<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Never mind. I figured it out. It seems something was wrong with my cert bundle. Works perfectly now.
<div><br>
</div>
<div><br>
</div>
<div>Best Regards and thanks.<br>
<div dir="ltr"><br>
<blockquote type="cite">On Sep 5, 2022, at 8:16 PM, Peter Fraser <p_fraser@hotmail.com> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Hi All,</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I have migrated my two Bind Servers to NSD and Unbound on FreeBSD 13.1. Works very well and is very fast. My last task is to configure DNS over TLS for only external queries. I want to have unbound accept udp queries on port 53 as usual internally, but use
DOT when it queries external upstream servers. So far, I have managed to get the DOT queries working upstream but the local clients can no long use the servers. The configs I tried are below. Any help would be apreciated.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
server:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
tls-cert-bundle: "/usr/local/etc/ssl/gd_bundle-g2-g1.pem"<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
forward-zone:
<div> name: "."</div>
<div> forward-tls-upstream: yes</div>
<div> forward-addr: 1.1.1.1@853 #one.one.one.one</div>
<div> forward-addr: 8.8.8.8@853 #dns.google</div>
<div> forward-addr: 8.8.4.4@853 #dns.google</div>
<div> forward-addr: 9.9.9.9@853 #dns.quad9.net</div>
<div> forward-addr: 1.0.0.1@853 #one.one.one.one</div>
<div> forward-addr: 149.112.112.112 #dns.quad9.net<br>
</div>
<div><br>
</div>
<div><b>Then I tried</b></div>
<div><span style="font-size:12pt;margin:0px">server:</span>
<div style="font-size:12pt;margin:0px">tls-cert-bundle: "/usr/local/etc/ssl/gd_bundle-g2-g1.pem"<br>
</div>
<span style="font-size:12pt;margin:0px"></span>tls-upstream: yes<br>
</div>
<div><br>
</div>
<div><span style="background-color:rgb(255, 255, 255);display:inline !important">forward-zone:</span>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> name: "."</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 1.1.1.1@853 #one.one.one.one</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 8.8.8.8@853 #dns.google</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 8.8.4.4@853 #dns.google</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 9.9.9.9@853 #dns.quad9.net</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 1.0.0.1@853 #one.one.one.one</div>
<div style="margin:0px;background-color:rgb(255, 255, 255)"> forward-addr: 149.112.112.112 #dns.quad9.net</div>
<br>
</div>
<br>
</div>
</div>
</blockquote>
</div>
</body>
</html>