DNS over TLS

[mika]

Hello there,

actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.

[meyergru]

Your question is waaaay too unspecific. It still goes over port 53 - "it" meaning what, exactly?

What type of DNS service do your clients use? Unbound, DNSmasq, OpenDNS, Bind or something else? How do you know that they do not use something else despite you sending them OpnSense's IP via DHCP, like 8.8.8.8?

Aside from your clients, does your OpnSense itself use upstream or configured servers?

You know, DNS is not as easy as it used to be these days.

[tangofan]

I also disabled the DNS server options.

In addition to what @meyergru said, I also suggest to be a bit more specific about the statement above, that is where did you change what exactly?

[(MARLOO)]

Hello there,

actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.

Here's the official OPNsense documentation for Unbound DNS:

https://docs.opnsense.org/manual/unbound.html

To have Unbound forward unknown queries to specific DNS-over-TLS servers, enable Forwarding Mode under Services → Unbound DNS → General, then add your DoT servers under Services → Unbound DNS → DNS over TLS.

For a catch-all entry, leave the Domain field empty and use port 853. Also make sure Use System Nameservers is disabled, otherwise OPNsense may use the system/DHCP-provided DNS servers instead.

If you still see traffic on port 53, check whether it is coming from your clients directly to external DNS servers, or from OPNsense itself. You can use a packet capture on LAN/WAN to see the source and destination.