local DNS resolution

[daegan_]

-takes a deep breath-
-exhales-

why is local dns resolution hard to configure?  why are there so many poorly documented (within the web ui) legacy features that do not explain when to use said legacy feature?

is there a tutorial for opnsense 26.x.x that explains how to setup local dns resolution for unbound+dnsmasq so that pihole can see host names? pi hole conditional forwarding has been enabled.

any leads to help educate me on this matter are appreciated.

i have figured out how to tell dnsmasq to specify pihole as the dhcp advertised dns server.
so the dns flow is client -> pihole -> opnsense ip as the dns upstream on pihole

-inhales-
-exhales-

[disorganise]

i have figured out how to tell dnsmasq to specify pihole as the dhcp advertised dns server.

Out of interest, was that using the 'set dns-server [6]' option?  Is that because setting it elsewhere failed?

pihole can see host names

in theory, I believe you define the local domain under Unbound DNS -> Query Forwarding and send it to loopback address and the port that DNSMasq is running on (eg, 53053), so unbound takes the query from pihole and passes to dnsmasq which should then resolve.  In practice I can't seem to get it work either.

[Seimus]

The documentation for DNSmasq on OPNsense in my opinion is well made.

So you have a Pihole, and you want the DNS to be handled by Pihole for clients, and to have OPNsense as the upstream for the Pihole itself?
(Personally I would not do this, I would just setup unbound on the pihole and direct Pihole to use the local unbound resolver + then disable unbound on OPN and point OPN to Pihole as its DNS server)

https://docs.opnsense.org/manual/dnsmasq.html#dhcp-settings
DNSmasq > DHCP Settings > DHCP Options > set option dns-server[6] with the IP of the Pihole

In the docs is a DHCP Options table with all the standard used options.

The OPNsense runs by default unbound, there you do not touch it, do not put the IP of Pihole as upstream for the OPNsense Unbound.
If you do, you will create a loop.


Regards,
S.

[nero355]

why is local dns resolution hard to configure?

It's not :)

why are there so many poorly documented (within the web ui) legacy features that do not explain when to use said legacy feature?

Not sure what you are talking about, but it's mainly a matter of understanding how OPNsense has everything built around Unbound even when you don't use ISC or KEA as the DHCP Server, so everyone using DNSmasqd gets confused easily...

is there a tutorial for opnsense 26.x.x that explains how to setup local dns resolution for unbound+dnsmasq

That is well documented @ https://docs.opnsense.org/

But this part :

so that pihole can see host names?

Is something you will have to figure out yourself by understanding how DNS in OPNsense works :

Clients => DNS Query to Local Gateway IP => Query goes to Unbound @ Port 53 => DNS Records are requested directly from the Root DNS Servers.

This is a problem when you are using DNSmasqd that also does DNS :

Clients => Request for DHCP IP Address => Query goes to DNSmasqd which runs on the Local Gateway IP => DNSmasqd sends the available DHCP IP Address to the Client and registers it's Hostname in it's DNS Database/Cache.

But...

Unbound doesn't know the Hostname of the Client unless you make sure it queries DNSmasqd @ Port 53053 Locally.

So this :

pi hole conditional forwarding has been enabled.

Does not work even when you (Correctly! Mind the syntax !!) ENABLE it and tell Pi-Hole to query the Local Gateway IP for DNS Records => They all go to Unbound and NOT DNSmasqd !!

any leads to help educate me on this matter are appreciated.

IMHO the best you can do is this :

(Personally I would not do this, I would just setup Unbound on the Pi-Hole and direct Pi-Hole to use the local Unbound resolver + then disable Unbound on OPNsense and point OPNsense Clients to Pi-Hole as its their DNS server)

I did the same right after installing OPNsense since I already had https://docs.pi-hole.org/guides/dns/unbound/ running for years! ;)

For Local DNS Resolution I have also been using the Local DNS Records option in Pi-Hole for many years.

But in your case you could change DNSmasqd Port 53053 to Port 53 after disabling Unbound on OPNsense and your Conditional Forwarding in Pi-Hole should then start to work :)

i have figured out how to tell dnsmasq to specify pihole as the dhcp advertised dns server.
so the dns flow is client -> pihole -> opnsense ip as the dns upstream on pihole

That will work, but is IMHO a mess and should not be the desired setup, because then you need to :
- Tell OPNsense Unbound about OPNsense DNSmasqd.
- Tell Pi-Hole that it's OK to send Local DNS Queries to the Upstream DNS Server.



Hope this all works for you as an explanation and if you need more help then let me know :)