Hi guys!
I'm facing a problem with NSD behind Unbound. What I want to
achieve is to have Unbound acting as a resolver for my LAN but
with some stub-zones for my local zones.
My setup is the following:
* OpenBSD 6.3 - dns1.doe.com (master)
Unbound listening on 10.10.11.13@53
NSD listening on 10.10.11.13@5353
* OpenBSD 6.3 - dns2.doe.com (slave)
Unbound listening on 10.10.11.14@53
NSD listening on 10.10.11.14@5353
## Unbound
Here is my Unbound configuration :
server:
interface: 10.10.11.13
interface: 127.0.0.1
interface: ::1
verbosity: 5
do-not-query-localhost: no
access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow_snoop
access-control: 10.10.11.0/24 allow_snoop
access-control: ::0/0 refuse
access-control: ::1 allow_snoop
hide-identity: yes
hide-version: yes
auto-trust-anchor-file: "/var/unbound/db/root.key"
local-zone: "11.10.10.in-addr.arpa" typetransparent
stub-zone:
name: "11.10.10.in-addr.arpa"
stub-addr: 10.10.11.13@5353
stub-zone:
name: "doe.com"
stub-addr: 10.10.11.13@5353
## NSD
Here is the NSD configuration :
server:
hide-version: yes
verbosity: 3
database: "" # disable database
logfile: "/var/log/nsd.log"
## bind to a specific address/port
ip-address: 10.10.11.13@5353
ip-address: 127.0.0.1@5353
remote-control:
control-enable: yes
control-port: 8953
## tsig key example
key:
name: "dns01.doe.com"
secret: "XXXXXXXXXXXXXXXXXXXXXXXXX"
pattern:
name: "talktoslave"
notify: 10.10.11.14 dns01.doe.com
provide-xfr: 10.10.11.14 dns01.doe.com
outgoing-interface: 10.10.11.13
zone:
name: "11.10.10.in-addr.arpa"
zonefile: "%s"
include-pattern: "talktoslave"
zone:
name: "doe.com-internal"
zonefile: "%s"
include-pattern: "talktoslave"
Now when I try to resolve john.doe.com :
$ dig @10.10.11.13 john.doe.com
; <<>> DiG 9.4.2-P2 <<>> @10.10.11.13 john.doe.com
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16717
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0,
ADDITIONAL: 0
;; QUESTION SECTION:
;john.doe.com. IN A
;; Query time: 11 msec
;; SERVER: 10.10.11.13#53(10.10.11.13)
;; WHEN: Wed Jul 25 07:52:41 2018
;; MSG SIZE rcvd: 31
And if I look into the logs I'm getting :
Jul 25 06:17:56 dns01 unbound: [39653:0] info: validator operate: query john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: resolving john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: use stub doe.com. NS IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: DelegationPoint<doe.com.>: 0 names (0 missing), 1 addrs (0 result, 1 avail) parentNS
Jul 25 06:17:56 dns01 unbound: [39653:0] info: resolving (init part 2): john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: use stub doe.com. NS IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: resolving (init part 3): john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: processQueryTargets: john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: DelegationPoint<doe.com.>: 0 names (0 missing), 1 addrs (0 result, 1 avail) parentNS
Jul 25 06:17:56 dns01 unbound: [39653:0] info: sending query: john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: mesh_run: end 1 recursion states (1 with reply, 0 detached), 1 waiting replies, 1 recursion replies sent, 0 replies dropped, 0 states jostled out
Jul 25 06:17:56 dns01 unbound: [39653:0] info: average recursion processing time 0.006881 sec
Jul 25 06:17:56 dns01 unbound: [39653:0] info: histogram of recursion processing times
Jul 25 06:17:56 dns01 unbound: [39653:0] info: [25%]=0 median[50%]=0 [75%]=0
Jul 25 06:17:56 dns01 unbound: [39653:0] info: lower(secs) upper(secs) recursions
Jul 25 06:17:56 dns01 unbound: [39653:0] info: 0.004096 0.008192 1
Jul 25 06:17:56 dns01 unbound: [39653:0] info: 0RDd mod1 rep john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: iterator operate: query john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: scrub for doe.com. NS IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: response for john.doe.com. A IN
Jul 25 06:17:56 dns01 unbound: [39653:0] info: reply from <doe.com.> 10.10.11.13#5353
Jul 25 06:17:56 dns01 unbound: [39653:0] info: incoming scrubbed packet: ;; ->>HEADER<<- opcode: QUERY, rcode: REFUSED, id: 0 ;; flags: qr ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: john.doe.com. IN A ;; ANSWER SECTION: ;; AUTHORITY SECTION: ;; ADDITIONAL SECTION: ;; MSG SIZE rcvd: 31
Jul 25 06:17:56 dns01 unbound: [39653:0] info: query response was THROWAWAY
Jul 25 06:17:56 dns01 unbound: [39653:0] info: processQueryTargets: john.doe.com. A IN
Do you guys know why I get a "rcode: REFUSED" here?
Thanks,