Hello Howard,
I do not think there is simple way to make it working. It should help if
you configure forwarding per internal-only domains, which would always
target internal VPN server. For general domains, it would forward
everything to 9.9.9.9.
We have made dnsconfd project [1] to configure unbound from Network
Manager. One of things it should do is split tunelling, which I think
you need here. I doubt pfSense would have UI for configuration of
subdomain forwarders, but I do not know it. If you can configure your
additional unbound snippets in console, then it might work.
if you could have config file with:
forward-zone:
name: example.com
forward-addr: 10.255.255.2
and repeated for all zones having special content in your VPN, then you
could put just 9.9.9.9 into DNS general settings.
Hope this helps.
Petr
1. https://github.com/InfrastructureServices/dnsconfd
On 29/03/2024 22:22, Howard Spindel via Unbound-users wrote:
I have unbound configured under pfSense+ on a Netgate 8200. I also
have a Wireguard VPN configured under pfSense.
I have DNS forwarding configured under pfSense/DNS Resolver/General
Settings. That caused unbound to forward to the two DNS server
configured under pfSense General Setup. The two DNS servers I have
configured there are 10.255.255.2 (the DNS server recommended by my
VPN provider) and 9.9.9.9 (Quad 9 public server).
What I want is that when the VPN is up for unbound to forward solely
to 10.255.255.2 and for unbound to fall back to using 9.9.9.9 only
when the VPN is down.
What happens now, is that unbound is free to choose either DNS server,
and therefore sometimes chooses 9.9.9.9 when the VPN is up. When the
VPN is down now, I presume that unbound still tries to forward to
10.255.255.2 but since that is not a routable address when the VPN is
down the lookup will fail and unbound will use 9.9.9.9 instead.
Is there a way to tell unbound to use 10.255.255.2 if and only if the
VPN is up? I can't find it.
Thank you.
Howard
--
Petr Menšík
Software Engineer, RHEL
Red Hat, https://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB
