I run OPNsense at home for my firewall, directly behind my AT&T fiber router. It has been rock solid for several years now.

Well… rock solid as a firewall. As an internal DNS server, it has left something to be desired. I’m sure that has a lot to do with the fact that I’ve never really sat down and dug into how ISC DHCP interacted with Unbound—or how Unbound interacted with AdGuard Home.

A few days ago, I updated OPNsense to the latest version (26.1.1). Knowing that ISC DHCP was going away, I decided to spend a little time with Sparky (ChatGPT) to understand how easy it might be to move to KEA DHCP.

My Sunday morning coffee time was spent preparing for the migration. I wanted to change the configuration of my internal subnet to better lay out switches, servers, access points, and lab equipment. Sparky was very good at walking me through some planning, and that planning also included fixing my internal IPv6 configuration.

Right now, I’m feeling a little silly that an IT Architect would need that kind of help in his home lab—but here we are.

I was happily surprised that Sparky was fairly well-versed in the configuration of KEA DHCP. In less than two hours, we were able to:

• Design the IP configuration for the home network
• Set reservations for devices that I wanted to be static, but did not need to survive a DHCP failure
• Lay out the DHCP scope
• Turn on KEA DHCP and turn off ISC DHCP
• Perform some troubleshooting for a few devices that were a bit sticky with their old IP addresses

I mentioned using AdGuard Home on the network. I run a couple of blocklists that help address privacy issues and advertising on websites. But since AdGuard Home was only being used for DNS (not DHCP), and I wasn’t constantly tuning the DNS settings, I decided to get rid of it. I was able to load my blocklists directly into Unbound DNS instead.

So far, DNS has been rock solid—and it’s working well for both internet lookups and my home and lab environments.

Not bad for a Sunday morning!