Current private-address default?

Unbound
1

Hi,

It was some years since this option was added (unbound 1.5.7 I think).
As per the man page for unbound.conf:

...skipping...
       private-address: <IP address or subnet>
              Give IPv4 of IPv6 addresses or classless subnets. These are
              addresses on your private network, and are not allowed to be
              returned for public internet names. Any occurrence of such
              addresses are removed from DNS answers. Additionally, the DNSSEC
              validator may mark the answers bogus. This protects against
              so-called DNS Rebinding, where a user browser is turned into a
              network proxy, allowing remote access through the browser to
              other parts of your private network. Some names can be allowed
              to contain your private addresses, by default all the local-data
              that you configured is allowed to, and you can specify addi‐
              tional names using private-domain. No private addresses are
              enabled by default. We consider to enable this for the RFC1918
              private IP address space by default in later releases. That
              would enable private addresses for 10.0.0.0/8 172.16.0.0/12
              192.168.0.0/16 169.254.0.0/16 fd00::/8 and fe80::/10, since the
              RFC standards say these addresses should not be visible on the
              public internet.

Q: Are there any plans to update this and add the RFC1918 addresses
as non-resolvable by default ?

(I’ve noticed that we do see some errors that is an artefact of unbound still are
allowing those by default)

Re,
/P

2

I hope not. I think that would lead to many unexpected failures. I think this is an item that the DNS admin should enable if they are confident.

Additionally, if using unbound on laptops and you getting on via hotspots this would break badly.

Paul

3

After an internal discussion we came to a similar conclusion.
Perhaps the man-page should delete this sentence:

  "We consider to enable this for the RFC1918
   private IP address space by default in later releases"

…since it hasen’t happened in the last ~7 years now :slight_smile:

We’re are using this:

  do-not-query-address: <RFC1918-addresses>

Perhaps a new complimentary option to "do-not-query-localhost” would be useful.
(For example, a "do-not-query-rfc1918: yes/no” -option)

Thx,
/P