Expected Behaviour:
I am currently running two Pi-holes—one as the primary DNS and the other as secondary. The setup should work seamlessly with OPNsense managing the firewall and network traffic, allowing all DNS queries to flow through the Pi-holes without interruptions. When connecting to WireGuard, DNS queries should continue to be handled by Pi-hole as expected (NAT Rule, don't have Permit all origins enabled), and Unbound should remain operational without any crashes or failures, even when running speed tests or performing other network-heavy activities.
Actual Behaviour:
At random times, the setup stops working, and logs show SERVFAIL errors occurring with Unbound. Looking into OPNsense firewall logs, traffic is being allowed between the LAN and WAN as expected, but despite this, DNS resolution fails.
One consistent way to trigger the failure is by connecting to WireGuard on any device and running a speed test, which causes Unbound to stop working and DNS queries to fail across the network. Logs also show entries like OK (answered by 127.0.0.1#5335 BOGUS (refused upstream)), with some queries getting answered from cache, and some just slipping through the cracks somehow. The only way to restore functionality is by rebooting OPNsense, and also the piholes.
Steps Tried
- Ran Unbound directly on OPNsense to see if it resolved the issue.
- Verified that NTP times are correctly synced on both OPNsense and the Pi-holes.
- Checked all firewall rules, which seem to be configured correctly.
Config Files
resolv.conf
# Generated by NetworkManager
search home.arpa
nameserver 192.168.1.2
nameserver 192.168.1.3
Unbound Config
server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
logfile: /home/joseph/logs/unbound.log
log-time-ascii: yes
log-queries: yes
log-replies: yes
verbosity: 1
interface: 127.0.0.1
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
do-ip6: no
prefer-ip6: no
harden-glue: yes
harden-dnssec-stripped: yes
use-caps-for-id: no
edns-buffer-size: 1232
prefetch: yes
num-threads: 1
so-rcvbuf: 1m
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
