Adult and Child DNS resolver in OPNSENSE.

[pasha-19]

I have been researching creating multiple DNS resolvers one for adults and one for children. 

If DNSmasq:53053 without forwarding provides local DNS and DHCP services for multiple vlans both IPv4 and IPv6.  DNSmasq:53053 is DNATed and has FW Rules for all DNS queries with an IPv6 source address as the local ONLY DNS resolver (my ISP is IPv4 only). 

Unbound is the adult DNS resolver (IPv4 source addresses); query forwarding to DNSmasq to all local dns resolution and DOT to quad9 for forward resolution of external resources.  DNAT and FW Rules enforce this currently.

Child DNS services can be provided using DNScrypt-proxy and DOH.  I have been looking for a DOT solution for the Child DNS services, too. 

In what seem to be circular possibilities OPNSENSE is reported to have supported multiple Unbound instances in the past and no longer apparently.  OPNSENSE also supported Stubby at one time and Unbound forwarding to Stubby for external DOT queries also appear to have been supported in the past.  Documentation indicates that Stubby with parallel design choices to Unbound can support query forwarding for local domains (to DNSmasq:53053) and DOT resolution using CleanBrowsing servers for children.  Both sets of filtered dns servers could also be replaced by CloudFlare servers  (1.1.1.2/... and 1.1.1.3/... respectively. 

QUESTION:  In the old code base for OPNSENSE or maybe as a community plugin would it be reasonable for Stubby to be supported as a very similar alternative to Unbound when one wishes to create a second DNS resolver for support of a second distinct set of users (children in this case)?  Multiple Unbound instances is also a desirable possibility.

[OPNenthu]

Do you specifically need different upstream resolvers?

One solution since you already have VLANs is to set up blocklist policies in Unbound (Unbound DNS->Blocklists).  Separate resolvers or DNS servers aren't needed if you are just wanting per-VLAN filtering.

The kids can circumvent your DNS blocks via e.g. browser or OS network settings.  You probably already know but worth mentioning.

[Patrick M. Hausen]

I suggest you investigate AdGuard Home. Runs well as a plugin on OPNsense and allows to manage per client policies directly in the AGH management UI.