Getting Refused from stub-zone authoritative query record_Follow_up

NSD
1

I would like to follow up on my previous message on the mailing list by saying that I have finally focused my issue to the tsig/ key ... The authoritative nsd1(master) & nsd2 (slave) after NOKEY change works without an issue and I'm able to get zone records; having said that, I would like to have the keys set up / DNSSEC.

When setting up keys, setting up allow-query, and setting up patterns on each zone the previous unbound log still occurs (refuse) BUT now I can see new logs in the NSD not previously available (SLAVE ns2 works with keys and without keys meaning it gets serial from each of the zones in master / no error in nsd log)...

  The new logs entries after TSIG changes in nsd.log (Master):

[2022-12-10 19:17:57.370] nsd[6338]: info: query example.com. from DNS1 (unbound1_Global) refused, no acl matches .
[2022-12-10 19:17:57.778] nsd[6338]: info: query example.com. from DNS1 (unbound1_Local_Alias) refused, no acl matches .
[2022-12-10 19:17:57.370] nsd[6338]: info: query example.com. from DNS2 (unbound1_Global) refused, no acl matches .
[2022-12-10 19:17:57.778] nsd[6338]: info: query example.com. from DNS2 (unbound1_Local_Alias) refused, no acl matches .

This occurs every time I used drill/dig to get information on the NSD zones I set up with the key.

I have looked into the issues but I have not been able to find exactly what the log means no acl matches or how to remedy it because I was under the impression that with the allow-query option in the pattern section and adding it to the zones it would serve as an access control list for NSD (maybe there is something else I must add as an acl). Any assistance on properly configuring this final step would be appreciated, I am kind of stuck at the moment.

2

Hi Josh,

Setting up an acl does not relate to DNSSEC. It's really just
specifying which machines are allowed to query, xfr, etc. Normally,
you'd want to limit which machines are allowed to IXFR/AXFR the zone,
I'm not sure that applies in this situation though as it seems you just
want Unbound to redirect queries for internal domains to your
authoratative servers?

In that case, I think you only want to specify provide-xfr, etc and
leave allow-query alone(?)

If you really want to limit the machines that are allowed to query as
well, you probably want to check which source address is used for the
query. Perhaps just list all IPs assigned to your Unbound machines in
the NSD configuration(?)

I'd try limiting to IP first, and include TSIG after you're sure that
works (assuming you're still in a lab environment).

Hope that helps. Of course, feel free to follow up if you need
additional help.

- Jeroen