opnsense · bryanwieg · Jul 29, 2026
diff --git a/dns/bind/pkg-descr b/dns/bind/pkg-descr
@@ -7,6 +7,12 @@ necessary for asking and answering name service questions.
 Plugin Changelog
 ================
 
+1.35
+
+* Add per-forwarder destination port for plain DNS forwarders
+* Add DNS-over-TLS (DoT) forwarders with TLS hostname verification
+* Migrate legacy DNS Forwarders list to the new DNS Forwarders tab
+
 1.34
 
 * Add custom configuration include directory /usr/local/etc/namedb/named.conf.d (contributed by Nicholas Card)

diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/ForwarderController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/ForwarderController.php
@@ -0,0 +1,99 @@
+<?php
+
+/**
+ *    Copyright (C) 2026 Bryan Wiegand <inbox@kw-ventures.com>
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Bind\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class ForwarderController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'forwarder';
+    protected static $internalModelClass = '\OPNsense\Bind\Forwarder';
+
+    public function searchDnsForwarderAction()
+    {
+        return $this->searchBase('forwarders.dns', ['enabled', 'ip', 'port']);
+    }
+
+    public function getDnsForwarderAction($uuid = null)
+    {
+        return $this->getBase('dns', 'forwarders.dns', $uuid);
+    }
+
+    public function addDnsForwarderAction()
+    {
+        return $this->addBase('dns', 'forwarders.dns');
+    }
+
+    public function delDnsForwarderAction($uuid)
+    {
+        return $this->delBase('forwarders.dns', $uuid);
+    }
+
+    public function setDnsForwarderAction($uuid)
+    {
+        return $this->setBase('dns', 'forwarders.dns', $uuid);
+    }
+
+    public function toggleDnsForwarderAction($uuid)
+    {
+        return $this->toggleBase('forwarders.dns', $uuid);
+    }
+
+    public function searchDotForwarderAction()
+    {
+        return $this->searchBase('forwarders.dot', ['enabled', 'ip', 'port', 'tlshostname']);
+    }
+
+    public function getDotForwarderAction($uuid = null)
+    {
+        return $this->getBase('dot', 'forwarders.dot', $uuid);
+    }
+
+    public function addDotForwarderAction()
+    {
+        return $this->addBase('dot', 'forwarders.dot');
+    }
+
+    public function delDotForwarderAction($uuid)
+    {
+        return $this->delBase('forwarders.dot', $uuid);
+    }
+
+    public function setDotForwarderAction($uuid)
+    {
+        return $this->setBase('dot', 'forwarders.dot', $uuid);
+    }
+
+    public function toggleDotForwarderAction($uuid)
+    {
+        return $this->toggleBase('forwarders.dot', $uuid);
+    }
+}
diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/ForwardingController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/ForwardingController.php
@@ -0,0 +1,39 @@
+<?php
+
+/*
+ * Copyright (C) 2026 Bryan Wiegand <inbox@kw-ventures.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Bind;
+
+class ForwardingController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->formDialogEditBindDnsForwarder = $this->getForm("dialogEditBindDnsForwarder");
+        $this->view->formDialogEditBindDotForwarder = $this->getForm("dialogEditBindDotForwarder");
+        $this->view->pick('OPNsense/Bind/forwarding');
+    }
+}
diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDnsForwarder.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDnsForwarder.xml
@@ -0,0 +1,46 @@
+<!--
+ Copyright (C) 2026 Bryan Wiegand <inbox@kw-ventures.com>
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS AND ANY
+ EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+
+<form>
+    <field>
+        <id>dns.enabled</id>
+        <label>Enabled</label>
+        <type>checkbox</type>
+        <help>This will enable or disable this forwarder.</help>
+    </field>
+    <field>
+        <id>dns.ip</id>
+        <label>IP Address</label>
+        <type>text</type>
+        <help>Set the IPv4 or IPv6 address of the upstream DNS server. For a local encryption proxy such as contrld, use 127.0.0.1.</help>
+    </field>
+    <field>
+        <id>dns.port</id>
+        <label>Port</label>
+        <type>text</type>
+        <help>Set the destination port. Defaults to 53; use a custom port for a local proxy (e.g. 5300).</help>
+    </field>
+</form>
diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDotForwarder.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDotForwarder.xml
@@ -0,0 +1,52 @@
+<!--
+ Copyright (C) 2026 Bryan Wiegand <inbox@kw-ventures.com>
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS AND ANY
+ EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+
+<form>
+    <field>
+        <id>dot.enabled</id>
+        <label>Enabled</label>
+        <type>checkbox</type>
+        <help>This will enable or disable this DNS-over-TLS forwarder.</help>
+    </field>
+    <field>
+        <id>dot.ip</id>
+        <label>IP Address</label>
+        <type>text</type>
+        <help>Set the IPv4 or IPv6 address of the upstream DoT server (e.g. 1.1.1.1 for Cloudflare).</help>
+    </field>
+    <field>
+        <id>dot.port</id>
+        <label>Port</label>
+        <type>text</type>
+        <help>Set the destination port. Defaults to 853 (the standard DNS-over-TLS port).</help>
+    </field>
+    <field>
+        <id>dot.tlshostname</id>
+        <label>TLS Hostname</label>
+        <type>text</type>
+        <help>Set the TLS hostname for certificate verification (e.g. cloudflare-dns.com). If set, the upstream certificate must match this hostname and is verified against the system CA bundle. If left empty, BIND verifies the certificate against the forwarder's IP address; that IP address must be present in the certificate Subject Alternative Name.</help>
+    </field>
+</form>
diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
@@ -61,14 +61,6 @@
         <advanced>true</advanced>
         <help>Specify the IPv6 address used as a source for zone transfers.</help>
     </field>
-    <field>
-        <id>general.forwarders</id>
-        <label>DNS Forwarders</label>
-        <style>tokenize</style>
-        <type>select_multiple</type>
-        <allownew>true</allownew>
-        <help>Set one or more hosts to send your DNS queries if the request is unknown.</help>
-    </field>
     <field>
         <id>general.filteraaaav4</id>
         <label>Enable filter-aaaa on IPv4 Clients</label>
@@ -126,6 +118,12 @@
         <type>select_multiple</type>
         <help>Define the ACLs where you allow which client are allowed to query this server.</help>
     </field>
+    <field>
+        <id>general.forwarding</id>
+        <label>Forwarding Mode</label>
+        <type>dropdown</type>
+        <help>Set to "Forward Only" to prevent BIND from falling back to its own recursive resolution when forwarders are unreachable. If set to "Forward Only", configure forwarders on the DNS Forwarders tab.</help>
+    </field>
     <field>
         <id>general.dnssecvalidation</id>
         <label>DNSSEC Validation</label>

diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Forwarder.php b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Forwarder.php
@@ -0,0 +1,31 @@
+<?php
+
+/*
+    Copyright (C) 2026 Bryan Wiegand <inbox@kw-ventures.com>
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\Bind;
+
+use OPNsense\Base\BaseModel;
+
+class Forwarder extends BaseModel
+{
+}
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Forwarder.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Forwarder.xml
@@ -0,0 +1,78 @@
+<!--
+ Copyright (C) 2026 Bryan Wiegand <inbox@kw-ventures.com>
+ All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+    this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright notice,
+    this list of conditions and the following disclaimer in the documentation
+    and/or other materials provided with the distribution.
+
+ THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS AND ANY
+ EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY
+ DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+-->
+
+<model>
+    <mount>//OPNsense/bind/forwarder</mount>
+    <description>BIND DNS and DNS-over-TLS forwarders</description>
+    <version>1.0.1</version>
+    <items>
+        <forwarders>
+            <dns type="ArrayField">
+                <enabled type="BooleanField">
+                    <Default>1</Default>
+                    <Required>Y</Required>
+                </enabled>
+                <ip type="NetworkField">
+                    <Required>Y</Required>
+                    <NetMaskAllowed>N</NetMaskAllowed>
+                    <Constraints>
+                        <check001>
+                            <ValidationMessage>A plain forwarder with this IP already exists.</ValidationMessage>
+                            <type>UniqueConstraint</type>
+                        </check001>
+                    </Constraints>
+                </ip>
+                <port type="PortField">
+                    <Default>53</Default>
+                    <Required>Y</Required>
+                </port>
+            </dns>
+            <dot type="ArrayField">
+                <enabled type="BooleanField">
+                    <Default>1</Default>
+                    <Required>Y</Required>
+                </enabled>
+                <ip type="NetworkField">
+                    <Required>Y</Required>
+                    <NetMaskAllowed>N</NetMaskAllowed>
+                    <Constraints>
+                        <check001>
+                            <ValidationMessage>A DoT forwarder with this IP already exists.</ValidationMessage>
+                            <type>UniqueConstraint</type>
+                        </check001>
+                    </Constraints>
+                </ip>
+                <port type="PortField">
+                    <Default>853</Default>
+                    <Required>Y</Required>
+                </port>
+                <tlshostname type="HostnameField">
+                    <Required>N</Required>
+                </tlshostname>
+            </dot>
+        </forwarders>
+    </items>
+</model>