0.1@8053
#  - 0::1@8053

dnssec: GETDNS_EXTENSION_TRUE

appdata_dir: "/var/cache/stubby"

tls_ca_file: "/usr/local/share/certs/ca-root-nss.crt"

upstream_recursive_servers:

  - address_data: 9.9.9.9
    tls_auth_name: "dns.quad9.net"
    tls_port: 853

  - address_data: 1.1.1.1
    tls_auth_name: "cloudflare-dns.com"
    tls_port: 853



2. Pi-hole is not running a DHCP server. It is set to use a single upstream DNS server with the router ip of 192.168.5.160 . It is listening only on its eth0 interface. There are no other interfaces configured. It is a amd64 virtual machine on an ESXi host. It's IP address is 192.168.5.154

3, On OPNSense:
3..1 On " System: Settings: General" > Networking > DNS servers: I have set 127.0.0.1. "DNS server options" I have none selected, none ticked.
3.2 On " Services: Unbound DNS: General" :
- Enable Unbound is ticked.
- Network interfaces I have both LAN and WAN selected. I don't have an option of ALL.
- DHCP registration is ticked
- DHCP static mappings is ticked

In this setup my LAN clients are getting their DNS server allocation from DHCP pointing them to 192.168.5.160. The OPNSense router is resolving DNS for them as a "normal" setup.

As soon as I enable these additional options in Unbound, my LAN clients fail to get their DNS queries resolved:
server:

Code Select Expand

do-not-query-localhost: no
forward-zone:
name: "."
forward-addr: 192.168.5.160@8053
I have tried setting these too but they seemed to cause Unbound to fail to start.
#forward-tls-upstream: yes
#logservfail: yes

Unfortunately with no logging available on stubby I'm really stumped on where/how to see where the failure occurs.

Can I ask for some pointers to start my investigation please.