[solved] Using one interface for Domain Overrides only?

[Bob.Dig]

I have another router behind pfSense. That router has its own domain name. I do query it from pfSense for this domain name via Domain Overrides in the resolver.
But the resolver will also send every DNS query via the interface to that other router, which I don't like.
It seems, I can't block the resolver doing that with firewall rules because you can't block the firewall itself.

What are my options within pfSense?

[Bob.Dig]

I guess I solved it by not allowing pfSense to have internet access on that other router.
So at least those querys won't come back into pfSense on that other router's WAN-interface.

[Gertjan]

@Bob-Dig

Can you specify a different configuration for different interfaces in unbound? ?

[johnpoz]

@Bob-Dig huh?

If I set an IP internally for a domain override for say somedomain.tld, only queries that are for host.somedomain.tld will be sent there - not all other queries.

[Bob.Dig]

@Gertjan @johnpoz Yeah, my guess is, you can do a lot with manual unbound config changes but I am more a GUI-type person.

But if you guys want to hand me the answer on a silver platter, I don't say no.

[Bob.Dig]

@johnpoz said in Using one interface for Domain Overrides only?:

If I set an IP internally for a domain override for say somedomain.tld, only queries that are for host.somedomain.tld will be sent there - not all other queries.

Unbound in pfSense always uses all interfaces (or all that are selected) for upstream querys or what did I miss? My "problem" is that a query also goes through the interface to that other router, then goes out its WAN, which is a LAN of pfSense and so on, I would like to stop this... I kinda did on that other router by not allowing pfSense to have internet access.

[johnpoz]

@Bob-Dig just because all interfaces are set.. it wouldn't send traffic to some internal IP for google.com - unless that internal IP was also a gateway in your routing.

[Bob.Dig]

@johnpoz said in Using one interface for Domain Overrides only?:

it wouldn't send traffic to some internal IP for google.com - unless that internal IP was also a gateway in your routing

Interesting. Right now it is set up as a WAN-type interface. I guess I did it for NAT etc. but I can have that without being a WAN-type interface... Thanks John! Makes sense if I think about it.