{"slug":"unbound-dns-in-opnsense","title":"Unbound DNS in OPNsense","tags":["tailscale","dns"],"agent_summary":"Last validated: May 6, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Unbound DNS in OPNsense\r\n\r\nLast validated: May 6, 2025\r\n\r\n[OPNsense](https://opnsense.org/) is an open source router and firewall platform built using\r\nFreeBSD. Tailscale can be [installed on an OPNsense platform](https://tailscale.com/docs/install/opnsense),\r\njoining it to your WireGuard-based mesh network.\r\n\r\n## [Unbound DNS configuration](https://tailscale.com/docs/integrations/firewalls/opensense-unbound\\#unbound-dns-configuration)\r\n\r\nOPNsense is often configured with a local Unbound DNS server to use for\r\nits own lookups and to provide as a recursive DNS service to LAN clients.\r\nTailscale DNS settings are not currently implemented for Unbound DNS;\r\ninstead, the 100.100.100.100 DNS server will be written to\r\n`/etc/resolv.conf`. This will effectively disable Unbound.\r\n\r\nIt may be preferable to not use the Tailscale DNS settings:\r\n`tailscale set --accept-dns=false`.\r\nInstead, Unbound can be configured to be able to resolve MagicDNS names.\r\nThe tiny 100.100.100.100 DNS server running within the `tailscaled` process\r\nwill always answer queries specifically sent to it.\r\n\r\nIn **System > Settings > General**, add a search domain for the [MagicDNS name](https://tailscale.com/docs/features/magicdns)\r\nof the tailnet such as `tails-scales.ts.net` or `tail0123456.ts.net`.\r\n\r\n![Set tails-scales.ts.net in the OPNsense Settings : General : DNS search domain](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsearch-domain.63086e87.png&w=1920&q=75)\r\n\r\nIn **Services > Unbound DNS > Query Forwarding**, add an entry for the [MagicDNS name](https://tailscale.com/docs/features/magicdns)\r\ndirected to 100.100.100.100.\r\n\r\n![Set Services : Unbound DNS : Query Forwarding to send tails-scales.ts.net to 100.100.100.100](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fquery-forwarding.1aa84ffe.png&w=1920&q=75)\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Unbound DNS in OPNsense

\n

Last validated: May 6, 2025

\n

OPNsense is an open source router and firewall platform built using\r\nFreeBSD. Tailscale can be installed on an OPNsense platform,\r\njoining it to your WireGuard-based mesh network.

\n

Unbound DNS configuration

\n

OPNsense is often configured with a local Unbound DNS server to use for\r\nits own lookups and to provide as a recursive DNS service to LAN clients.\r\nTailscale DNS settings are not currently implemented for Unbound DNS;\r\ninstead, the 100.100.100.100 DNS server will be written to\r\n/etc/resolv.conf. This will effectively disable Unbound.

\n

It may be preferable to not use the Tailscale DNS settings:\r\ntailscale set --accept-dns=false.\r\nInstead, Unbound can be configured to be able to resolve MagicDNS names.\r\nThe tiny 100.100.100.100 DNS server running within the tailscaled process\r\nwill always answer queries specifically sent to it.

\n

In System > Settings > General, add a search domain for the MagicDNS name\r\nof the tailnet such as tails-scales.ts.net or tail0123456.ts.net.

\n

\"Set

\n

In Services > Unbound DNS > Query Forwarding, add an entry for the MagicDNS name\r\ndirected to 100.100.100.100.

\n

\"Set

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}