OPNsense Forum

Archive => 22.1 Legacy Series => Topic started by: Mitzsch on April 17, 2022, 10:36:53 am

Title: [unbound] host override won't work when DHCP registration is turned on.
Post by: Mitzsch on April 17, 2022, 10:36:53 am
Hello everyone!

I just noticed in case dhcp registration is turned on and you add an entry to the host override page it would not work correctly. It only won't work for machines that are also registered by the dhcp registration option.
For example:
My main rig "192.168.1.110" is registered by the dhcp registration option as "HomePC". Now when I add "TestHomePC" with the same "192.168.1.110" IP as a Host override it won't resolve it.

Code: [Select]
nslookup HomePC
Server:  OPNsense.home
Address:  192.168.1.1

Name:    HomePC.home
Address:  192.168.1.110

were as

Code: [Select]
nslookup TestHomePC
Server:  OPNsense.home
Address:  192.168.1.1

*** TestHomePC wurde von OPNsense.home nicht gefunden: Non-existent domain.

All entries are correctly propagated to their config files. Two different hostnames with the same IP - both set in the host override page - work fine - it just won´t work when one is set by the dhcp registration option and the other one manually. In this case, both entries are in two different config files which seems to break it.

Is this supposed to be working?

Thanks! (:

(EDIT: I´m running OPNsense 22.1.6-amd64)
Title: Re: [unbound] host override won't work when DHCP registration is turned on.
Post by: arcaen on April 30, 2022, 01:24:05 am
Hey!

So I ran into a very similar situation where I wanted to add host overrides so that
Code: [Select]
*.computer.example.com gets redirected to
Code: [Select]
computer.example.com because thats where I have an NGINX reverse-proxy to direct traffic based off of subdomains.

I noticed that with DHCP lease registration in Unbound I was no longer able to get any overrides working anymore.

I was poking around the unbound configuration in
Code: [Select]
/var/unbound on the server and noticed that
Code: [Select]
/var/unbound/dhcpleases.conf gets included AFTER
Code: [Select]
/var/unbound/host_entries.conf, and that order seems to be important when it comes to these things in unbound.
Here's the include order:
Code: [Select]
...

# DNS Rebinding


# Private domains (DNS Rebinding)
include: /var/unbound/private_domains.conf

# Access lists
include: /var/unbound/access_lists.conf

# Static host entries
include: /var/unbound/host_entries.conf

# DHCP leases (if configured)
include: /var/unbound/dhcpleases.conf

# Custom includes
include: /var/unbound/etc/*.conf

...

I also noticed that part of the unbound startup script is to clear out the conf files in
Code: [Select]
/var/unbound and repopulate them, meaning that i can't just directly add my overrides directly to those conf files.
The last set of conf files to be included though, are
Code: [Select]
/var/unbound/etc/*.conf
Those conf files originally live within
Code: [Select]
/usr/local/etc/unbound.opnsense.d/ and get copied over on unbound startup

what I ended up doing was creating a new custom.conf file within that directory, and added my unbound settings in there (btw I am very much a newb at unbound so this might not be the right way to do this, but it works for me and my use case. hopefully someone with a better understanding of unbound could chime in and explain exactly what is happening)
Code: [Select]
local-data: "media.example.com IN A 10.0.0.69"   // this is a new record, media is not an existing hostname
local-zone: "computer.example.com" redirect      // this is to redirect *.computer.example.com to computer.example.com
local-data: "computer.example.com A 10.0.0.69"   // i honestly dont know why this is "needed" but it gets mad and doesnt work right if i dont do this
local-zone: "media.example.com" redirect         // this is to redirect *.media.example.com to media.example.com
local-data: "media.example.com A 10.0.0.69"      // same as above, doesnt work right if i dont include this

after doing that and restarting unbound in the OPNSense UI i was succesfully able to get nslookup for media.example.com to return the right IP address, as well as subdomain.media.example.com. this worked with computer.example.com and subdomain.computer.example.com as well.

I still have DHCP lease registration enabled and have no issues with this setup.

Hope this helps!
Title: Re: [unbound] host override won't work when DHCP registration is turned on.
Post by: EdwinKM on April 30, 2022, 09:19:30 am
Not sure, possible related to https://github.com/opnsense/core/issues/5599 ?