Unbound forwarding local FQDN

[tbk49]

I have two sites each with an OPNsense box communicating over IPSec VTI so LAN hosts can communicate. Each fw uses its own local FQDN for hosts so when an IP is leased through DHCP, they get a "host1.mysite.s1.internal" or "host1.mysite.s2.internal" depending on which LAN they're on (s1 vs s2) FQDN.

What I do at each site is I intercept port 53 traffic from LAN, re-route it to localhost for unbound, and I set up query forwarding in unbound so that if the lookup is for an internal FQDN, unbound will forwards to port 53053 for DHCP server to resolve. This is done per the docs with a destination NAT rule redirecting the traffic.

Would somebody walk me through how do I resolve FQDNs of hosts on the other end of the IPSec tunnel?

What I've tried so far is to put an entry in query forwarding table for the other site's FQDN, but I'm not sure what fw rules are needed or the config on the other end.

[Bob.Dig]

and I set up query forwarding in unbound so that if the lookup is for an internal FQDN, unbound will forwards to port 53053 for DHCP server to resolve.

Is that really in the docs? This part looks weird to me.

[tbk49]

and I set up query forwarding in unbound so that if the lookup is for an internal FQDN, unbound will forwards to port 53053 for DHCP server to resolve.

Is that really in the docs? This part looks weird to me.

https://docs.opnsense.org/manual/unbound.html#query-forwarding
https://docs.opnsense.org/manual/dnsmasq.html

What I'm currently seeing is that my DNS query from one site is indeed forwarded to the other end (tcpdump showing the traffic on enc0), but there is no response. I've tried fiddling with the firewall rules, but maybe I'm missing something else.

This looks like my situation: https://forum.opnsense.org/index.php?topic=48004.0

If I do:

`drill -4 host1.mysite.s2.internal` from s2, I get a successful response.
`host -4 host1.mysite.s2.interenal` from s2, I get a successful response.

`drill -4 host1.mysite.s2.internal` from s1, I get "not found: 3(NXDOMAIN)".
`host -4 host1.mysite.s2.interenal` from s1, sometimes I get "network error" other times I get a successful but empty record back.

I have made sure there is a domain entry for mysite.s2.internal on s2 under Services | Dnsmasq | Domains

[nero355]

and I set up query forwarding in unbound so that if the lookup is for an internal FQDN, unbound will forwards to port 53053 for DHCP DNSmasqd's DNS server part to resolve.

Is that really in the docs? This part looks weird to me.

There... I fixed it! ;)