Unbound DNS ACL Lists: refuse_non_local



  • I was looking into running the pfSense DNS server on my WAN interface because I want to be able to resolve internal hostnames with global names (including DHCP leases)

    But I can't just open port 53 on the firewall because this would create an open resolver and answer any query from anywhere, which is bad.

    I found that recent versions of Unbound have an access control option for this exact use case: refuse_non_local (also: deny_non_local)

    So I installed Unbound and put this into the advanced options field:

    server: 
    access-control: 0.0.0.0/0 refuse_non_local 
    access-control: ::/0 refuse_non_local
    

    This works ( :) ) Now two questions:

    • Does this solution have horrible side-effects I might have overlooked?

    • (if it does not have horrible side-effects) Should these two options be part of the UI in Unbound DNS ACLs?

      I'd like to take a shot at adding this. What's the process of submitting pfSense patches? Is there a getting-started-guide or something like that? Or is it just "send a pull request on pfsense/pfsense-packages"?