Unbound for DoH

[CallMeR]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [* ] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [ *] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the solution you like
https://blog.nlnetlabs.nl/dns-over-https-in-unbound/
I've noticed that Unbound could be configured to support DoH.
Will WEB UI support this feature someday？

[fichtner]

In practice it is quite difficult to make port 443 the DoH port for a LAN segment, but in principle I agree that it should be added to the GUI.

I will work on it after 21.7 is released.

Cheers,
Franco

[CallMeR]

Thanks for your reply :)
I agree that it is very difficult to listen to DNS requests on port 443, but few devices can natively use DoH or DoT for DNS queries.
Therefore, if you can forward to the DoH port (443) like forwarding ordinary DNS (port 53) to DoT (port 853), and then configure the DoH server on the external network, it is enough for now.
Just like ：

Configure a DoH, it seems that only a domain name is needed，like https://somedomin/dns-query?

[CallMeR]

By the way, I am very much looking forward to the release of the new version 21.7, and I am going to reinstall my OPNsense :)

[fichtner]

I'm not sure I understand because actually the DoH seems to be a server, not a client like DoT seen here. You basically need a virtual IP for that and/or a port forward. I suppose we need to support tls-port: and https-port: directives along with it.

And, yes, from the looks of it 21.7 will be pretty good. We are excited for the release at least anyway. :)

Cheers,
Franco

[fichtner]

Note to self:

server:
   tls-port:              dotport
   https-port:         dohport
   tls-service-key "key.pem"
   tls-service-pem: "cert.pem"

tls-service nodes should be enabled per "DoH-DoT server" setting enable/disable or just use the certificate selector.

[fichtner]

Via https://twitter.com/DKaufmann_/status/1421023327762751489