DNS rebind issue maybe???

[wgstarks]

I recently lost access to my unraid webui. Suddenly started getting a nginx 404 error but could access the page using the private IP address. All my DNS is handled by pfsense.

Unraid uses LE certificates for SSL and a special myunraid.net address in the form https://<IP>.<random alpha numeric>.myunraid.net. This has been working for years but suddenly stopped working.

Users in the unraid forum suggested adding this to DNS Resolver custom options (so-reuseport: no was already there)-

This only seems to work if I also disable rebind checks in sytem>advanced. I think I must be missing something else.

[stephenw10]

The dns rebinding check usually only triggers if you're hitting the webgui using an fqdn that isn't the firewall. So what is it resolving to?

[wgstarks]

It resolves to a nginx 404 error.

[johnpoz]

@wgstarks that looks like it resolved to me, just the server sent back a 404.

A rebind would not send you an answer.. I have my plex.direct setup as private.. And it resolves to its local rfc1918 IP.

$ dig 192-168-9-10.90a72f9<snipped>b25c.plex.direct

; <<>> DiG 9.16.50 <<>> 192-168-9-10.90a72f93c<snipped>c0bb25c.plex.direct
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38246
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;192-168-9-10.90a72f9<snipped>b25c.plex.direct. IN A

;; ANSWER SECTION:
192-168-9-10.90a72f93c<snipped>b25c.plex.direct. 8109 IN A 192.168.9.10

;; Query time: 7 msec
;; SERVER: 192.168.3.10#53(192.168.3.10)
;; WHEN: Fri Jun 19 19:16:29 Central Daylight Time 2026
;; MSG SIZE  rcvd: 102

I snipped out unique part of the query.

[wgstarks]

But everything works if I disable the rebind protection.

[stephenw10]

But what address does that fqdn resolve to?

[wgstarks]

@stephenw10
I’m not sure what you’re asking? It resolved to my Unraid server until yesterday.
<lan ip>.<hash>.myunraid.net

When I try to configure it now in Unraid I get a warning that rebind protection is on but that I should be able to disable it selectively in pfsense by setting DNS Resover custom options to
server:
private-domain: "myunraid.net"

That doesn’t appear to work.

[johnpoz]

@wgstarks said in DNS rebind issue maybe???:

When I try to configure it now in Unraid

dude do a simple query, with your fav dns client, dig, host, nslookup, doggo.

If you are asking unbound look up something.domain.tld and it has to go ask something else, and it gets back rfc1918 - that is a rebind and you will get no answer.. Here I turned off my plex private domain

See how put a # in front to comment that command out.

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11141
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;192-168-9-10.90a72<snipped>0bb25c.plex.direct. IN A

;; Query time: 141 msec
;; SERVER: 192.168.9.253#53(192.168.9.253)
;; WHEN: Fri Jun 19 21:00:48 Central Daylight Time 2026
;; MSG SIZE  rcvd: 86

See get back noerror - but no answer..

Let us see your query.. Maybe what your looking for has a cname returned, and this cname is hitting a rebind because you do not have it set to a private.

here I asked 8.8.8.8 directly - no rebind protection

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;192-168-9-10.90a72<snipped>b25c.plex.direct. IN A

;; ANSWER SECTION:
192-168-9-10.90a72f9<snipped>b25c.plex.direct. 21600 IN A 192.168.9.10

;; Query time: 126 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Jun 19 21:04:58 Central Daylight Time 2026
;; MSG SIZE  rcvd: 102

How rebind protection works - is if unbound does not have what is asked for as a local resource, ie it resolves something or forwards to get an answer and the answer is an rfc1918, that is a rebind and unbound will not return this answer to the client.

If you say if you completely turn off rebind it works.. Then that points to something being asked for that you have not listed as a private domain.

A simple query to unbound running on pfsense if no answer for something at say googledns answers rfc1918 then pfsense is doing rebind protection for that domain.. If you get an answer from unbound that you have either have a matching private domain set, or unbound completely off. If you have to completely disable rebind - tells me your private domain setting isn't actually matching what is being asked for.

[wgstarks]

wgstarks@walters-m4-mini ~ % nslookup https://10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net/
Server: 10.0.1.1
Address: 10.0.1.1#53

** server can't find https://10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net/: NXDOMAIN

wgstarks@walters-m4-mini ~ %

[johnpoz]

@wgstarks that is not a valid query - drop the https://

$ dig 10-0-1-20.0f613bbcc2f814341fd47af475a59915536d584d.myunraid.net @8.8.8.8

; <<>> DiG 9.16.50 <<>> 10-0-1-20.0f613bbcc2f814341fd47af475a59915536d584d.myunraid.net @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15941
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;10-0-1-20.0f613bbcc2f814341fd47af475a59915536d584d.myunraid.net. IN A

;; ANSWER SECTION:
10-0-1-20.0f613bbcc2f814341fd47af475a59915536d584d.myunraid.net. 21600 IN A 10.0.1.20

;; Query time: 95 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Jun 19 21:32:20 Central Daylight Time 2026
;; MSG SIZE  rcvd: 108

[wgstarks]

@johnpoz said in DNS rebind issue maybe???:

tells me your private domain setting isn't actually matching what is being asked for.

I believe you've got it. I just realized that I had server: private-domain: "myunraid.net".
Changing it to server: private-domain: 'myunraid.net' seems to have fixed it.

[wgstarks]

@johnpoz said in DNS rebind issue maybe???:

that is not a valid query - drop the https://

Doesn't seem to have changed anything but I can access the unraid server now.

wgstarks@walters-m4-mini ~ % nslookup 10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net/
Server: 10.0.1.1
Address: 10.0.1.1#53

** server can't find 10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net/: NXDOMAIN

[wgstarks]

said in DNS rebind issue maybe???:

@johnpoz said in DNS rebind issue maybe???:

tells me your private domain setting isn't actually matching what is being asked for.

I believe you've got it. I just realized that I had server: private-domain: "myunraid.net".
Changing it to server: private-domain: 'myunraid.net' seems to have fixed it.

I also had the DNS Resolver Custom Options entered on two lines so changing it to all be on one line may also have fixed it???

[tinfoilmatt]

Need to drop the trailing forward slash, too.

[wgstarks]

@tinfoilmatt said in DNS rebind issue maybe???:

Need to drop the trailing forward slash, too.

How's this-

wgstarks@walters-m4-mini ~ % nslookup 10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net 8.8.8.8
Server:		8.8.8.8
Address:	8.8.8.8#53

Non-authoritative answer:
Name:	10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net
Address: 10.0.1.20

wgstarks@walters-m4-mini ~ %

I think that means everything is good now right?

[tinfoilmatt]

Unbound docs say that only whitespace is necessary to separate keywords contained in the unbound.conf file, but remarks on visual clarity (and utilizes newlines in the example.conf file).

https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#file-format

[johnpoz]

@wgstarks said in DNS rebind issue maybe???:

I think that means everything is good now right?

that shows that you know how to do a query, and yes it returns rfc1918 ;)

now do that query against pfsense - if its doing rebind you will not get an answer. If not doing rebind for that domain via private domain setting you will get an answer.

[wgstarks]

@johnpoz said in DNS rebind issue maybe???:

@wgstarks said in DNS rebind issue maybe???:

I think that means everything is good now right?

that shows that you know how to do a query, and yes it returns rfc1918 ;)

now do that query against pfsense - if its doing rebind you will not get an answer. If not doing rebind for that domain via private domain setting you will get an answer.

Here is what I get-

wgstarks@walters-m4-mini ~ % nslookup 10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net
Server:		10.0.1.1
Address:	10.0.1.1#53

Non-authoritative answer:
Name:	10-0-1-20.0f613bbcc<snip>5536d584d.myunraid.net
Address: 10.0.1.20

wgstarks@walters-m4-mini ~ % 

Looks correct to me but obviously I don't know what I'm doing.

[johnpoz]

@wgstarks yeah rebind is off there, or unbound would not return that rfc1918 address (10.X.X.X)

So your stuff working now, without having to completely disable rebind protection?

[wgstarks]

Thanks to everyone for your help. I never would have solved this problem without it.