core icon indicating copy to clipboard operation
core copied to clipboard

Unbound does not respond to DNS queries on ::1 when redirecting from any network except loopback

Open Unspec7 opened this issue 1 year ago • 0 comments

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

  • [x] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
  • [x] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

When using the unbound plugin, creating a redirect rule that redirects IPv6 DNS traffic on port 53 to the loopback address of ::1 on whatever port unbound is set to does not actually allow DNS queries. Firewall permits it just fine and the redirect rules work, Unbound just doesn't respond.

Redirecting ::1#53 to ::1#unboundPort works fine, at least when running dig on the opnsense machine itself. IPv4 redirects to 127.0.01 work fine as well.

To Reproduce

Steps to reproduce the behavior:

  1. Create a redirect rule (LAN interface, any source/port, destination LAN IPv6 port 53, redirect ::1 port [unboundPort]
  2. On a LAN attached device, run "dig google.com @[LAN IPv6]"
  3. Communication error
  4. Change redirect rule to redirect to LAN IPv6 address port [unboundPort]
  5. Run same command
  6. Dig successful

Expected behavior

Unbound to respond on ::1. IPv4 redirect rules to 127.0.0.1 respond just fine.

Describe alternatives you considered

Redirecting to the actual LAN IPv6 address instead of Loopback ::1

Environment

OPNsense 24.7.5_3 (amd64).

Unspec7 avatar Oct 03 '24 22:10 Unspec7