nextdns config with pfsense dns resolver

nextdns-with-pfsense-dns-resolver.md

NextDNS with pfSense dns resolver

this is the basic configuration for nextdns combine with pfSense dns resolver to use both.

1. Login into pfSense GUI

SSH access is turned off by default on pfSense. To enable it, go to System -> Advanced -> Enable Secure Shell

2. SSH into pfsense

Use any terminal to ssh into pfSense using username and password. it can be default or custom user if you have created for your firewall.

Windows : You can use putty

Mac or Linux : You can use default terminal app or third party one like iterm in mac etc.

If you are ssh into firewall using main admin account then press 8) Shell to enter shell mode. Otherwise you can use directly shell command to enter in main shell by executing su - admin to enter in admin shell and enter password to login.

3. Install NextDNS CLI

This wiki describes steps to install the NextDNS CLI. For router, in out case pfSense, it is recommended way and only required single line command.

sh -c 'sh -c "$(curl -sL https://nextdns.io/install)"'

Follow the wizard and enter your config id from the NextDNS setup page.

4. Modify NextDNS Config

The installation script will create a vanilla configuration. We need to modify it to make it play nice with

1. pfSense
2. support all our subnets.

For more advanced usecases, like supporting different profiles, Cache configuration, split horizon i.e. conditional configuration (e.g. different configuration for a kids, iot, guest subnets), follow their guide here.

To edit the configuration file, in the pfSense GUI, navigate to Diagonistics -> Edit File and open the configuration file located at /usr/local/etc/nextdns.conf. You have to add whole path and press Load and after edit press Save to write back settings.

You can also edit this file by ssh into pfSense and use vi or nano or your favorite editor. I'm using vi and edit by executing vi /usr/local/etc/nextdns.conf.

I have provided basic template and you can use as it is or modify as per your need if you have some other configuration and didn't match with this template.

There are other things need to modify it.

1. discovery-dns Unbound, by default, listens on port 53. In the next step, we will change it to something else like 5555 in the template. You can use different port as well and replace 5555 with your port and make sure that port isn't use by any other process. You can check it by executing netstat -an | grep LISTEN.
2. listen ip:53 We need a listen entry for every subnet we want to route through NextDNS. In the template those are 192.168.1.1 and 192.168.10.1. We also need an entry for localhost so pfSense can resolve domains. You can also pfSense as your main DNS server and assign DNS server IP in every interface.
3. config The config ID from the NextDNS setup page.
4. forwarder domain=ip:port To forward internal domain resolution to unbound, we need to tell NextDNS to route all queries for domain.com or internal.domain.com or lab.domain.com etc. to unbound.

5. Modify DNS Resolver Settings in pfSense

Go to Services -> DNS Resolver and change the following settings.

1. Change port other than 53.

5. Finalize

That's all you need to configure to work NextDNS with pfSense.

1. Restart Unbound service from GUI and make sure 53 port is released. You can also check it by executing netstat -an | grep LISTEN.
2. Restart nextdns service by ssh into pfSense using shell nextdns restart. If it won't work for you, use sh -c "nextdns restart".
3. Verify logs by executing nextdns log or sh -c "nextdns log" if previous one is not worked for you.

You'll see all external and local domain resolved in nextdns logs if everything works as expected.

nextdns.conf

report-client-info true
detect-captive-portals false
bogus-priv true
use-hosts true
log-queries true
cache-size 10MB
max-ttl 5s
debug false
discovery-dns 127.0.0.1:5555
max-inflight-requests 256
setup-router false
cache-max-age 0s
hardened-privacy false
timeout 5s
profile 972ab5
forwarder internal.domain.com=127.0.0.1:5555
forwarder lab.domain.com=127.0.0.1:5555
mdns all
auto-activate true
listen localhost:53
listen 192.168.1.1:53
listen 192.168.10.1:53
control /var/run/nextdns.sock