Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS over TLS with CloudFlare not working for LAN hosts

    Scheduled Pinned Locked Moved DHCP and DNS
    27 Posts 18 Posters 4.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • demD
      dem
      last edited by

      Good to know, thanks Jim.

      1 Reply Last reply Reply Quote 0
      • T
        T5000
        last edited by

        Doesn't work well, for me anyway. I have DNSBL enabled and my options look like this:

        server:include: /var/unbound/pfb_dnsbl.*conf
        forward-zone:
        name: "."
        forward-ssl-upstream: yes
        forward-addr: 1.1.1.1@853
        forward-addr: 1.0.0.1@853
        

        many websites don't load at all or very slow (some are ok), iOS Appstore won't work either.

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          Cloudflare 's 1.1.1.1 server has been flaky for some people since it launched, try adding a line for 9.9.9.9 instead of 1.1.1.1

          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          1 Reply Last reply Reply Quote 0
          • R
            Ralphys
            last edited by

            @T5000:

            Doesn't work well, for me anyway. I have DNSBL enabled and my options look like this:

            server:include: /var/unbound/pfb_dnsbl.*conf
            forward-zone:
            name: "."
            forward-ssl-upstream: yes
            forward-addr: 1.1.1.1@853
            forward-addr: 1.0.0.1@853
            

            many websites don't load at all or very slow (some are ok), iOS Appstore won't work either.

            Cloudflare 1.1.1.1 and 1.0.0.1 is having issues with TLS atm. A Cloudflare team member mentioned that they will be releasing an update soon to correct it but there is no eta yet.

            Try the following:

            server:
            include: /var/unbound/pfb_dnsbl.*conf
            ssl-upstream: yes
            do-tcp: yes
            forward-zone:
            name: "."
            forward-addr: 9.9.9.9@853
            

            That's Quad9 for the moment… you can reverse back to Cloudflare DNS once the issue has been resolved.

            1 Reply Last reply Reply Quote 0
            • M
              MoonKnight
              last edited by

              Hi,

              Strange, when i use forward-addr: 9.9.9.9@853 is working, but when I change to forward-addr: 1.1.1.1@853 or forward-addr: 1.0.0.1@853 i lose my Internet.

              Any idea?

              Thanks

              --- 24.11 ---
              Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
              Kingston DDR4 2666MHz 16GB ECC
              2 x HyperX Fury SSD 120GB (ZFS-mirror)
              2 x Intel i210 (ports)
              4 x Intel i350 (ports)

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                Cloudflare has a problem with Unbound right now, they are not handling how it sends requests properly with tls. They say it's going to be fixed soon.

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • G
                  gsmornot
                  last edited by

                  @jimp:

                  Cloudflare has a problem with Unbound right now, they are not handling how it sends requests properly with tls. They say it's going to be fixed soon.

                  Read on their Community this morning the update related to Unbound was released overnight. Testing here I still have an issue with 1.1.1.1 but 1.0.0.1 is fine. The issue covered here they created overnight a night ago with Unbound has been addressed though. No errors in my log. Now I just need to looking what is using 1.1.1.1 already.

                  1 Reply Last reply Reply Quote 0
                  • T
                    tnovy
                    last edited by

                    I think they have solved it - it started working for me.

                    1 Reply Last reply Reply Quote 0
                    • NeoDudeN
                      NeoDude
                      last edited by

                      Yep, working for me now too.

                      Home Server "Gandalf":  unRAID Pro 6 | MB**:**  ASUS Z9PE-D8 WS | CPU:  Dual Xeon E5-2670 | RAM:  64GB Crucial PC-1600 ECC

                      1 Reply Last reply Reply Quote 0
                      • R
                        renegade
                        last edited by

                        For me resolution does not work always.
                        I use MultiWAN with failover and it seems that if one gateway is down, resolution hangs.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.