3 ms·
OpenBSD acts as router for my home, and I run Unbound on the router to provide DNS-over-TLS capability to both OpenBSD and to the computers in my LAN. My ISP co
by daneel_w 5y ago
OpenBSD acts as router for my home, and I run Unbound on the router to provide DNS-over-TLS capability to both OpenBSD and to the computers in my LAN. My ISP connection uses DHCP, and my ISP obviously provide DNS servers for me, but by superseding these with "127.0.0.1" through dhclient.conf I can make sure OpenBSD never inserts the ISP DNSes into resolv.conf and consequently always resolve through Unbound instead, and by letting computers in my LAN use the router (i.e. Unbound) as DNS I can make sure they too get DNS-over-TLS instead of resolving hostnames with my ISP's DNSes.
Since I don't involve Unwind here, which according to the manpages of the new daemons is what makes them prepend "127.0.0.1" to resolv.conf, and since I cannot see any apparent way of configuring the new daemons to ignore DNS information in the DHCP response the way I can with dhclient, how can I achieve what I have now? How can I prevent my ISP's DNSes from entering resolv.conf when running the new daemons?
I get the impression that my use case (which really is neither uncommon nor obscure) hasn't been thought of at all.
- tedunangst 5y agoI think the current path of least resistance would be unwind with unwind.conf forwarding to unbound.
- daneel_w 5y agoYes. Clumsy. It's an unusually awkward design choice to have the software detect if another specific application is running in order to trigger the behavior, instead of just giving the user the ability to configure it. In my opinion this whole new dhcpleased/resolvd setup is poorly planned, as it contrives the gruesome trick of being both a privacy/integrity problem (no user control over ISP DNS making its way into resolv.conf) and a userland villainy problem (forcefully altering behavior based on whether some other application is running, no matter what the user's actual intention is for running that application).
- rsmarples 5y agoI agree, although I am biased! resolvconf was designed to take DNS inputs from many sources and allow the user to tailor these to their needs.