DNS Resolver unbound is missing A records when forwarding

meow

Hi there,

I've got problems with unbound which can't resolve some of my A records.

My setup:

firewall with pfsense 2.4.5-RELEASE-p1
behind that there are three DNS servers: pihole and two windows servers.

The firewall forwards it's queries to the DNS servers in my local net.

When I query my local dns servers everything is fine. But when I query the firewall some of the A records are missing.

Additionally: I had to use unbound because I can't use IPv4 adresses via IPv6 PD and RA..

Anyone ideas how to fix that?

Thanks.

johnpoz

Well if unbound forwards to dns1, or 2 or 3 on your local net, and the returned address is rfc1918. That would be a rebind. So you either have to turn off rebind protection completely.

Or tell unbound that if forwards for domain.xyz that its private and not to care if a rfc1918 is returned.

https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html

This protection is in place whenever unbound resolves or forwards, unless the record is local to unbound - if it resolves or forwards for something.domain.xyz and it gets back a rfc1918 address that is rebind.. So its no different if you forward to your local dns, or if you forwarded to googledns, or if you asked the authoritative ns directly for host.domain.tld - and that server tried to tell you the IP was rfc1918 (192.168.x.x,10.x.x.x or 172.16-31.x.x)

So if you forward to dns1 for test.publicdomain.tld and it returns a public IP 1.2.3.4 that would be fine. But if you ask it for something.domain.tld and it answers with 192.168.1.42 then unbound would not return that response to the client. Because its a rebind concern.

meow

@johnpoz thank you. That solved everything :)

I'm a bit confused because it worked for a lot private addresses before adding my domain to the whitelist.

johnpoz

Unbound has no whitelist - do you mean pfblocker? You made no mention of that in your OP.

I have no idea how you have pfblocker setup..

meow

I added

private-domain: "mydomain.net"

to the unbound custom options like in the documentation you have linked.

I'm using pfblocker, too. Yeah you are right. I never mentioned that. DNS rebinding protection was the cause of my problems.