Unbound on ipv6

[johnpoz]

So ran through the setup on the welcome message.  Ran smooth as silk, had to toggle the default gateway on the wanipv6 I setup – but other than working great, dhcp works -- pointed dns to the HE.net dns, and hands that out great.

But running unbound and would like clients to use that, but when I tell unbound to use the lan, and wanipv6 interface created via the welcome thread instructions - unbound dies.

Any tricks here?  I have to run so will look at closer later - but shouldn't I be able to get unbound to listen on both ipv4 and ipv6 addresses?  But it seems to die when I do that, and get this error in the system log

Mar 6 18:22:43 php: /pkg_edit.php: The command '/usr/local/sbin/unbound-control start' returned exit code '1', the output was '/usr/local/etc/unbound/unbound.conf:32: error: stray '"' /usr/local/etc/unbound/unbound.conf:32: error: stray '"' read /usr/local/etc/unbound/unbound.conf failed: 2 errors in configuration file [1299457363] unbound[19270:0] fatal error: Could not read config file: /usr/local/etc/unbound/unbound.conf'

[johnpoz]

Ok I manually edit the config for unbound to do ipv6 queries, and listening on ipv6 address and allow queries from my ipv6 local network and seems to be working.  Would be better to do from gui though.

[tebeve]

Hey John,

What exactly did you edit in your unbound config to get this to work?
Does it stick for you after reboot or are you manually reediting each time?

[johnpoz]

I have not tried a reboot that I recall, but here is what I edited.

interface: ::0
do-ip6: yes
access-control: 2001:470:snipped:b85::/64 allow

; <<>> DiG 9.7.1-P2 <<>> @2001:470:snipped:b85::1 www.google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16642
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.com.                        IN      A

;; ANSWER SECTION:
www.google.com.        583225  IN      CNAME  www.l.google.com.
www.l.google.com.      300    IN      A      74.125.225.20
www.l.google.com.      300    IN      A      74.125.225.19
www.l.google.com.      300    IN      A      74.125.225.18
www.l.google.com.      300    IN      A      74.125.225.17
www.l.google.com.      300    IN      A      74.125.225.16

;; Query time: 86 msec
;; SERVER: 2001:470:snipped:b85::1#53(2001:470:snipped:b85::1)
;; WHEN: Thu Mar 10 17:08:52 2011
;; MSG SIZE  rcvd: 132

2001:470:snipped:b85::1 is the ipv6 address on lan interface of my pfsense box

When I get home will try a reboot.

[tebeve]

oh man, i totally missed access-control… duh.

thanks John!

[wagonza]

Thanks @johnpoz - i'll look into adding proper IPv6 support in the next couple of days.

[tebeve]

@wagonza:

Thanks @johnpoz - i'll look into adding proper IPv6 support in the next couple of days.

That would be awesome! Thank you!

[iFloris]

Wagonza, is there any news on the 'proper' support in unbound?

[wagonza]

@iFloris:

Wagonza, is there any news on the 'proper' support in unbound?

Yeah finally! Just update to the latest package. It will automatically setup to listen on the interfaces that have v6 configured and setup the appropriate ACLs for that interface.
I still need to do work on the ACLs page to specify other networks but for now this support should suffice.

Let me know if you have any problems - either respond here, DM me or catch me on twitter (@wagonza).

[tebeve]

fan-freakin-tastic! Thanks Wagonza!

[iFloris]

Thanks Wagonza, very nice and useful!