unbound not accepting a stub or forward pointing to a loopback interface.

Unbound
1

Greetings,

I've got a resolve server setup, using OpenBSD, unbound, and nsd. (hence the crosspost)

The setup is as follows;

unbound is listening on a loopback interface, lo1, using an address that
is anycast, let's call it 192.0.2.53/32. This address is configured as
resolver in clients. This works.

However, this particular machine is slated to go walkabout in a travel
kit to a place where it might lose its connection. We still want it to
work and keep on serving names, since some resources will be local.

Therefore, we've got a nsd instance running on the same host. The nsd is
slaving a number of the important zones we need off of the normal servers,
and we intend to use stub/forward in unbound to prefer this instance --
a lot of firewalling means we can't freely recurse from the root anyway,
so such a setup is required regardless. We're forwarding to a pair of
DMZ resolver hosts for external names, and to internal name servers for
our own stuff.

I initially tried to make nsd listen on 127.0.0.53 using an extra
loopback interface (in contrast to a statement by a PFY working at a
Swedish ISP back in the dotcom bubble days, we feel that we can afford
loopback interfaces... True story.) and it works. Half-way. I can dig
@127.0.0.53 and get excellent answers back. But unbound refuses to use
the address, and returns SERVFAIL. As soon as I make nsd listen on a
physical interface on the host and change the unbound config accordingly
so that it points to that address for forwarding/stub address, things
start working.

Is this an issue in unbound or OpenBSD (5.9)?

Bonus question: Forward or Stub? I never really got through to understand
the differences :wink:

Thanks for any pointers in this.

2

Try:

server:
do-not-query-localhost: no

Regards,

3

You'll want the following in unbound.conf:

do-not-query-localhost: no

The default is yes, and stops unbound from sending queries to anything
in 127.0.0.0/8 and ::1.

Regards,
Anand

4

Hej Måns,

Greetings,

I've got a resolve server setup, using OpenBSD, unbound, and nsd. (hence the crosspost)

The setup is as follows;

[…]

Is this an issue in unbound or OpenBSD (5.9)?

We have an almost similar setup on some of our servers, and it works fine (on Debian).
I saw others already gave the hint what’s needs to be configured for this to work.

Bonus question: Forward or Stub? I never really got through to understand
the differences :wink:

Stub is for local zone(s) in unbound (unless something changed last time I looked)
Simpler and preferred if you can use that I’d say...

The reason for us to choose forward to local nsd was that the zone(s) served
locally from nsd was updated several time from the master (the master is not under our control),
so doing timely zone transfers was a pre-req.
And forwarding allows for the use of "forward-first" option in unbound (which we use),
which allows unbound to fallback to the zone(s) served by name servers on Internet
if our local cache would fail for some reason...

Re,
/P

5

Generally it's: Stub - to an authoritative server. Forward - to
another cache/resolver.

Typically, for an internal use only authoritative server, I run NSD on
an alternate port on the loopback interface: