"Recent posts
#1
26.7 Series / Re: DNS over TLS
Last post by (MARLOO) - Today at 07:49:42 AMQuote from: mika on October 17, 2026, 09:56:10 PMHello there,
actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.
Here's the official OPNsense documentation for Unbound DNS:
https://docs.opnsense.org/manual/unbound.html
To have Unbound forward unknown queries to specific DNS-over-TLS servers, enable Forwarding Mode under Services → Unbound DNS → General, then add your DoT servers under Services → Unbound DNS → DNS over TLS.
For a catch-all entry, leave the Domain field empty and use port 853. Also make sure Use System Nameservers is disabled, otherwise OPNsense may use the system/DHCP-provided DNS servers instead.
If you still see traffic on port 53, check whether it is coming from your clients directly to external DNS servers, or from OPNsense itself. You can use a packet capture on LAN/WAN to see the source and destination.
#2
26.7 Series / Re: SSD drive died - I disable...
Last post by oc - Today at 01:57:26 AMPatrick: na endlich hat es geklappt - danke :)
The disk is filled by zenarmor/elastic. I'll have to further tweak logging. I definitely want the ZA "protection", and would like to be able to take a look at what's happening, but ideally it would store the fresh logs in RAM before flushing them (and I've bumped up space in Reporting Data/Memory Disk Size to 500MB, the maximum permitted).
Update: I have also temporarily stopped ntopng - that one also appears to fill the disk with the timeseries...
The disk is filled by zenarmor/elastic. I'll have to further tweak logging. I definitely want the ZA "protection", and would like to be able to take a look at what's happening, but ideally it would store the fresh logs in RAM before flushing them (and I've bumped up space in Reporting Data/Memory Disk Size to 500MB, the maximum permitted).
Update: I have also temporarily stopped ntopng - that one also appears to fill the disk with the timeseries...
#3
26.7 Series / Re: SSD drive died - I disable...
Last post by Patrick M. Hausen - Today at 12:28:35 AMWie ich geschrieben hatte ...
So findest du, was deine SSD füllt.
Code Select
cd usr
du ... # wieder von vorneSo findest du, was deine SSD füllt.
#4
26.7 Series / Re: SSD drive died - I disable...
Last post by oc - Today at 12:20:48 AMQuote from: Patrick M. Hausen on October 17, 2026, 09:31:17 PM@oc Du hast dasCode Selectcd /
vorher vergessen. Nach deinem Prompt zu urteilen bist du immer noch im Home-Directory /root.
Danke Patrick!
root@OC-OPNsense01:/ # du -sk * | sort -rn | head
2866972 usr
1231306 var
174862 boot
11405 tmp
10852 lib
5799 conf
3372 sbin
2489 etc
929 bin
146 libexec
#5
26.7 Series / Re: DNS over TLS
Last post by tangofan - October 17, 2026, 11:07:57 PMQuote from: mika on October 17, 2026, 09:56:10 PMI also disabled the DNS server options.
In addition to what @meyergru said, I also suggest to be a bit more specific about the statement above, that is where did you change what exactly?
#6
26.7 Series / Re: DNS over TLS
Last post by meyergru - October 17, 2026, 10:21:56 PMYour question is waaaay too unspecific. It still goes over port 53 - "it" meaning what, exactly?
What type of DNS service do your clients use? Unbound, DNSmasq, OpenDNS, Bind or something else? How do you know that they do not use something else despite you sending them OpnSense's IP via DHCP, like 8.8.8.8?
Aside from your clients, does your OpnSense itself use upstream or configured servers?
You know, DNS is not as easy as it used to be these days.
What type of DNS service do your clients use? Unbound, DNSmasq, OpenDNS, Bind or something else? How do you know that they do not use something else despite you sending them OpnSense's IP via DHCP, like 8.8.8.8?
Aside from your clients, does your OpnSense itself use upstream or configured servers?
You know, DNS is not as easy as it used to be these days.
#7
26.7 Series / DNS over TLS
Last post by mika - October 17, 2026, 09:56:10 PMHello there,
actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.
actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.
#8
26.7 Series / Re: os-upnp plugin not working...
Last post by fornax - October 17, 2026, 09:39:04 PMQuote from: AlpAne on October 10, 2026, 09:09:24 PMCan you please post a screenshot of your "Firewall: NAT: Source NAT" rules?Sorry, just saw this. Looks like you already got it sorted, but for anyone who happens on this thread later I posted the setup on my previous thread:
Thanks in advance!
https://forum.opnsense.org/index.php?topic=51973.msg273529#msg273529
#9
26.7 Series / Re: SSD drive died - I disable...
Last post by Patrick M. Hausen - October 17, 2026, 09:31:17 PM@oc Du hast das
vorher vergessen. Nach deinem Prompt zu urteilen bist du immer noch im Home-Directory /root.
Code Select
cd /
vorher vergessen. Nach deinem Prompt zu urteilen bist du immer noch im Home-Directory /root.
#10
26.7 Series / Re: SSD drive died - I disable...
Last post by Monviech (Cedrik) - October 17, 2026, 09:23:20 PMncdu
thats my tool of choice for finding large folders.
thats my tool of choice for finding large folders.
