local DNS resolution

[daegan_]

-takes a deep breath-
-exhales-

why is local dns resolution hard to configure?  why are there so many poorly documented (within the web ui) legacy features that do not explain when to use said legacy feature?

is there a tutorial for opnsense 26.x.x that explains how to setup local dns resolution for unbound+dnsmasq so that pihole can see host names? pi hole conditional forwarding has been enabled.

any leads to help educate me on this matter are appreciated.

i have figured out how to tell dnsmasq to specify pihole as the dhcp advertised dns server.
so the dns flow is client -> pihole -> opnsense ip as the dns upstream on pihole

-inhales-
-exhales-

[disorganise]

i have figured out how to tell dnsmasq to specify pihole as the dhcp advertised dns server.

Out of interest, was that using the 'set dns-server [6]' option?  Is that because setting it elsewhere failed?

pihole can see host names

in theory, I believe you define the local domain under Unbound DNS -> Query Forwarding and send it to loopback address and the port that DNSMasq is running on (eg, 53053), so unbound takes the query from pihole and passes to dnsmasq which should then resolve.  In practice I can't seem to get it work either.

[Seimus]

The documentation for DNSmasq on OPNsense in my opinion is well made.

So you have a Pihole, and you want the DNS to be handled by Pihole for clients, and to have OPNsense as the upstream for the Pihole itself?
(Personally I would not do this, I would just setup unbound on the pihole and direct Pihole to use the local unbound resolver + then disable unbound on OPN and point OPN to Pihole as its DNS server)

https://docs.opnsense.org/manual/dnsmasq.html#dhcp-settings
DNSmasq > DHCP Settings > DHCP Options > set option dns-server[6] with the IP of the Pihole

In the docs is a DHCP Options table with all the standard used options.

The OPNsense runs by default unbound, there you do not touch it, do not put the IP of Pihole as upstream for the OPNsense Unbound.
If you do, you will create a loop.


Regards,
S.