DNS over TLS

[mika]

Hello there,

actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.

[meyergru]

Your question is waaaay too unspecific. It still goes over port 53 - "it" meaning what, exactly?

What type of DNS service do your clients use? Unbound, DNSmasq, OpenDNS, Bind or something else? How do you know that they do not use something else despite you sending them OpnSense's IP via DHCP, like 8.8.8.8?

Aside from your clients, does your OpnSense itself use upstream or configured servers?

You know, DNS is not as easy as it used to be these days.

[tangofan]

I also disabled the DNS server options.

In addition to what @meyergru said, I also suggest to be a bit more specific about the statement above, that is where did you change what exactly?

[(MARLOO)]

Hello there,

actually till now I didn't pay much attention to the security of DNS, as FF is securing it through HTTPS already. But I wanted to configure Opnsense, so that it would work as a Resolver but also look up at specific DNS over TLS for unknown addresses, but it kinda still goes over Port 53 and is not using the specified DNS's. I don't know why, as I also disabled the DNS server options.

Here's the official OPNsense documentation for Unbound DNS:

https://docs.opnsense.org/manual/unbound.html

Add your DoT servers under Services → Unbound DNS → DNS over TLS. For a catch-all entry, leave the Domain field empty and use port 853.

Do not enable Forwarding Mode if you want Unbound to use only those DoT servers: it can make Unbound use the system DNS servers on port 53 instead.

Also disable Use System Nameservers, leave the DNS servers under System → Settings → General empty, and disable "Allow DNS server list to be overridden by DHCP/PPP on WAN".

Traffic on port 53 between clients and OPNsense is normal, since Unbound listens there. Use Packet Capture to check whether port 53 traffic is going from OPNsense or a client directly to an external DNS server.

[turipriv]

Also, a  DNAT rule may help redirect your clients to your DNS server if they ever try to reach an external service.

[(MARLOO)]

Also, a  DNAT rule may help redirect your clients to your DNS server if they ever try to reach an external service.

Yes, a LAN DNAT/port-forward rule redirecting outbound TCP/UDP port 53 to 127.0.0.1:53 is a good addition. It prevents clients from bypassing Unbound by querying external DNS servers directly.

Note that it will not catch clients using DNS-over-HTTPS or DNS-over-TLS directly, such as browsers with secure DNS enabled.

[nero355]

Note that it will not catch clients using DNS-over-HTTPS or DNS-over-TLS directly, such as browsers with secure DNS enabled.

Just had my first victim of blocking DoT via Port 853 UDP/TCP the other day : I was very proud of my OPNsense that day! ^_^

[(MARLOO)]

Just had my first victim of blocking DoT via Port 853 UDP/TCP the other day : I was very proud of my OPNsense that day! ^_^

The pure joy of watching my toy firewall reject a packet on 853. Truly the highlight of my day.