Register DHCP WAN address with unbound?

[dennypage]

I feel like this should be a stupid question, but I haven't been able to figure it out...

Does anyone know of a way to register the current DHCP WAN address with unbound? Similar to the way that you would use a dynamic DNS service, except for the local unbound server.

[Bob.Dig]

@dennypage said in Register DHCP WAN address with unbound?:

Does anyone know of a way to register the current DHCP WAN address with unbound?

What do you want to achieve with that? Externally you would need DDNS, like you said.

[johnpoz]

@Bob-Dig yeah I was going to ask the same question.. So you want your wan IP to resolve from say wan.home.arpa or whatever domain your using locally?

[dennypage]

@Bob-Dig said in Register DHCP WAN address with unbound?:

What do you want to achieve with that?

I am moving from static IPs to dynamic IP because of a circuit change.

I have a public DNS entry for vpn.mydomain.net which is updated with a dynamic dns service. The registered address is the external (WAN) interface for the firewall (pfSense) in order to support IPSEC.

As you would expect, the firewall hosts DHCP, DNS, etc. for the LANs, and so is authoritative for mydomain.net. This means that vpn.mydomain.net is not resolvable in the LAN without some form of dynamic registration. This precludes basic IPSEC testing from inside the network. It's not the end of the world, but it seems like there should be some way to accomplish it.

Previously, with static IPs, this was trivial.

[johnpoz]

@dennypage said in Register DHCP WAN address with unbound?:

so is authoritative for mydomain.net.

To the public? And now your going to have a dynamic IP? That for sure could be problematic..

How many IPs do you own? Hosting your own dns for public consumption is almost always a bad idea..

[dennypage]

@johnpoz said in Register DHCP WAN address with unbound?:

@dennypage said in Register DHCP WAN address with unbound?:

so is authoritative for mydomain.net.
To the public? And now your going to have a dynamic IP? That for sure could be problematic..

No, not authoritative to the public. Authoritative to the LAN segments.

Publicly available DNS names->addresses are handled by the registrar's DNS servers. pfSense registers its WAN interface as one of these with the registrar via dynamic dns. The registered one is "vpn.mydomain.net"

The 100 or so internal DNS names, such as "host1.mydomain.net" are assigned via DHCP, and resolved locally via Unbound. As a result, Unbound considers itself authoritative or "mydomain.net". So when a local host does a DNS lookup for "vpn.mydomain.net", Unbound will return not found.

What I am looking for is a way to tell unbound that "vpn.mydomain.net" should resolve to the (current) WAN address of the firewall.

[johnpoz]

@dennypage said in Register DHCP WAN address with unbound?:

when a local host does a DNS lookup for "vpn.mydomain.net", Unbound will return not found.

That is not the default behavior - the default zone type is transparent, so if your using the same domain locally as public.. ie mydomain.net and there is no vpn.mydomain.net unbound would look it up via public.

If you had change the zone to static vs transparent then yeah it wouldn't look up anything that wasn't local for mydomain.net. But out of the box the zone type is transparent.

edit:
https://docs.netgate.com/pfsense/en/latest/services/dns/resolver-config.html

[dennypage]

@johnpoz said in Register DHCP WAN address with unbound?:

That is not the default behavior - the default zone type is transparent, so if your using the same domain locally as public.. ie mydomain.net and there is no vpn.mydomain.net unbound would look it up via public.

If you had change the zone to static vs transparent then yeah it wouldn't look up anything that wasn't local for mydomain.net. But out of the box the zone type is transparent.

Thanks John. Yes, I changed it a couple of years ago as part of a shift from using another local host as a DNS master. Now I'll have to go back and research why it was necessary...

[johnpoz]

@dennypage I have mine set to static - just for being a good netizen. I use local domain so there would be zero reason to try and resolve either local.lan or home.arpa from the public dns.

So if I typo something, or try and get to something in my local dns that does not have a record there would be zero reason to try and normally resolve it via public.

I never been a fan of using the same domain both public and local, can lead to all kinds bad stuff. If going to use same parent domain.net you should prob use say say sub locally like local.domain.net, or domain.net locally and like domain.org public..

But yeah transparent should resolve your current issue.. can resolve all your local resources, and when trying to resolve vpn.yourdomain.net it would return your public IP via normal dns resolution your using either resolving for forwarding.

[NollipfSense]

@dennypage said in Register DHCP WAN address with unbound?:

The 100 or so internal DNS names, such as "host1.mydomain.net" are assigned via DHCP, and resolved locally via Unbound. As a result, Unbound considers itself authoritative or "mydomain.net". So when a local host does a DNS lookup for "vpn.mydomain.net", Unbound will return not found.

Set host override here should work, that's if pfSense is doing DNS...

[dennypage]

@NollipfSense said in Register DHCP WAN address with unbound?:

The 100 or so internal DNS names, such as "host1.mydomain.net" are assigned via DHCP, and resolved locally via Unbound. As a result, Unbound considers itself authoritative or "mydomain.net". So when a local host does a DNS lookup for "vpn.mydomain.net", Unbound will return not found.
Set host override here should work, that's if pfSense is doing DNS...

? More words please...

[NollipfSense]

@dennypage said in Register DHCP WAN address with unbound?:

@NollipfSense said in Register DHCP WAN address with unbound?:

The 100 or so internal DNS names, such as "host1.mydomain.net" are assigned via DHCP, and resolved locally via Unbound. As a result, Unbound considers itself authoritative or "mydomain.net". So when a local host does a DNS lookup for "vpn.mydomain.net", Unbound will return not found.
Set host override here should work, that's if pfSense is doing DNS...

? More words please...

Services > DNS Resolver > General Settings: scroll to the bottom of page...your DNS must be set to:

Configure your "mydomain.net" or vpn.mydomain.net with the IP and pfSense will resolve it.

[johnpoz]

@NollipfSense said in Register DHCP WAN address with unbound?:

Configure your "mydomain.net" or vpn.mydomain.net with the IP and pfSense will resolve it.

That would be easy solution if was static - but as stated in the first post, he is moving to a dynamic IP. So if it does happen to change and they have a host override set for it - it would be resolving the wrong IP.

Now maybe the dynamic doesn't change - I have had the same dynamic IP for years at a time.. But even when its like that, you never know when it could change. Last time mine changed it was because the isp merged and their was a whole restructuring of the IP space - that doesn't happen often most likely. But when your on a dynamic IP you have no control over when it "could" change.

[NollipfSense]

@johnpoz said in Register DHCP WAN address with unbound?:

he is moving to a dynamic IP

Forgot that part...

[Gertjan]

@dennypage said in Register DHCP WAN address with unbound?:

Does anyone know of a way to register the current DHCP WAN address with unbound? Similar to the way that you would use a dynamic DNS service, except for the local unbound server.

I'm not sure if my IPv4 WAN is really dynamic, as it never changes.
I've a Dyndns running, just in case.

So, on a LAN device :

Microsoft Windows [version 10.0.22621.2134]
(c) Microsoft Corporation. Tous droits réservés.

C:\Users\Gauche>nslookup home.brit-hotel-fumel.fr
Serveur :   pfSense.brit-hotel-fumel.net
Address:  2a01:cb19:907:a6dc:92ec:77ff:fe29:392c

Réponse ne faisant pas autorité :
Nom :    home.brit-hotel-fumel.fr
Address:  82.127.26.108

"Register in unbound" means locking a host name on an IP, right ?
Where ever I need my WAN IP (I guess, I don't) I use this host name.

Btw : 188.165.53.87 is the zone master of all my publicly accessible host names (domain names).

I 'own' this domain dot net name, and use it only locally, for my LAN/pfSense needs :

[NollipfSense]

@Gertjan said in Register DHCP WAN address with unbound?:

the zone master of all my publicly accessible host names (domain names).

I 'own' this domain dot net name,

I found it best also to have a real domain (often a $10/yr cost) and Cloudflare DNS but resolve locally.

[Bob.Dig]

@johnpoz said in Register DHCP WAN address with unbound?:

I never been a fan of using the same domain both public and local, can lead to all kinds bad stuff. If going to use same parent domain.net you should prob use say say sub locally like local.domain.net, or domain.net locally and like domain.org public..

Interesting. Just the other day I saw in an email header of mine that it would use home.arpa in it and I thought this is not looking "professional", so I changed some hosts to my external domain.

[Gertjan]

@NollipfSense said in Register DHCP WAN address with unbound?:

I found it best also to have a real domain (often a $10/yr cost)

Exact.
And it comes with a free bonus : free certificates.