Good Morning from my Robotics Lab! This is Shadow_8472 with another short update my progress with my OPNsense firewall. Let\u2019s get started.<\/p>\n\n\n\n
I have done a substantial amount of work with DNS on my home network, but as noted in a previous post, it\u2019s sub-optimal to exclusively manipulate your Domain Name System access from a power-hungry desktop when you sometimes have to ration electricity in your Uninterruptible Power Supply (UPS). I like PiHole\u2019s web interface with all its fancy, moving graphs and charts, but our new firewall, Cerberus, can replicate the functionality I need.<\/p>\n\n\n\n
I primarily use PiHole for DNS ad blocking, but I also explicitly blacklist a few URL\u2019s while hosting local DNS records for servers on my Local Area Network (LAN), though the later is a work in progress.<\/p>\n\n\n\n
OPNsense\u2192Services\u2192Unbound DNS\u2192Blocklist\u2192Type of DNSBL offers a drop-down checkbox menu of block lists. This is in contrast to PiHole\u2192Adlists, which lets you import lists from arbitrary sources (edit the day after posting: OPNsense Unbound does have a URLs of Blocklists field). Either way, it should go without saying that sites and ads only need to be blocked once; it will only slow your DNS service down if given a bunch of redundant lists. From what I remember installing OISD Big onto PiHole, they aggregate several of these lists and remove the duplicates. PiHole also picked up a list named StephenBlack with a comment, \u201cMigrated from \/etc\/pihole\/adlists.list.\u201d It sounds like a system default, but in any case, I found it had stuff not on OISD Big. OPNsense Unbound has the option for it, so it got migrated.<\/p>\n\n\n\n
Migrating singled-out blacklist items was as simple as adding each entry to a comma-separated list (where PiHole wants separate entries). I\u2019m going to wait on migrating my LAN domain names though. I believe I found the place to do it, but ButtonMash isn\u2019t running Caddy to recognize subdomain requests right now.<\/p>\n\n\n\n
One last step was to get into the red gaming router we\u2019ve been using and point its DNS at Cerberus the Firewall. I then pointed its secondary DNS alternative at ButonMash.<\/p>\n\n\n\n
To summarize, we should have the exact same protection as before on a smaller battery footprint and within the firewall\u2019s default attack surface to boot!<\/p>\n\n\n\n
One of my eventual goals is to have my own recursive DNS server, which seeks out an a URL\u2019s authoritative DNS record if it doesn\u2019t have it cached. This will increase privacy, but I haven\u2019t figured it out at a production grade yet. Instead, I looked up the best free and privacy respecting DNS, and so far as I can tell, that\u2019s Cloudflare at 1.1.1.1.<\/p>\n\n\n\n
From OPNsense, it wasn\u2019t much more trouble to encrypt using DNS over TLS. I would prefer DNS over HTTPS, does the same thing but camouflages DNS requests as normal web traffic. For now, I\u2019m assuming Unbound can\u2019t do this and working properly. Please tell me if I\u2019m wrong.<\/p>\n\n\n\n
It\u2019s slow going, but I am moving into Cerberus. While looking around, I found a module for NUT (Network UPS Tools), a utility for shutting down computers gracefully as their UPS runs down. I wanted to get it working, and for a moment after a reboot I did, but for reasons beyond me besides the driver on BSD not agreeing the best with CyberPower UPS systems, I\u2019m at a loss. At this point, I am thinking to install a small Linux box to do the job at a future date, even though that will be yet another thing on the UPS.<\/p>\n\n\n\n
From above: Do you know of a way for OPNsense\u2019s Unbound module to run DNS over HTTPS? I look forward to hearing from you in the comments below or on my Socials<\/a>!<\/p>\n","protected":false},"excerpt":{"rendered":" Good Morning from my Robotics Lab! This is Shadow_8472 with another short update my progress with my OPNsense firewall. Let\u2019s get started. I have done a substantial amount of work with DNS on my home network, but as noted in a previous post, it\u2019s sub-optimal to exclusively manipulate your Domain Name System access from a … <\/p>\n