Setting TTL for local for Unbound host overrides - Solved

skitzo2000

Hey Guys,

I've got a lot of static leases on my lan and I'm trying to migrate my setup with minimal downtime for the business. Essentially I need to separate my traffic to two vlans for pci compliance reasons, but my business is 24 hours so I can't go mucking up the network or it costs me dearly :P

My first step was to setup host over rides within DNS resolver(this way when I switch over to the vlans with new dhcp leases I don't need to reconfigure every machine in the biz), but right away I realized that I'm unable to set the TTL for these entries. so once they are cached by local clients the TTL is set to 3600 as documented here https://redmine.pfsense.org/issues/7495

So I took a closer look at the Unbound Documentation https://www.unbound.net/documentation/unbound.conf.html and it shows that I should be able to enter a TTL with the "local-data-ptr" entry. So my plan was to pull a full copy of the hosts_entries.conf and then manually edit all of the entries with the TTL as 60 so that when I start switching things around downtime's are minimized to one minute.

So is this the right approach? are there any other gotcha's that I might be missing.

johnpoz

Just pull the record out of the gui host override section and put it in the advanced box… And you can set the ttl to whatever you want...

If you need a specific example.. just ask.

skitzo2000

I'm currently on 2.4.2

I don't see an option in the GUI to "pull the record out of the GUI". Note that I need to do this with close to 100 records which is part of why I'm eyeing the .conf file directly.

"the advanced box"-> I'm guessing you mean the Custom Options box? There is no place in the Advanced settings tab where I could enter this much info.

A specific example would be awesome. :D

johnpoz

hehehe - if you have an entry in the gui remove it ;) That is what I meant by pull it out..

You can past as many entries here that you want, or even just load a file that has all your entries in it..

So all of these entries are from dhcp or static reservations?

Anyway remove any entries you have in host overrides. See I created a AAtestttl.local.lan entry and it default to the 3600 ttl. I removed that!! And then put in a specific entry calling out the 60 second ttl in the entry.. And there you go when I query it ttl of 60 vs 3600. Or if you really have a shitton of them you could just load them from a file. So I removed that from the custom box. Set it to include a file, edited the file to have my entries I wanted in it.. see screenshots

differentttl.png_thumb

skitzo2000

Excellent! Thanks so much for the detailed response :)

johnpoz

No problem - I even updated the feature request for this that was done like a year ago you linked too. I had chimed in on that quite some time ago.. But this thread is a perfect example of how it would be a nice feature to make edited of that in the gui.

skitzo2000

Until the Feature request goes through and Anyone who stumbles onto this thread this was my final resolution.

I had already spent time entering all of the Local host values through the GUI. So for starters I pulled a copy of /var/unbound/hosts_entries.conf via sftp.

This gave me a complete file with all of my entries minus the TTL addition.

Each entry looks something like this when the gui build it:

local-data-ptr: "192.168.1.12 host.name"
local-data: "host.name. A 192.168.1.122"

For Each entry I simply changed these two lines to include the TTL value for my setup I wanted a 60 second TTL.

local-data-ptr: "192.168.1.12 60 host.name"
local-data: "host.name. 60 A 192.168.1.12"

After adding the TTL values to the file I renamed it to "local_host_entries.conf" And then pushed it back to the server into the /var/unbound directory. After pushing it up I needed to manually ssh into the box and change the ownership of the file to the unbound group.

chown root:unbound local_host_entries.conf

Now I needed to clear out all of the entries done through the GUI. I tried simply dumping the host_entries.conf file, but that didn't work, so instead I was forced to manually delete all the entries through the GUI. If any one finds an easier way please feel free to comment and tell us how.

I then updated the Custom Options Section on the main tab on the DNS Resolver General setting page to include my file


server:
include: /var/unbound/local_host_entries.conf

Note the server part is important, so be sure to include it.

Now I simply had to apply the changes with the button at the top and like magic all my local entries were migrated to the new file I created with my chosen TTL settings.

You can confirm the change with a dig command to one of your local host entries.

The only downside to this is if I wanted to see all of my entries I have to pull a copy of the local_host_entries.conf.

And if I need to add more I will have to add them through the local file if I want to adjust the TTL.

Hopefully someone finds this helpful!