unbound: unblock-lan-zones

[osn1803]

Salutations --

Just thought I'd note, as we close in on the drop-dead date for "Custom options" in the unbound GUI, that my use for this feature is to add this section:

server:
   unblock-lan-zones: yes

I forward requests for my own domain to an internal authoritative server using overrides, and the above declaration is needed to make the PTR lookups work for RFC1918 addresses. If you felt like adding a toggle for that in the GUI someday, that'd be appreciated; else I'm fine with adding it manually in /var/unbound/etc in future.

Thanks again for an outstanding piece of software.

[Maurice]

Did you add domain overrides for your RFC1918 reverse lookup zones (like [..].168.192.in-addr.arpa)? These work without setting unblock-lan-zones. This option is only required for upstream RFC1918 PTR record lookups.

[osn1803]

Thank you for your note. Yes, the reverse zones are in the overrides (168.192.in-addr.arpa, as well as a v6 net block). PTR lookups from attached clients definitely don't work unless unblock-lan-zones is specified. I'm not anyone's expert on DNS, so I may misunderstand what is meant by "upstream", but the authoritative server is on a different network from the client, beyond the unbound resolver (via another LAN route, not the WAN).

[Maurice]

Does the IPv6 reverse lookup zone use ULAs (.d.f.ip6.arpa)? I was indeed able to identify a bug which breaks such domain overrides: https://github.com/opnsense/core/pull/4663

But IPv4 reverse lookup zones should not be affected. I use several .in-addr.arpa domain overrides with RFC1918 addresses and they work just fine (without 'unblock-lan-zones'). Could you double-check?

[osn1803]

Well. That's puzzling. Or I have no idea what I'm doing.

On a hunch, I UNchecked "Disable DNS rebinding check" in System->Settings->Administration, and sure enough, reverse lookups for overridden zones now work correctly without unblock-lan-zones. That is the opposite of what I'd expect the effect of "Disable DNS rebinding check" to be, based on the help text:

"When this is unchecked, your system is protected against DNS Rebinding attacks. This blocks private IP responses from your configured DNS servers. Check this box to disable this protection if it interferes with web GUI access or name resolution in your environment."

I'm not sure I understand why unchecking that allows PTR queries for private addresses, and selecting it causes them to fail.

Re: IPv6 addresses - PTR lookups for those were not affected in my case, because mine are publicly routed (I have an HE tunnel allocation). The IPv4 addresses are all in 192.168/16.

Thank you very much for the info.

[Maurice]

You found another bug! Disabling DNS rebinding checks should indeed not break domain overrides for private reverse lookup zones.

Unbound by default filters all reverse lookups for private and reserved IP addresses. When you add a domain override for a reverse lookup zone, OPNsense adds an exception (typetransparent local-zone) which excludes that zone from filtering. But these exceptions are only added for IPv4 reverse lookup zones (bug #1) and only if DNS rebinding checks are enabled (bug #2).

I added another patch which should fix bug #2.

[osn1803]

Well, I'll be darned. Thank you!

So, the end result is that I can simplify my configuration, since I won't need unblock-lan-zones. Win-win.

Cheers, and thanks again.