unbound with ULA: connection timed out (nslookup)?

the other

Hey everyone,
I got a rather stoopid question, I'm afraid...

Home network running on dual stack, some VLANs have IPv4 and 6 running.
Now, everything is working fine: I reach external sites with v4 and v6, I reach internal clients with v4 and v6 addresses. IPv6 checking sites say all is well.

Local clients are answering under their GUA as well as their ULA adresses...DNS for clients is working.

Under unbound (resolver mode) config I have checked that access is allowed, here the ULA addresses are noted. BUT: when trying a nslookup with unbound's ULA I get a connection timed out. I tried to enter the ULA in DHCPv6/RA DNS Server fields, no positive result. I tried without it (since it should be default), no positive result.

So:

everything is working
access for subnets and ULA is in unbound's config file
internal and external adresses are answering by IP as well as hostname
nslookup with given GUA of unbound is working
Problem:
nslookup with ULA (fd:...) is not answering (time out)

I don't really understand why.
Any ideas? Any hints?
Thanx and have a nice weekend, everyone!

(pfsense CE 2..6, no DHCPv6, running RA with unmanaged, Subnets have ULA, routing is working, firewall rules with Virtual IP (ULA) are working, ...if more information is needed, please say so)

JasonAU

@the-other said in unbound with ULA: connection timed out (nslookup)?:

on't really unders

Can you see the nslookup query arriving, if you enable the extra logging in DNS /Resolver advanced

Turn up the logging a bit and watch the logs as you run the query

Bob.Dig

... Although it is not exactly for your problem, maybe it helps.

Or you just have missing firewall rules.

the other

@jasonau
I can see it when using GUA, not when using ULA.
If I set ULA in RA DNS Servers field, I can resolve via using my browser. Nslookup still timing out when using fd:... although it ist entered in /var/etc/radvd.conf

Well, it is working (the only flaw is that time out with ula IP for unbound). Internet browser finds sites with ula as well as gua in /var/etc/radvd.conf...
Thanx for your answer :)

the other

@bob-dig
Firewall rule should not be the issue, tried even with allow all for port 53 on vlan interface...
So...no practical issues, but still not working with
nslookup -query=AAAA google.com pfsense-ula-ipv6

Patch did not change anything...since an ugly flu is just coming up, I give this curiosity (and myself) a rest.
Was just wondering, if I missed something obvious...thanx for your input

johnpoz

@the-other not able to duplicate your problem.

Setup a ula vip on my pfsense lan

fd10:a945:372f:6c84::1/64

Setup unbound to listen on this VIP

Made sure my firewall rules and unbound acl allowed for ula range fd00::/8

Set my pc up with a IPv6 ula address in this range fd10:a945:372f:6c84::2/64

And query and it works fine..

Few things to keep in mind, you need to make sure unbound is listening on this vip.. If your using auto ACLs in unbound you need to make sure set to allow from your ula range. Or set it them manually to allow.

You can view them with
cat /var/unbound/access_lists.conf

You need to make sure your firewall rules on this enterface allow for udp/tcp 53 from your ULA range, etc. Keep in mind that rule of Lan Net or OptX Net as source isn't going to include some vip ULA address.. You would need to make sure your firewall rules specifically allow for your ULA range or the whole ULA block, etc.

Now I am on 23.01, maybe there is something wrong with 2.6? But not sure how that could be really, it comes down to is unbound listening on this ULA address, does its ACLs allow queries from ULA address range. Do the firewall rules on the interface allow for dns port from ULA range, etc.

Validate unbound listening on the ULA address, sockstat come in handy here

You say its working with your gua - so its not like you set unbound to not do Ipv6 with the do-ip6: no in custom options or something.

the other

@johnpoz
I erased all my steps and started fresh...did everything as you wrote (pretty sure that's what I had)...

AND IT IS WORKING!! Thank you very much @johnpoz

Don't know, maybe had a typo anywhere. It is all well and the little voice in my head that was ickering about it is quiet now... :)
Have a nice weekend!!

johnpoz

@the-other glad you got it sorted.. Hope you have a great weekend as well!

Out of curiosity if you don't mind - other than a learning experience, why do yo want ula.. I just do not see the point, you have a gua right.. What what is the purpose of the ula for your use case? Just curious..

Seems to me it just another layer of complexity.. I don't see the value in it. Your already running a dual stack with rfc1918 and IPv6.. You sure do not need even to access pfsense via IPv6 for dns for IPv6 to work - you can just as easy use the rfc1918 address you have locally for dns it can lookup AAAA etc..

Now some point in the future when we are not running IPv4 and need stuff to talk to each other on local networks, stuff that doesn't have a gua ok makes sense then. And then only if you had to route stuff across segments, or the link-local could be used.

I could see setting it up for a learning exercise, but soon as that was done with - I would remove them.. The ula I setup for testing is already been removed.. I have zero use for it.. And can not even think why I might want to use it currently with the state of the transition to IPv6.. I have gua /48 I can use if I want something to use IPv6, locally my device just use IPv4 via rfc1918 and don't see any time soon where I would even need to fire up or even allow for any IPv6 communication between really any of my devices, etc.

Complexity only adds more points of possible failure ;) KISS is my motto!

the other

@johnpoz
Hey there,
well, it is a dynamic GUA, changing in unspecific intervals by ISP (Germany)...
so, although I could set everything on automatic getting a working connection (the GUA is handed out), I quite like it to configure manually (setting Gateway and DNS and such). Since my GUA is changing I thought I would get that done with giving out ULAs as well. So for IPv6 I use ULA for routing in LAN...beteeen vlans.

To be clear: this is just for the heck of it, a hobby, trying to do this and that with my network. So yeah, a learning experience.
And yeah, everything is kinda "double" for DNS was working via IPv4 as well. It's rather an approach to play with IPv6 and learning by doing...
:)

SteveITS

@johnpoz Without looking it up :) I’m assuming Bob’s patch above is the one for pfSense setting incorrect unbound ACLs using IPv6

Yeah its quite possible problem with that - I don't actually use auto acls, I use manual

But I don't believe even auto would take into account a vip? And sure there could be a problem, and track for IPv6 prefixes that change could be a problem..

I was just trying to point out the stuff to validate if not working, etc.