How to Change DNS on OPNsense (Firewall-Wide)

Why change DNS on OPNsense

OPNsense sits between your whole network and the internet, so changing its DNS is the single most efficient place to apply a faster resolver: every phone, laptop, TV, and IoT device behind the firewall benefits at once, with no per-device setup. By default OPNsense runs the Unbound resolver on the LAN and hands out the firewall’s own address as the DNS server via DHCP, so clients already point at the firewall — you’re just changing where the firewall sends those lookups.

A faster resolver shortens the lookup delay before a page starts to load. It does not increase your bandwidth, throughput, or download speed — those are set by your ISP plan and line. What you’re trimming is the round-trip time spent turning a hostname into an IP address, which happens before any real data transfer begins.

Before you start, run the DNS speed test from a device on this network, pick the resolver that responds fastest from your connection, and use its two addresses in place of the Cloudflare examples below. You can also compare resolvers on the public DNS servers page if privacy or filtering matters to you as well as speed.

The key OPNsense detail: recursive vs. forwarding

This trips up a lot of people, so it’s worth stating plainly. Out of the box, Unbound is a recursive resolver — it talks directly to the authoritative name servers on the internet and does not forward to whatever you type into System → Settings → General. That means entering 1.1.1.1 there alone changes only the firewall’s own name resolution, not what your LAN clients ultimately use.

To make the whole network actually use Cloudflare (or any specific resolver), you switch Unbound into forwarding mode by adding Query Forwarding entries, as in step 6. If you’d rather keep Unbound resolving recursively — a perfectly valid, privacy-friendly choice that talks to no single third party — then skip step 6 and understand that the addresses in System → Settings → General are just the firewall’s fallback, not your network’s resolver.

OPNsense vs. pfSense and version differences

• This guide is OPNsense-specific. pfSense uses different menu paths (System → General Setup for the servers, and Services → DNS Resolver for Unbound). Don’t apply these exact labels there.
• Tab locations shift between OPNsense releases. The Unbound sub-tabs (Query Forwarding, DNS over TLS) have moved and been renamed across major versions. If a tab isn’t where described, look through the full Services → Unbound DNS menu — the option exists, it may just sit under a slightly different tab name on your build.
• Dnsmasq option. Some installs use Dnsmasq DNS instead of Unbound. If your resolver service is Dnsmasq (Services → Dnsmasq DNS), the forwarding is configured there instead; the System → Settings → General part is identical.

Encrypted DNS (DoT/DoH)

OPNsense does support encrypted DNS natively — specifically DNS over TLS (DoT) through Unbound, so every device on your network gets encrypted lookups without any per-device configuration.

1. Go to Services → Unbound DNS → DNS over TLS.
2. Add a server: Server IP 1.1.1.1, Port 853, Verify CN cloudflare-dns.com.
3. Add a second entry for 1.0.0.1 with the same port and Verify CN.
4. Save, then Apply. Adding servers on this tab puts Unbound into forwarding-over-TLS mode, so all queries leave the firewall encrypted to Cloudflare on port 853.

The “Verify CN” value is the hostname Unbound checks the resolver’s TLS certificate against — this is the part that makes the connection genuinely secure rather than just encrypted. In raw Unbound terms this maps to 1.1.1.1@853#cloudflare-dns.com; the GUI just splits the IP, the @853 port, and the #-hostname into three fields. If you used the DNS over TLS tab, you don’t also need the plain Query Forwarding entries from step 6 — pick one path.

A note on DoH: Unbound’s GUI does not forward upstream over DNS-over-HTTPS. If you specifically need DoH out of the firewall, that requires the optional os-dnscrypt-proxy plugin rather than a built-in menu — so don’t expect a native “DoH” checkbox. For picking an encrypted resolver and getting its exact DoT hostname or DoH endpoint, use our encrypted DNS setup generator.

Verify it worked

• Confirm resolution works. From a LAN device, run nslookup example.com (Windows) or dig example.com (macOS/Linux). It should resolve through the firewall’s LAN IP — that’s expected, since clients query Unbound, not Cloudflare directly.
• Confirm the upstream resolver. Because clients see the firewall as their DNS, don’t judge by the DNS IP shown on the client. Instead, from a device on the network open https://one.one.one.one/help — with Cloudflare configured it reports Connected to 1.1.1.1: Yes, and if you set up DoT it shows DNS over TLS: Yes.
• Watch it live on the firewall. Services → Unbound DNS → Log File shows queries as they happen, and Reporting → Unbound DNS confirms Unbound is answering with per-query statistics.
• Re-run the speed test. Reload this site and run the DNS speed test from a couple of devices; your chosen resolver should show up as the one in use, and ideally the fastest.

Troubleshooting

• Clients still resolve after saving System → Settings → General only. Expected — that page sets the firewall’s own resolvers, not the network’s. Add the Query Forwarding entries (step 6) or a DNS over TLS server to route client lookups.
• DoT set up but resolution stops working. Double-check the Verify CN matches the resolver’s certificate hostname exactly (cloudflare-dns.com for Cloudflare) and that port is 853. A wrong CN or a firewall rule blocking outbound 853 will make every lookup fail.
• ISP DNS keeps coming back. Confirm “Allow DNS server list to be overridden by DHCP/PPP on WAN” is unchecked under System → Settings → General.
• Some sites won’t load. If you enabled forwarding, DNSSEC handling can interact with a misbehaving upstream — try the other resolver from the public DNS servers page, or temporarily revert to recursive mode to isolate whether DNS is really the cause.
• A single device ignores the firewall’s DNS. That device likely has its own hardcoded DNS (common on some smart TVs and phones using private DNS). It overrides anything the firewall hands out; change or clear it on the device itself.

Revert to your old settings

To undo the change: remove the entries you added under Services → Unbound DNS → Query Forwarding (and any under DNS over TLS), then Save and Apply — this returns Unbound to recursive resolution. Under System → Settings → General, clear the DNS server addresses you entered (or re-check “Allow DNS server list to be overridden by DHCP/PPP on WAN”) and Save to hand control back to your ISP’s DHCP-supplied servers. Clients pick up the change on their next DNS query or DHCP renewal.