Unbound DNS ACL Lists: refuse_non_local
lxa last edited by
I was looking into running the pfSense DNS server on my WAN interface because I want to be able to resolve internal hostnames with global names (including DHCP leases)
But I can't just open port 53 on the firewall because this would create an open resolver and answer any query from anywhere, which is bad.
I found that recent versions of Unbound have an access control option for this exact use case: refuse_non_local (also: deny_non_local)
So I installed Unbound and put this into the advanced options field:
server: access-control: 0.0.0.0/0 refuse_non_local access-control: ::/0 refuse_non_local
This works ( :) ) Now two questions:
Does this solution have horrible side-effects I might have overlooked?
(if it does not have horrible side-effects) Should these two options be part of the UI in Unbound DNS ACLs?
I'd like to take a shot at adding this. What's the process of submitting pfSense patches? Is there a getting-started-guide or something like that? Or is it just "send a pull request on pfsense/pfsense-packages"?