Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Problem with DNS over TLS

    Scheduled Pinned Locked Moved DHCP and DNS
    28 Posts 5 Posters 3.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pietsnot56
      last edited by

      The dns settings in the “general setup” are ok.
      I have tested several times with and without the custom settings. Only “with” allows me to browsing on the internet.
      As far i can see all the rest seems working correcty : lookup, 1.1.1.1/ help, ect.
      I don’t understand that your settings doesn’t working on my firewall. ???

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @pietsnot56
        last edited by johnpoz

        @pietsnot56 the gui settings do what your doing in custom..

        So I again set this back with simple click.. And then look in my unbound.conf

        cat /var/unbound/unbound.conf

        And you will see this

        # Forwarding
forward-zone:
        name: "."
        forward-tls-upstream: yes
        forward-addr: 1.1.1.1@853#cloudflare-dns.com
        forward-addr: 1.0.0.1@853#cloudflare-dns.com

        then I undo the check marks and it is gone.

        while what your doing is doing the same thing really - it makes no sense that you would have to use the custom options to get those settings into your unbound.conf file

        You really should be setting the name, or your not actually going to verify your talking to clouldflare.. Are you not doing that with custom?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • P
          pietsnot56
          last edited by

          Hi,

          Version 2.6.0-RELEASE (amd64)
          built on Mon Jan 31 19:57:53 UTC 2022
          FreeBSD 12.3-STABLE

          The system is on the latest version.
          Version information updated at Sat Jan 21 14:35:40 -01 2023

          DNS Server Settings in General setup
          DNS Servers
          1.1.1.1
          cloudfare-dns.com
          1.0.0.1
          cloudfare-dns.com
          .......
          DNS Resolution Behavior

          Use local DNS (127.0.0.1), ignore remote DNS Servers

          A) Config file

          1 ) this is what i have with the "custom settings on" in the config file.

          Domain overrides

          include: /var/unbound/domainoverrides.conf

          Forwarding

          forward-zone:
          name: "."
          forward-tls-upstream: yes
          forward-addr: 1.1.1.1@853#cloudfare-dns.com
          forward-addr: 1.0.0.1@853#cloudfare-dns.com

          Unbound custom options

          server:
          private-domain:"plex.direct"
          forward-zone:
          name:"."
          forward-ssl-upstream: yes
          forward-addr: 1.1.1.1@853
          forward-addr: 1.0.0.1@853
          server:include: /var/unbound/pfb_dnsbl.*conf

          1. by erasing the custom settings:

          Domain overrides

          include: /var/unbound/domainoverrides.conf

          Forwarding

          forward-zone:
          name: "."
          forward-tls-upstream: yes
          forward-addr: 1.1.1.1@853#cloudfare-dns.com
          forward-addr: 1.0.0.1@853#cloudfare-dns.com

          Unbound custom options

          server:
          private-domain:"plex.direct"
          server:include: /var/unbound/pfb_dnsbl.*conf

          3 ) by unchecking "use SSL/TLS for outgoing..."

          Domain overrides

          include: /var/unbound/domainoverrides.conf

          Forwarding

          forward-zone:
          name: "."
          forward-addr: 1.1.1.1
          forward-addr: 1.0.0.1

          B) error file with Use SSL/TLS for outgoing DNS Queries to Forwarding Servers checked on and without custm settings.
          IP6 ????

          Can this help you to expain?

          ##########################

          Unbound Configuration

          ##########################

          Server configuration

          server:

          chroot: /var/unbound
          username: "unbound"
          directory: "/var/unbound"
          pidfile: "/var/run/unbound.pid"
          use-syslog: yes
          port: 53
          verbosity: 1
          hide-identity: yes
          hide-version: yes
          harden-glue: yes
          do-ip4: yes
          do-ip6: yes
          do-udp: yes
          do-tcp: yes
          do-daemonize: yes
          module-config: "iterator"
          unwanted-reply-threshold: 0
          num-queries-per-thread: 4096
          jostle-timeout: 200
          infra-host-ttl: 900
          infra-cache-numhosts: 10000
          outgoing-num-tcp: 10
          incoming-num-tcp: 10
          edns-buffer-size: 512
          cache-max-ttl: 86400
          cache-min-ttl: 0
          harden-dnssec-stripped: yes
          msg-cache-size: 4m
          rrset-cache-size: 8m

          num-threads: 4
          msg-cache-slabs: 4
          rrset-cache-slabs: 4
          infra-cache-slabs: 4
          key-cache-slabs: 4
          outgoing-range: 4096
          #so-rcvbuf: 4m

          prefetch: no
          prefetch-key: no
          use-caps-for-id: no
          serve-expired: no
          aggressive-nsec: no

          Statistics

          Unbound Statistics

          statistics-interval: 0
          extended-statistics: yes
          statistics-cumulative: yes

          TLS Configuration

          tls-cert-bundle: "/etc/ssl/cert.pem"
          tls-port: 853
          tls-service-pem: "/var/unbound/sslcert.crt"
          tls-service-key: "/var/unbound/sslcert.key"

          Interface IP(s) to bind to

          interface-automatic: no
          interface: 0.0.0.0
          interface: 0.0.0.0@853
          interface: ::0
          interface: ::0@853

          Outgoing interfaces to be used

          outgoing-interface: 178.116.127.35

          DNS Rebinding

          For DNS Rebinding prevention

          private-address: 127.0.0.0/8
          private-address: 10.0.0.0/8
          private-address: ::ffff:a00:0/104
          private-address: 172.16.0.0/12
          private-address: ::ffff:ac10:0/108
          private-address: 169.254.0.0/16
          private-address: ::ffff:a9fe:0/112
          private-address: 192.168.0.0/16
          private-address: ::ffff:c0a8:0/112
          private-address: fd00::/8
          private-address: fe80::/10

          Set private domains in case authoritative name server returns a Private IP address

          Access lists

          include: /var/unbound/access_lists.conf

          Static host entries

          include: /var/unbound/host_entries.conf

          dhcp lease entries

          include: /var/unbound/dhcpleases_entries.conf

          Domain overrides

          include: /var/unbound/domainoverrides.conf

          Forwarding

          forward-zone:
          name: "."
          forward-tls-upstream: yes
          forward-addr: 1.1.1.1@853#cloudflare-dns.com
          forward-addr: 1.0.0.1@853#cloudflare-dns.com
          forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
          forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com

          Unbound custom options

          server:include: /var/unbound/pfb_dnsbl.*conf
          server:
          private-domain: "plex.direct"

          Remote Control Config

          include: /var/unbound/remotecontrol.conf

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @pietsnot56
            last edited by johnpoz

            @pietsnot56 said in Problem with DNS over TLS:

            IP6 ????

            Where are you putting in IPv6? I do see it in your output you posted.

            And looks like you have stuff in there twice

            forward-zone:
name: "."
forward-tls-upstream: yes
forward-addr: 1.1.1.1@853#cloudfare-dns.com
forward-addr: 1.0.0.1@853#cloudfare-dns.com
Unbound custom options

server:
private-domain:"plex.direct"
server:include: /var/unbound/pfb_dnsbl.*conf

3 ) by unchecking "use SSL/TLS for outgoing..."
Domain overrides

include: /var/unbound/domainoverrides.conf
Forwarding

forward-zone:
name: "."
forward-addr: 1.1.1.1
forward-addr: 1.0.0.1

            One would be with tls the other would not be.. You got something messed up that is for sure..

            Your info might be easier to read if you used the code option for text so it in specific box vs just long running text..

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • P
              pietsnot56
              last edited by

              @johnpoz said in Problem with DNS over TLS:

              code option for text

              "code option for text"
              how or where can you chose this option?

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @pietsnot56
                last edited by

                @pietsnot56

                text.jpg

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • P
                  pietsnot56
                  last edited by 

                   that's with custom settings on config file

                  ##########################
# Unbound Configuration
##########################

##
# Server configuration
##
server:

chroot: /var/unbound
username: "unbound"
directory: "/var/unbound"
pidfile: "/var/run/unbound.pid"
use-syslog: yes
port: 53
verbosity: 1
hide-identity: yes
hide-version: yes
harden-glue: yes
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
module-config: "iterator"
unwanted-reply-threshold: 0
num-queries-per-thread: 4096
jostle-timeout: 200
infra-host-ttl: 900
infra-cache-numhosts: 10000
outgoing-num-tcp: 10
incoming-num-tcp: 10
edns-buffer-size: 512
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: yes
msg-cache-size: 4m
rrset-cache-size: 8m

num-threads: 4
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
outgoing-range: 4096
#so-rcvbuf: 4m

prefetch: no
prefetch-key: no
use-caps-for-id: no
serve-expired: no
aggressive-nsec: no
# Statistics
# Unbound Statistics
statistics-interval: 0
extended-statistics: yes
statistics-cumulative: yes

# TLS Configuration
tls-cert-bundle: "/etc/ssl/cert.pem"

# Interface IP(s) to bind to
interface-automatic: yes
interface: 0.0.0.0
interface: ::0

# Outgoing interfaces to be used
outgoing-interface: 178.116.127.35

# DNS Rebinding
# For DNS Rebinding prevention
private-address: 127.0.0.0/8
private-address: 10.0.0.0/8
private-address: ::ffff:a00:0/104
private-address: 172.16.0.0/12
private-address: ::ffff:ac10:0/108
private-address: 169.254.0.0/16
private-address: ::ffff:a9fe:0/112
private-address: 192.168.0.0/16
private-address: ::ffff:c0a8:0/112
private-address: fd00::/8
private-address: fe80::/10
# Set private domains in case authoritative name server returns a Private IP address



# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# dhcp lease entries
include: /var/unbound/dhcpleases_entries.conf



# Domain overrides
include: /var/unbound/domainoverrides.conf
# Forwarding
forward-zone:
	name: "."
	forward-tls-upstream: yes
	forward-addr: 1.1.1.1@853#cloudfare-dns.com
	forward-addr: 1.0.0.1@853#cloudfare-dns.com


# Unbound custom options
server:
private-domain:"plex.direct"
forward-zone:
name:"."
forward-ssl-upstream: yes
forward-addr: 1.1.1.1@853
forward-addr: 1.0.0.1@853
server:include: /var/unbound/pfb_dnsbl.*conf


###
# Remote Control Config
###
include: /var/unbound/remotecontrol.conf

                  idem error file``

                  ##########################
# Unbound Configuration
##########################

##
# Server configuration
##
server:

chroot: /var/unbound
username: "unbound"
directory: "/var/unbound"
pidfile: "/var/run/unbound.pid"
use-syslog: yes
port: 53
verbosity: 1
hide-identity: yes
hide-version: yes
harden-glue: yes
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
module-config: "iterator"
unwanted-reply-threshold: 0
num-queries-per-thread: 4096
jostle-timeout: 200
infra-host-ttl: 900
infra-cache-numhosts: 10000
outgoing-num-tcp: 10
incoming-num-tcp: 10
edns-buffer-size: 512
cache-max-ttl: 86400
cache-min-ttl: 0
harden-dnssec-stripped: yes
msg-cache-size: 4m
rrset-cache-size: 8m

num-threads: 4
msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
outgoing-range: 4096
#so-rcvbuf: 4m

prefetch: no
prefetch-key: no
use-caps-for-id: no
serve-expired: no
aggressive-nsec: no
# Statistics
# Unbound Statistics
statistics-interval: 0
extended-statistics: yes
statistics-cumulative: yes

# TLS Configuration
tls-cert-bundle: "/etc/ssl/cert.pem"
tls-port: 853
tls-service-pem: "/var/unbound/sslcert.crt"
tls-service-key: "/var/unbound/sslcert.key"

# Interface IP(s) to bind to
interface-automatic: no
interface: 0.0.0.0
interface: 0.0.0.0@853
interface: ::0
interface: ::0@853

# Outgoing interfaces to be used
outgoing-interface: 178.116.127.35

# DNS Rebinding
# For DNS Rebinding prevention
private-address: 127.0.0.0/8
private-address: 10.0.0.0/8
private-address: ::ffff:a00:0/104
private-address: 172.16.0.0/12
private-address: ::ffff:ac10:0/108
private-address: 169.254.0.0/16
private-address: ::ffff:a9fe:0/112
private-address: 192.168.0.0/16
private-address: ::ffff:c0a8:0/112
private-address: fd00::/8
private-address: fe80::/10
# Set private domains in case authoritative name server returns a Private IP address



# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# dhcp lease entries
include: /var/unbound/dhcpleases_entries.conf



# Domain overrides
include: /var/unbound/domainoverrides.conf
# Forwarding
forward-zone:
	name: "."
	forward-tls-upstream: yes
	forward-addr: 1.1.1.1@853#cloudflare-dns.com
	forward-addr: 1.0.0.1@853#cloudflare-dns.com
	forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
	forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com


# Unbound custom options
server:include: /var/unbound/pfb_dnsbl.*conf
server:
private-domain: "plex.direct"


###
# Remote Control Config
###
include: /var/unbound/remotecontrol.conf

```sometimes 
forward-addr: 1.1.1.1@853#cloudfare-dns.com
with #cloudfare-dns.com at the end

and in the custom settings :
forward-addr: 1.1.1.1@853``
without #cloudfare-dns.com.

can this help us to find the reason?
                  1 Reply Last reply Reply Quote 0
                  • P
                    pietsnot56
                    last edited by

                    Thanks everybody,
                    I founded my error : a typo in the Dnsname!
                    This case can be closed.

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.