<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hi All,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I have migrated my two Bind Servers to NSD and Unbound on FreeBSD 13.1. Works very well and is very fast. My last task is to configure DNS over TLS for only external queries. I want to have unbound accept udp queries on port 53 as usual internally, but use
DOT when it queries external upstream servers. So far, I have managed to get the DOT queries working upstream but the local clients can no long use the servers. The configs I tried are below. Any help would be apreciated.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
server:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
tls-cert-bundle: "/usr/local/etc/ssl/gd_bundle-g2-g1.pem"<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
forward-zone:
<div> name: "."</div>
<div> forward-tls-upstream: yes</div>
<div> forward-addr: 1.1.1.1@853 #one.one.one.one</div>
<div> forward-addr: 8.8.8.8@853 #dns.google</div>
<div> forward-addr: 8.8.4.4@853 #dns.google</div>
<div> forward-addr: 9.9.9.9@853 #dns.quad9.net</div>
<div> forward-addr: 1.0.0.1@853 #one.one.one.one</div>
<div> forward-addr: 149.112.112.112 #dns.quad9.net<br>
</div>
<div><br>
</div>
<div><b>Then I tried</b></div>
<div><span style="font-size:12pt;margin:0px">server:</span>
<div style="font-size:12pt;margin:0px">tls-cert-bundle: "/usr/local/etc/ssl/gd_bundle-g2-g1.pem"<br>
</div>
<span style="font-size:12pt;margin:0px"></span>tls-upstream: yes<br>
</div>
<div><br>
</div>
<div><span style="background-color:rgb(255, 255, 255);display:inline !important">forward-zone:</span>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> name: "."</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 1.1.1.1@853 #one.one.one.one</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 8.8.8.8@853 #dns.google</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 8.8.4.4@853 #dns.google</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 9.9.9.9@853 #dns.quad9.net</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 1.0.0.1@853 #one.one.one.one</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 149.112.112.112 #dns.quad9.net</div>
<br>
</div>
<br>
</div>
</body>
</html>