Hi All,
I have migrated my two Bind Servers to NSD and Unbound on FreeBSD 13.1. Works very well and is very fast. My last task is to configure DNS over TLS for only external queries. I want to have unbound accept udp queries on port 53 as usual internally, but use DOT when it queries external upstream servers. So far, I have managed to get the DOT queries working upstream but the local clients can no long use the servers. The configs I tried are below. Any help would be apreciated.
server:
tls-cert-bundle: “/usr/local/etc/ssl/gd_bundle-g2-g1.pem”
forward-zone:
name: “.”
forward-tls-upstream: yes
forward-addr: 1.1.1.1@853 #one.one.one.one
forward-addr: 8.8.8.8@853 #dns.google
forward-addr: 8.8.4.4@853 #dns.google
forward-addr: 9.9.9.9@853 #dns.quad9.net
forward-addr: 1.0.0.1@853 #one.one.one.one
forward-addr: 149.112.112.112 #dns.quad9.net
Then I tried
server:
tls-cert-bundle: “/usr/local/etc/ssl/gd_bundle-g2-g1.pem”
tls-upstream: yes
forward-zone:
name: “.”
forward-addr: 1.1.1.1@853 #one.one.one.one
forward-addr: 8.8.8.8@853 #dns.google
forward-addr: 8.8.4.4@853 #dns.google
forward-addr: 9.9.9.9@853 #dns.quad9.net
forward-addr: 1.0.0.1@853 #one.one.one.one
forward-addr: 149.112.112.112 #dns.quad9.net