Zero trust Egress with CoreDNS - can't get it working

[keyser]

I have tried several times now to configure ZTE in CoreDNS, and I can't get it to work.
Version: 26.07-RC - 20260801-1756

I know my CoreDNS basic settings are good, and it's the only DNS service on my pfSense and the default group is configured to forward to 9.9.9.9.
Clients are using it, and their requests are filtered as per my default group settings in CoreDNS (blocks, lists and so on).

But when enabling ZTE and creating the required Firewall rules, I cannot get ANY hits on rules configured with the
"coredns_allow" or "coredns_deny" tags. Is there perhaps a typo in the documentation, and the tag has some capital letters or something?

Is there any way to verify and see the lists CoreDNS creates for each client as they resolve names that are then added to their approved IP list?

[jimp]

I just double checked my reference setup I used when writing the docs and it's all still working as expected, traffic is hitting the expected rules when tagged as allowed or denied.

Make sure the rules match the screenshot and text in the recipe (especially that you used the Tagged field, not Tag and that no rules above those are matching/passing the traffic before they can reach the rules.

[keyser]

@jimp I’ll give it another go, but I’m 99.99% sure I did everything as supposed. The traffic simply passes the two rules that:
1: Allow all (if tagged “coredns_allow”)
2: reject all (if tagges “coredns_deny”)
And then either hits the Internet If I make a general allow rule at the bottom, or gets denied If I leave it to hit the default deny rule.

So it seems no traffic is tagged even though ZTE clearly is enabled, and clients are hitting my CoreDNS instance.
The documentation says once ZTE is enabled all traffic is by default tagged with “coredns_deny” unless it is marked with allow because the client looked up the DNS name.
But no traffic is tagged with “coredns_deny” according to how traffic is evaluated on my rules.

EDIT: It just does not work on my setup. It’s a scratch installed 1537 with no config except enabling CoreDNS and ZTE on LAN. But I cannot get any rule hits on any rules with either of those two tags.

[mr_nets]

Netgate 6100
Version 26.07

It's not working for me either. I followed the procedure, and the traffic isn't hitting the rule at all; the counter always stays at 0. In addition, there's a port forwarding rule that forces traffic on port 53 to 127.0.0.1 to ensure all DNS queries go through CoreDNS. At first, I thought the problem was traffic shaping, so I removed everything, but it's unrelated.

Another point: the CPU usage is very high when I enable the Zero Trust option. I imagine it's because all the traffic is tagged (coredns_allow, coredns_deny). And if I disable Zero Trust, the router becomes completely unstable, and I have no choice but to reboot it.

[mr_nets]

My setup:

WAN:
1xPPPoE

LAN:
1xLAGG link using 2 interfaces (No address set)
8xVLAN set on the LAGG (All network have the DNS set to hit the router )

General setting:
2xIPv4 public DNS server
DNS Resolution Behavior : local, fallback to remote

CoreDNS: , (Unbound Resolver, is disabled)
Port: 53

• Default Group
  2xIPv4 Public DNS
• Example GUEST Group
  2xIPv4 more restrictive public DNS server
• No Fallback

Port Forwarding:
1xRule to redirect all query on port 53 target IP 127.0.0.1

Firewall Rules (Tested on the Guest network) :
1xPass all traffic on port 53 only
1xPass all traffic with the tag cordns_allow in the Tagged box
1xBlock All trafic with the tag cordns_deny