I just tested this with snap
2.0-BETA5 (i386)
built on Tue Jan 18 03:34:33 EST 2011
The current acl in unbound was just set to my local network of 192.168.1.0/24
When I tried to query ubound from roadwarrior client got
; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 pfsense.local.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 60436
;; flags: qr rd; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 31 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Fri Jan 21 16:03:11 2011
;; MSG SIZE rcvd: 12
So then I edited the ACL to also include my openvpn network 10.0.200.0/24 restarted unbound just to be sure.
now works just fine.
; <<>> DiG 9.7.2-P3 <<>> @192.168.1.253 pfsense.local.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46473
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;pfsense.local.lan. IN A
;; ANSWER SECTION:
pfsense.local.lan. 3600 IN A 192.168.1.253
;; Query time: 46 msec
;; SERVER: 192.168.1.253#53(192.168.1.253)
;; WHEN: Fri Jan 21 16:04:43 2011
;; MSG SIZE rcvd: 51
Roadwarriors get handed 192.168.1.253 as their dns..
Ethernet adapter ovpn:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-79-1A-85-63
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 10.0.200.6
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 10.0.200.5
DNS Servers . . . . . . . . . . . : 192.168.1.253
Lease Obtained. . . . . . . . . . : Friday, January 21, 2011 1:15:37 PM
Lease Expires . . . . . . . . . . : Saturday, January 21, 2012 1:15:37 PM