Unbound DNS ACL Lists: refuse_non_local

[lxa]

I was looking into running the pfSense DNS server on my WAN interface because I want to be able to resolve internal hostnames with global names (including DHCP leases)

But I can't just open port 53 on the firewall because this would create an open resolver and answer any query from anywhere, which is bad.

I found that recent versions of Unbound have an access control option for this exact use case: refuse_non_local (also: deny_non_local)

So I installed Unbound and put this into the advanced options field:

server: 
access-control: 0.0.0.0/0 refuse_non_local 
access-control: ::/0 refuse_non_local

This works ( :) ) Now two questions:

• Does this solution have horrible side-effects I might have overlooked?

• (if it does not have horrible side-effects) Should these two options be part of the UI in Unbound DNS ACLs?

  I'd like to take a shot at adding this. What's the process of submitting pfSense patches? Is there a getting-started-guide or something like that? Or is it just "send a pull request on pfsense/pfsense-packages"?