pfSense

assigned to PIngle for eval, but looks like "not a bug" to me.

wrong assignee

Looks like it is a problem but not one most would hit since it's rare to have both enabled.

source:src/etc/inc/unbound.inc#L568 unbound_add_host_entries() is reading /etc/hosts rather than starting with $config['unbound']['hosts'].

When the DNS Forwarder is enabled, its contents are preferred for /etc/hosts since as the comment states, unbound doesn't care about /etc/hosts but dnsmasq does, which means if both are enabled, then the /etc/hosts entries from dnsmasq will be picked up and put in /var/unbound/host_entries.conf rather than what is defined in the GUI for DNS Resolver.

So unbound_add_host_entries() needs to be changed to read the hosts from config.xml not /etc/hosts. The only other reason I can think of why it would read /etc/hosts directly would be to also pick up the automatic entries for localhost and for the firewall itself, so those likely need added as well.

As an alternate tactic, hosts for dnsmasq could be written elsewhere and dnsmasq can be passed the --addn-hosts=/path/to/file parameter so it picks up its own distinct copy.

Applied in changeset commit:ac446eac051c4514666f9904bbdd0609468f2fc5.

Assigning to Jim Pingle for testing

Looks good now. Forwarder hosts go in /etc/hosts, Resolver hosts go in /var/unbound/host_entries.conf and they appear to work as expected.