Date: Sat, 25 Jul 2015 14:11:33 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 196138] Unbound fails with 2(SERVFAIL) when behind NAT Message-ID: <bug-196138-8-oOTcfZmRAm@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-196138-8@https.bugs.freebsd.org/bugzilla/> References: <bug-196138-8@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=196138 --- Comment #3 from christop@physik.tu-berlin.de --- Yes and no. No, because the default installation fails. I booted FreeBSD-10.2-PRERELEASE-amd64-20150704-r285132-bootonly.iso and made an network install. Unbound is of version 1.4.22. I do not think this a problem with the unbound software, but with the unbound configuration or DNSSEC in general. In the default configuration with dnssec unbound tries to get the DNSSEC public keys from the upstream nameserver, but the upstram nameserver does not deliver. Without public keys unbound cannot do validate the domain and fails. This behaviour is correct, because otherwise any attacker could disable DNSSEC. Yes, when I edit my /etc/resolv.conf root@freebsd:~ # cat /etc/resolv.conf search home nameserver 8.8.8.8 options edns and run root@freebsd:~ # /etc/rc.d/local_unbound setup Performing initial setup. Extracting forwarders from /etc/resolv.conf. original /var/unbound/forward.conf saved as /var/unbound/forward.conf.20150725.174438 /var/unbound/lan-zones.conf not modified /var/unbound/unbound.conf not modified /etc/resolvconf.conf not modified original /etc/resolv.conf saved as /etc/resolv.conf.20150725.174438 and then unbound config looks like root@freebsd:~ # cat /etc/unbound/forward.conf # Generated by local-unbound-setup # Do not edit this file. forward-zone: name: . forward-addr: 8.8.8.8 After an restart of unbound root@freebsd:~ # /etc/rc.d/local_unbound restart unbound resolves hosts: root@freebsd:~ # host google.com google.com has address 216.58.213.46 google.com has IPv6 address 2a00:1450:4008:800::1007 google.com mail is handled by 10 aspmx.l.google.com. google.com mail is handled by 40 alt3.aspmx.l.google.com. google.com mail is handled by 20 alt1.aspmx.l.google.com. google.com mail is handled by 30 alt2.aspmx.l.google.com. google.com mail is handled by 50 alt4.aspmx.l.google.com. When you are using DHCP, it will overwrite /etc/resolv.conf and unbound will be back to use the DHCP provided DNS Server. In short: Correctly configured Unbound works for me. Default configuration does not work. DNSSEC by design does not work with forward nameserver, which does not answer for public DNSSEC keys. This should be mentioned somewhere explicitly, because in my opinion the most SOHO devices do not run a DNSSEC aware DNS Server. -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-196138-8-oOTcfZmRAm>