Point the LAN at the router's resolver#

You will end up with the router answering DNS for the LAN, forwarding what it does not know to servers you named, and refusing everyone else. Every client already points at the router for its default route, so making it the resolver too is one DHCP option and no client configuration.

Before you start#

• The operator role and a licence.
• The LAN address the resolver should listen on.
• The upstream servers you want to use.

Step 1 — Configure the forwarder#

Network → DNS.

set service dns forwarding listen-address 192.0.2.1
set service dns forwarding allow-from 192.0.2.0/24
set service dns forwarding name-server 9.9.9.9
set service dns forwarding name-server 1.1.1.1
set service dns forwarding cache-size 10000

Add one allow-from line per segment you serve. The page shows the current list.

Step 2 — Hand it out with DHCP#

set service dhcp-server shared-network-name LAN subnet 192.0.2.0/24 option name-server 192.0.2.1

Clients pick it up at their next renewal.

Step 3 — Watch the cache#

The DNS page shows the resolver's configuration beside its cache statistics, read from the router. A cache with no hits is a resolver nothing is using; a cache size of 10000 entries is a sensible default and the number to raise if the hit rate is poor on a busy network.

Check it worked#

From a client:

dig @192.0.2.1 example.com

And confirm it is closed from outside:

dig @203.0.113.2 example.com

That second one should time out. If it answers, allow-from or listen-address is wrong, and the router is an open resolver.

On the router:

show dns forwarding statistics

What this resolver will not do#

Filtering#

If what you actually want is ad and tracker filtering for every client, Network-wide filtering with AdGuard Home is the guide, and it forwards from this resolver rather than replacing it.

Undoing it#

delete service dns forwarding

Change the DHCP option back to an upstream resolver in the same commit, or the LAN loses DNS at its next renewal.

See also#

• Authoritative records for local names
• Network-wide filtering with AdGuard Home
• Find printers and speakers across VLANs
• DNS — resolver

Checked against ui/src/pages/Dns.tsx · agent/main.go · tools/opnsense-import.py