Unbound needs Outgoing Network Interfaces set to resolve AAAA via IPv6

[maik3k]

Hello,

I am using OPNsense 23.7.10_1-amd64 and have a strange problem with Unbound. If I have set Unbound => General => Outgoing Network Interfaces to ALL (the default), I get a timeout from Unbound with the following query:

Code: [Select]

dig -t AAAA aaaa.v6ns.test-ipv6.com

; <<>> DiG 9.10.6 <<>> @10.1.1.1 -t AAAA aaaa.v6ns.test-ipv6.com
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
However, if I only add LAN to the Outgoing Network Interfaces, the query is resolved correctly:

Code: [Select]

dig -t AAAA aaaa.v6ns.test-ipv6.com

; <<>> DiG 9.10.6 <<>> @10.1.1.1 -t AAAA aaaa.v6ns.test-ipv6.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47182
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;aaaa.v6ns.test-ipv6.com. IN AAAA

;; ANSWER SECTION:
aaaa.v6ns.test-ipv6.com. 300 IN AAAA 2001:470:1:18::115

;; Query time: 331 msec
;; SERVER: 10.1.1.1#53(10.1.1.1)
;; WHEN: Thu Dec 21 16:28:04 CET 2023
;; MSG SIZE  rcvd: 80

I get a dynamic IPv4 and a dynamic /59 subnet from my provider. IPv6 generally works. How can I find out what is going wrong?

[Maurice]

Your primary IPv6 WAN address might be unroutable (this is unrelated to the /59 delegated prefix and IPv6 Internet access from the LAN).

Can you ping anything on the Internet from OPNsense when setting the source address to the primary WAN address?

Cheers
Maurice

[maik3k]

Thank you for your answer. Unfortunately, that is not the reason. I can ping from the OPNSense via the WAN IP:

Code: [Select]

ping -S MY_WAN_IPV6 www.google.de
PING6(56=40+8+8 bytes) MY_WAN_IPV6 --> 2a00:1450:400e:805::2003
16 bytes from 2a00:1450:400e:805::2003, icmp_seq=0 hlim=118 time=37.263 ms
16 bytes from 2a00:1450:400e:805::2003, icmp_seq=1 hlim=118 time=19.277 ms
16 bytes from 2a00:1450:400e:805::2003, icmp_seq=2 hlim=118 time=17.602 ms
16 bytes from 2a00:1450:400e:805::2003, icmp_seq=3 hlim=118 time=38.381 msWhat else could it be? It must be some kind of setting. I quickly set up an OPNSense from scratch on another system and connected it to the same modem. The problem does not occur there.

[Maurice]

Well, I guess I'd perform a packet capture on both systems and look for differences.

[maik3k]

I have actually found my problem. It is due to a buffer bloat fix that I took from this website (https://maltechx.de/en/2021/03/opnsense-setup-traffic-shaping-and-reduce-bufferbloat/). If I deactivate the rules, Unbound works again with IPv6 NS querys. But I don't understand the reason for this at all.