# OPNsense DNS Architecture
Last updated: 2026-05-28 Status: Active
## Overview
Two DNS services run on OPNsense:
- Unbound — primary resolver on port 53, handles all external DNS with DNSSEC, DoT upstreams - dnsmasq — local DHCP and host resolution on port 5353, handles `kaburu.lan` records
Unbound forwards `kaburu.lan` queries to dnsmasq on 127.0.0.1:5353, so all devices get a single DNS server (OPNsense at 192.168.0.1) for both local and external resolution.
## Unbound Configuration
| Setting | Value |
| — | — |
| Port | 53 |
| Interface | All (listens on all, outgoing locked to Mullvad) |
| DNSSEC | Enabled |
| Outgoing interface | Mullvad_VPN (opt5) |
| regdhcp | Enabled |
| regdhcpstatic | Enabled |
| regdhcpdomain | kaburu.lan |
### Upstream Resolvers (DoT) — Active
| UUID | Name | Server | Port | Verify |
| — | — | — | — | — |
| 48000e06 | Mullvad DNS TLS 1 | 193.138.218.74 | 853 | adblock.dns.mullvad.net |
| 09060f42 | Mullvad DNS TLS 2 | 194.242.2.2 | 853 | adblock.dns.mullvad.net |
### Upstream Resolvers — Disabled
| UUID | Name | Server | Reason |
| — | — | — | — |
| d53fa713 | Cloudflare DoT | 1.1.1.1 | DNS leak — Cloudflare IPs appeared on mullvad.net/check |
| 8da39e2d | Quad9 DoT | 9.9.9.9 | DNS leak |
| 76093144 | Cloudflare Forward | 1.1.1.1 | DNS leak |
| 08dd7e77 | Quad9 Forward | 9.9.9.9 | DNS leak |
### Query Forwarding
| Domain | Server | Port |
| — | — | — |
| kaburu.lan | 127.0.0.1 | 5353 |
## dnsmasq Configuration
| Setting | Value |
| — | — |
| DNS port | 5353 (not on port 53) |
| Interface | LAN |
| Domain | kaburu.lan |
| regdhcp | Enabled |
| regdhcpstatic | Enabled |
| DNSSEC | Disabled (Unbound handles this) |
| no_resolv | Enabled (does not use upstream resolvers) |
## Local Domain
All local hosts resolve under `kaburu.lan` — e.g. `kaburuaibox.kaburu.lan`
Host records are managed in dnsmasq under Services → Dnsmasq DNS → Hosts.
## Key Host Records
| Hostname | IP | Description |
| — | — | — |
| kaburuaibox | 192.168.0.253 | HP Z840 AI Server |
| TrueNAS | 192.168.0.251 | TrueNAS MicroServer Gen8 |
| TrueNAS-1gb-1 | 192.168.0.200 | TrueNAS port 1 |
| TrueNAS-1gb-2 | 192.168.0.201 | TrueNAS port 2 |
| KABURU-UM790-MAIN | 192.168.0.143 | UM790 Pro mini PC |
| KaburuLINK | 192.168.0.250 | Unraid box |
| homeassistant | 192.168.0.123 | Home Assistant |
| ILOCZ162000TP | 192.168.0.155 | HP Z840 iLO4 port |
| keeplink-sw | 192.168.0.10 | KeepLink KP-9000 switch |
| eap653-01 | 192.168.0.101 | TP-Link EAP653 AP1 |
| eap653-02 | 192.168.0.100 | TP-Link EAP653 AP2 |
| eap110-outdoor | 192.168.0.102 | TP-Link EAP110 Outdoor AP |
## VLANs
| VLAN | Interface | DHCP Range | Domain |
| — | — | — | — |
| LAN | lan | 192.168.0.51–250 | kaburu.lan |
| CamerasVLAN | opt7 | 192.168.20.10–100 | kaburu.lan |
| IOTVlan | opt8 | 192.168.30.10–100 | kaburu.lan |
## Change Log
### 2026-05-28 — DNS Leak Fix
Problem: mullvad.net/check showed DNS requests leaking via Cloudflare (172.70.88.163, 172.70.88.164 and IPv6 equivalents) despite VPN being active.
Root cause: Cloudflare and Quad9 DoT/Forward entries were enabled in Unbound. Even with outgoing_interface set to Mullvad (opt5), these upstream resolvers were resolving outside the VPN tunnel and their IPs appeared in DNS leak tests.
Fix: - Disabled all 4 Cloudflare/Quad9 DoT and Forward entries in Unbound - Enabled both Mullvad DoT entries (193.138.218.74 and 194.242.2.2, both verify adblock.dns.mullvad.net) - Config edited directly via SSH: `perl -i -0pe` on `/conf/config.xml` - Unbound reconfigured via API - Pre-change backup saved to `/conf/config.xml.bak-20260528-prednsfix` on OPNsense
### 2026-05-17 — DNS Architecture Refactor
- Unbound bound to LAN interface only (was listening on all interfaces) - regdhcp and regdhcpstatic enabled on Unbound - dnsmasq moved from port 53 to port 5353 - Unbound query forward added for kaburu.lan → 127.0.0.1:5353 - This resolves the issue where dnsmasq host records were not visible to Unbound
### 2026-05-28 — DoH Browser Leak Fix
Problem: After fixing Unbound upstreams, mullvad.net/check still showed Cloudflare IPs (172.69.193.x) leaking. These are Cloudflare's DNS-over-HTTPS resolver IPs, not plain DNS. The browser (Brave) was bypassing OPNsense entirely and sending DoH queries directly to Cloudflare port 443 over the VPN.
Root cause: Brave and other modern browsers have built-in encrypted DNS (DoH) configured to Cloudflare/Google by default. This traffic goes to port 443 so it's indistinguishable from HTTPS — it bypasses any DNS server the OS/router sets.
Fix — two firewall rules added to LAN (top of ruleset, quick):
| UUID | Rule | Interface | Proto | Destination | Port | Action |
| — | — | — | — | — | — | — |
| b1000001 | Block DoH providers | LAN | tcp/udp | DoH_Block alias | 443 | block |
| b1000002 | Block rogue plain DNS | LAN | tcp/udp | !192.168.0.1 | 53 | block |
DoH_Block alias (uuid: a1b2c3d4-0000-0000-0000-doh000000001): - 1.1.1.1, 1.0.0.1 (Cloudflare) - 8.8.8.8, 8.8.4.4 (Google) - 9.9.9.9, 149.112.112.112 (Quad9) - 208.67.222.222, 208.67.220.220 (OpenDNS) - 94.140.14.14, 94.140.15.15 (AdGuard)
Result: All three green on mullvad.net/check — Using Mullvad VPN / No DNS leaks / No WebRTC leaks. Confirmed 2026-05-28.
Also: Brave “Use secure DNS” setting disabled in browser settings (Settings → Privacy → Security → Use secure DNS → off). Belt and braces — the firewall block rules handle any device that has it on, but disabling in-browser is cleaner where possible.
Note: The plain-DNS redirect rule (rule b1000002) also prevents any device from using a hardcoded DNS server (e.g. 8.8.8.8 in network settings).