DNS issues since 23.1.6

[Patrick M. Hausen]

@fromUnifi, what if you hard code the interface address of OPNsense in the DHCP settings? The update should not affect DNS per se, but only DHCP picking up the DNS server address automatically. That's why some folks have no problems.

[maclinuxfree]

All people having problems please just set the DNS server in the DHCP settings explicitly and report back. This should help at least for IPv4.

I updated last night and found my computers this morning without DNS servers. After manually adding DNS server in Windows I had working internet again. Then I found this thread!
I can understand OPNsense POV, so for now this is a working solution and I added DNS server on all my different subnets in DHCP configuration.

Working for me, too.

[fromUniFi]

@fromUnifi, what if you hard code the interface address of OPNsense in the DHCP settings? The update should not affect DNS per se, but only DHCP picking up the DNS server address automatically. That's why some folks have no problems.

This works.

Also it turned out there was some IPv6 setting enabled in Unbound. Disabling it and setting everything to use Unbiund seems to be working at the moment.

Thanks!

[Animosity]

I'm with Patrick on this one, similar setup yet simpler:


- AdguardHome installed from Michael's repo and up to date - running on 5353
- Port forward NAT rules on all interfaces directing DNS queries to AdGuardHome
- AdGuardHome handles the DoH/DoT

Running without issues on multiple firewalls for more than 6 months and not affected by any updates so far.

How did you setup the port forward rules? I did a LAN 53 -> 5353 and when I query the IPV4, it tells me a source mismatch.

```
> test.com
;; reply from unexpected source: 192.168.1.1#5353, expected 192.168.1.1#53
;; reply from unexpected source: 192.168.1.1#5353, expected 192.168.1.1#53
;; reply from unexpected source: 192.168.1.1#5353, expected 192.168.1.1#53
```

I assume I'm missing something super easy.

[Patrick M. Hausen]

You need to forward to 127.0.0.1:5353, so the reply packet gets routed through the NAT state engine.

[Animosity]

Sorry if I'm being dense, but that is what I am doing.

I thought the goal was to forward the inbound request to say 192.168.1. 53 to 127.0.0.1 5353 so I get to my AdGuard Home instance.

[Patrick M. Hausen]

I read your post like you were forwarding to 192.168.1.1:5353 - sorry. In that case (127.0.0.1:5353) it should work, IMHO.

[Animosity]

No worries - Thanks as it's confusing me. I'll probably do some more testing in the afternoon once I'm more awake as well

[Taunt9930]

Just quickly checking as all the different configs being discussed (and some with issues not stating their config/setup) is getting confusing!

Am I right to say that the DNS issues only manifest if you're using something for DNS that doesn't correctly register on the port?

So if I'm using Unbound for DNS, with DoT, I should be able to update with no issues? If everything works now on 23.1.5_4 it will work post upgrade? Or do I explicitly have to define the DNS server in the DHCP settings (which would be difficult for ipv6) in 23.1.6?

Thanks.

[Animosity]

Yes, if you are using the default packages, you'll have no issues.

I just removed AdGuard and added the same 2 blocklists I had in AdGuard into Unbound DNSBL and turned on the reporting in Unbound and that really does everything I wanted anyway without another package installed.

[mimugmail]

Just quickly checking as all the different configs being discussed (and some with issues not stating their config/setup) is getting confusing!

Am I right to say that the DNS issues only manifest if you're using something for DNS that doesn't correctly register on the port?

So if I'm using Unbound for DNS, with DoT, I should be able to update with no issues? If everything works now on 23.1.5_4 it will work post upgrade? Or do I explicitly have to define the DNS server in the DHCP settings (which would be difficult for ipv6) in 23.1.6?

Thanks.

Yes, only if you use Adguard and also only if it runs on port 53. I just uploaded a test pkg, maybe next week it will go into stable

[mimugmail]

Some testers around?

https://github.com/opnsense/core/issues/6513#issuecomment-1527740960

[ChrisChros]

After editing /usr/local/etc/pkg/repos/mimugmail.conf and replace /repo/ with /transfer/ only the opnsense update 23.1.6 is listed.
Plugin os-adguardhome-maxit in version 1.9 is not shown, also in the plugin section not.

So a reboot later I was able to install both updates, opnsense and Adguard-plugin. After enabeling the new checkbox it was not working, but a second reboot fix that problem and now its working.

[mimugmail]

Wohoo  :

[mimugmail]

Anyone else able to test?