Perhaps I missed something during setup, but despite the fact that pfBlockerNG is blocking ads and when I run ipconfig /all Windows shows my DNS to be the X.X.X.1 ip of my subnet, but when I go to https://mullvad.net/en/check/ and https://whoer.net/ to check DNS and it identifies my DNS as being Comcast. My DNS Servers are set to 9.9.9.9 and 1.1.1.1 under pfSense > System > General, but is there something else I need to set?
I actually just figured it out, posting here for anyone who discovers the same issue.
Under System>General DNS Server Settings uncheck Allow DNS server list to be overridden by DHCP/PPP on WAN
Under Service>DNS Resolver, check the following boxes:
Enable Forwarding Mode
Use SSL/TLS for outgoing DNS Queries to Forwarding Servers
That fixed it for me.
I’m just wondering, what’s the reason for using the public DNS servers? If it’s so that you don’t want to reveal your real IP via DNS, then you may be better letting Mullvad hijack your DNS requests. If it’s for privacy reasons, then I think you’d be better off using Unbound in recursive mode.
well, both however I’m still setting up my Mullvad connection but only certain subnets will use that, and I’m having some trouble getting that working right. As far as using Unbound in recursive mode I would prefer that for the other connections but have only just begun setting it up so I guess I missed something in setup of pfBlockerNG. When I uncheck forwarding mode and use ssl/tls my DNS for my ISP appears to be getting used NOT the root DNS that DNS Resolver supposedly queries directly. Do you know what I need to change to have Unbound configured for recursive mode?
By unchecking Forwarding Mode, Unbound runs in its default mode. When you run a DNS leak check, you should see your WAN IP address, which is correct, since you are the DNS server for your network. Double check the IP address again using ipleak.net. I think you will find that this is not the IP of your ISP’s DNS (assuming you have “allow DNS list to be overridden Unchecked”), it is actually your public IP address.
Some argue that the downside of this is that your reveal your true IP address, but it has privacy benefits over using public DNS servers. It depends what you want to achieve. It sounds to me like you just need to set Unbound in forwarding mode, using DoT.
Regarding your VLAN Setup, this is probably beyond the scope of this subreddit and probably best discussed in r/pfsense. I’ve achieved what you are trying to do, but with NordVPN as the provider. Make sure under Unbound that the specific network interfaces of your VLANs are selected if you wan granular control over this.
With the setup above where the DNS is my public IP address, and I’m using Unbound to do the root server lookups for DNS, how do I ensure that the traffic to those root authoritative servers are encrypted (while still having pfBlockerNG working)?
Does it even matter at that point? If I make unencrypted requests to the root authoritative servers, my ISP still needs to fetch and serve the content to me, so if they reverse look up the IP, they could guess with a high degree of certainty what I’m looking at even if DNS requests didn’t go through their servers?