dnssec_return_status: GETDNS_EXTENSION_TRUE
server:forward-zone: name: "." # Allow all DNS queries forward-addr: 192.168.7.11@8053 ## ( Your One Main LAN Address )## END OF ENTRY
trying to get this to work with nextdns or blockerdns, but although stubby runs, when I try to dig the server to test it I get "WARNING: recursion requested but not available".Running latest production 20.1.5.Any help would be appreciated.
Thank you for this big update on how to install unbound + stubby on opnsense.I am a satisfied user of these 2 softwares for about a year now.I have got a few questions for you. I hope you will have the time to answer a few of them.1) I have seen that you have enable the DNSSEC extension in Stubby.We can see it in the stubby.yml files:Quotednssec_return_status: GETDNS_EXTENSION_TRUEIf you have already activated the DNSSEC validation in unbound, don't you think that it is useless to activate it in stubby?I have enabled DNSSEC only in unbound and everything is fine.Unbound is making all the stuff about the dns queries. I am using stubby only to send the dns queries from unbound with DoT or DoH to several servers.2) I will try your new settings with the main LAN Address instead of the localhost address. What is exactly the pro of this new settings ?3)With the new plugin unbound-plus we will soon not have access anymore to the "custom options" in unbound GUI.Where can we then specify the following to transfer the dns queries from unbound to stubby?Quoteserver:forward-zone: name: "." # Allow all DNS queries forward-addr: 192.168.7.11@8053 ## ( Your One Main LAN Address )## END OF ENTRYThanks again for all the help provided on the install of stubby on opnsense.
Quote from: mrancier on April 29, 2020, 01:32:45 amtrying to get this to work with nextdns or blockerdns, but although stubby runs, when I try to dig the server to test it I get "WARNING: recursion requested but not available".Running latest production 20.1.5.Any help would be appreciated.Dear mrancier,Hello and I hope that you are both safe and well. Forgive me for not getting back to you earlier. My main router is OpenWRT and I use both nextdns and blockerdns. I just ran the dig commands for both of these with no issues. Now - to be transparent, I am running getdns stubby and unbound on localhost ( 127.0.0.1 ) on my OpenWRT router. So try changing to that setup and test it ( you know troubleshooting ). Here below for how to : https://forum.opnsense.org/index.php?PHPSESSID=k6ivse7g94849ga6nk9r8kg9g5&topic=13487.0The other possibility could involve how you are configuring blockerdns and nextdns respectively. See here for nextdns demo and illustration : https://nextdns.io/ - Click on " Try It Now For Free "you must append your own prefix to the DNS OVER TLS endpoint ( see this entry at the very bottom of the page ) :DNS-over-TLSPrepend the name to the provided domain (the name should only contain a-z, A-Z, 0-9 and -). Use -- for spaces.For "John Router", you would use John--Router-f7fc55.dns.nextdns.io as your DNS-over-TLS endpoint.That may solve your issue on nextdns. As for blockerdns - Tambe recently changed his IP addresses - use the following command line entry to determine them for yourself:dig +short abcdefgh.blockerdns.com ( where abcdefgh is your blockerdns "username" ) see here : https://blockerdns.com/overview read the section here :Do I get a username and/or password to use blockerDNS? How do you know I'm actually a user if all I'm doing is putting in a DNS server in my settings?If you're accessing our service via DNS over TLS or DNS over HTTPS, the way we handle authentication is by giving you a unique URL to put as your setting. It'll be something like asdfghjkl.blockerdns.com. The first portion is what serves as your "username".You must be careful and precise when entering server - address_data: tls_auth_name: and value: for SPKI key - hope this helps and stay safe
