Redirect DNS: Question.
-
Thanks again for the informative replies!. I think I will go ahead and use BIND. I was hesitant because, I have never used BIND earlier, so there is a learning curve for me.
-
@yogi_en looking at that redmine, it has target set to future. But looking at the output of unbound -V on my test 2.6RC I see this specifically called out
--disable-subnet
unbound -V Version 1.13.2 Configure line: --with-ssl=/usr --with-libexpat=/usr/local --disable-dnscrypt --disable-dnstap --with-libnghttp2 --enable-ecdsa --disable-event-api --enable-gost --with-libevent --with-pyunbound=yes --with-pythonmodule=yes LDFLAGS=-L/usr/local/lib ac_cv_path_SWIG=/usr/local/bin/swig --disable-subnet --disable-tfo-client --disable-tfo-server --with-pthreads --prefix=/usr/local --localstatedir=/var --mandir=/usr/local/man --infodir=/usr/local/share/info/ --build=amd64-portbld-freebsd12.3 Linked libs: libevent 2.1.12-stable (it uses kqueue), OpenSSL 1.1.1l-freebsd 24 Aug 2021 Linked modules: dns64 python respip validator iterator BSD licensed, see LICENSE in source package for details. Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues -
@johnpoz
That means 2.6 will not help me. Thanks for that. -
@yogi_en possible 2.7? that is out in dev version already, but is that redmine you linked too doesn't future version set, prob not.
I would chime in on that redmine if something you would like to see included..
-
For the time being I will go ahead with BIND which should survive the upgrades. Based on my analysis so far BIND already supports EDNS client subnet. I will keep an eye on that redmine.
Another question: Can we run multiple instances of dnsmasq in pfsense on different ports/interfaces?. Looks like this not possible, just want to confirm.
-
@yogi_en no I don't think so, you could run say unbound on port x, and then dnsmasq on port y and then even bind on port z I would think.
Don't forget the control port, 953 I think is both default for bind and unbound.. So one of those needs to be changed as well.
If it was me personally and I wanted to fire up different NS instances or software versions to be used by different things on my network. I would just fire them up on a vm or docker or a pi, etc. Vs trying to get them all to run on pfsense at the same time on different ports.
If you don't have say a nas or something you can run some low power vms on - pi's are cheap, and they sell neat little cluster sort of racks to mount them all together and can provide power to all of them via some usb power strip... I provide power to 4 of them with a little usb power thing from anker that can provide 60w, etc. And then little short usb cables.. All of that can be setup for very low budget.. You could prob even use pi zeros for such lower requirement sort of services..
Something like this for a bunch of pi zeros
-
Thanks. I do have a pi which runs pihole and Unifi Controller. I do have a home assistant server ( along with frigate for camera ) which also runs 24x7. I will see whether I can use any of these devices. My NAS is not on 24x7.
The cluster of pi zeros looks really interesting. Will explore that too.
-
@johnpoz
Another related question.Can I configure dnsmasq in pfsense ( via Advanced Options ) so that different clients uses different DNS servers?. As I understand this is also not possible because DHCP is not done by dnsmasq in pfsense. Is that correct?
-
@yogi_en just set in the dhcp server what dns you want clients to use.
-
-
@MoonKnight when your pihole is on a different vlan then the client you can do that.. But if your client is on the same network as pihole you can run into problems.
But yeah looks to be redirecting, there is no way google knows about pfsense.home.arpa ;) and sure don't think google is going to answer in 5 ms let alone 1 ;)
btw, I am a huge fan of dig on windows that I see your running, 9.16.48 is out ;) so your bit behind there ;)
-
@johnpoz
Hi, thank you very much ;) And thanks for the info around newer Dig version. Just updated :) -
@MoonKnight its sad they are dropping support for dig on windows.. As my work around I just installed wlc on my windows box use that for my day to day dig needs.. This way I can easy use the features and stuff in 9.18 while windows is stuck in the 9.16 line..
user@i9-win:~$ dig
; <<>> DiG 9.18.24-1+ubuntu22.04.1+deb.sury.org+1-Ubuntu <<>>Pretty much just looks like have cmd prompt window open
-
@johnpoz
I was reading about the same, they are dropping support for windows :(
But I do have installed WSL - Ubuntu, but haven't tried it so much. For some reason I still use CMD :) -
@MoonKnight oh I still have my cmd window open all the time.. But I also have the wsl prompt open - I use it for whois multiple times a week for sure..
