HOWTO - DNS Security / Unbound DNS with DNSCrypt, DoH Plugin for IPv4 + IPv6

[Nekromantik]

does this replace using stubby?

[p1n0ck10]

does this replace using stubby?

stubby uses DoT and dnscrypt-proxy uses DNSCrypt or DoH and optional DNSBL. difficult to say what is better. depend of privat/business yousecase. i think DoH for client <-> resolver requests and DoT for server <-> resolver requests. DNSCrypt seems not so populate but has more privacy features. you don't can use both for the same ports. only with different and then you must handle the request from the clients. i like the option from dnscypt-proxy to use an own serverlist from trusted server and it always use the fastest. DoH seems to be the fastest way because existing technologies and knowledge for https requests can be used for this. loadbalancer, haproxies, not blocked ports...
with an cronjob on opnsense you can restart the service from dnscrypt-proxy every 15min or 30min and it use the fastest server again. for me a good combination. all can be configured over the gui. Not necessary to install packages over cli.
If you use the firewall only for you and you are the only admin thats ok to configure the firewall with custom configurations if you know what you do.
If you use the firewall for customers/other admins or only not familiar with deep firewall knowledge its diffcult to handle custom options and manual installations of packages. stability, troubleshooting. some configs over gui. some over cli... not really supportet and so on...

but this is only my experience ;-)

[Nekromantik]

thanks

[chain]

How to redirect all traffic to forward traffic to Unbound DNS/DNSCrypt  Current I have rule that

Interface LAN
Protocol TCP/UDP
Source LAN Net
Destination ANY
Destination port range DNS.

Or is related to the article that you have posted that would work with HOWTO - Redirect all DNS Requests to Opnsense injunction with you current article?
thanks

[p1n0ck10]

How to redirect all traffic to forward traffic to Unbound DNS/DNSCrypt  Current I have rule that

Interface LAN
Protocol TCP/UDP
Source LAN Net
Destination ANY
Destination port range DNS.

Or is related to the article that you have posted that would work with HOWTO - Redirect all DNS Requests to Opnsense injunction with you current article?
thanks

It is good explained in the HOWTO - Redirect all DNS Requests to Opnsense. It is only a recommendation and they are not dependent to each other. It should be a NAT Rule => "Firewall/NAT/Port Forward" and destination is "invert" + "Local Firewall Address" that means if your clients uses not the local firewall address for unencrypted dns (Port 53) it redirects the request to opnsense. If some clients in your network uses encrypted dns it would not apply.

I think you have a normal rule that is not correct...

[chain]

So the rule should look like this that I have include

[miroco]

I found these posts useful.

https://forum.opnsense.org/index.php?topic=5593.0
https://forum.opnsense.org/index.php?topic=9245.0

[xpendable]

Hello,

I just finished setting up DNScrypt-proxy on OPNsense with unbound following the provided guide, and it works great with the exception of not being able to verify DoH is enabled through cloudflare's site for example. Most likely because it knows nothing about the local DNS setup and how it's being routed through OPNsense. However I see that a local DoH server can be setup via DNScrypt-proxy: https://github.com/DNSCrypt/dnscrypt-proxy/wiki/Local-DoH

I've taken a look at the dnscrypt-proxy.toml configuration file located in /usr/local/etc/dnscrypt-proxy, however there is no section called local_doh. I assume that any changes via the OPNsense GUI would overwrite any changes done manually via the config file? Perhaps an update to the os-dnscrypt-proxy plugin could be made to allow this configuration through the GUI?

EDIT: I missed this part in the wiki near the bottom (don't pay attention to the "Secure DNS" column, the green mark will only be shown when using Cloudflare). So I guess that check will never work unless pointing to cloudflare directly, but I suppose this would be the local solution in order to enable ESNI in Firefox when using DoH. Which may be debatable on it's current usefullness due to it's lack of implementation.

[Exinus]

Install DNSCrypt-Proxy:
System/Firmware/Plugins
=> Install "os-dnscrypt-proxy"

is the plugin discontinued?
For me trying to use on OPNsense 2.1.9 the plugin (os-dnscrypt-proxy) is missing on the plugin list.

[mimugmail]

i386?

[Exinus]

yes sure i386, but that shouldn't be a problem.

Version 18.7 still had the plugin in the i386 pepository
http://mirror.wjcomms.co.uk/opnsense/FreeBSD:11:i386/18.7/latest/Latest/

So it is apparently feasible in terms of programming?

[mimugmail]

I think it depends on Go which is now unsupported in i386

[Bytechanger]

You can also add an alias 127.0.0.8 and listen dnscrypt to this IP with port 53. Will also work ...

How Do I do this for IPv6 please?

Virtual IP for ::8 ??

Greets

Byte

[mimugmail]

::1

[Bytechanger]

::1

I doesn´t understand this.

127.0.0.1 doesn´t  work, because unbound dns ist listen to Port 53.
So I set 127.0.0.8 as virtual IP and listen do Port 53.

So ::1 doesn´t work, because unbound DNS listen to Port 53,
so I need another virtual IP for listen to Port 53.
e.g. ::8 Port 53


Greets

Byte