Adult and Child DNS resolver in OPNSENSE.

[pasha-19]

I have been researching creating multiple DNS resolvers one for adults and one for children. 

If DNSmasq:53053 without forwarding provides local DNS and DHCP services for multiple vlans both IPv4 and IPv6.  DNSmasq:53053 is DNATed and has FW Rules for all DNS queries with an IPv6 source address as the local ONLY DNS resolver (my ISP is IPv4 only). 

Unbound is the adult DNS resolver (IPv4 source addresses); query forwarding to DNSmasq to all local dns resolution and DOT to quad9 for forward resolution of external resources.  DNAT and FW Rules enforce this currently.

Child DNS services can be provided using DNScrypt-proxy and DOH.  I have been looking for a DOT solution for the Child DNS services, too. 

In what seem to be circular possibilities OPNSENSE is reported to have supported multiple Unbound instances in the past and no longer apparently.  OPNSENSE also supported Stubby at one time and Unbound forwarding to Stubby for external DOT queries also appear to have been supported in the past.  Documentation indicates that Stubby with parallel design choices to Unbound can support query forwarding for local domains (to DNSmasq:53053) and DOT resolution using CleanBrowsing servers for children.  Both sets of filtered dns servers could also be replaced by CloudFlare servers  (1.1.1.2/... and 1.1.1.3/... respectively. 

QUESTION:  In the old code base for OPNSENSE or maybe as a community plugin would it be reasonable for Stubby to be supported as a very similar alternative to Unbound when one wishes to create a second DNS resolver for support of a second distinct set of users (children in this case)?  Multiple Unbound instances is also a desirable possibility.

[OPNenthu]

Do you specifically need different upstream resolvers?

One solution since you already have VLANs is to set up blocklist policies in Unbound (Unbound DNS->Blocklists).  Separate resolvers or DNS servers aren't needed if you are just wanting per-VLAN filtering.

The kids can circumvent your DNS blocks via e.g. browser or OS network settings.  You probably already know but worth mentioning.

[Patrick M. Hausen]

I suggest you investigate AdGuard Home. Runs well as a plugin on OPNsense and allows to manage per client policies directly in the AGH management UI.

[cookiemonster]

I still use stubby on OPNSense which I think I documented sometime here. However it was not to have logic to direct queries in different directions. In fact that is news to me that it can do that. Mine use has clients directed to AdgH , which then has Unbound as the upstream resolver. Then Unbound forwards ALL queries to Stubby. Stubby is configured with a few DoT upstream resolvers in round-robin fashion.
In other words the dns selection for clients if I wanted would go on AdGH as Patrick says.

[OPNenthu]

@cookiemonster was there a time when Unbound in OPNsense didn't support multiple DoT resolvers?  I don't remember but I'm curious what stubby is adding in that chain.

[nero355]

multiple DNS resolvers one for adults and one for children.

Pi-Hole + Two different Groups + Different Block Lists per Group = DONE! :)

You can also add https://docs.pi-hole.net/guides/dns/unbound/ to the setup and customize it to your wishes if needed.