[Bug 196138] Unbound fails with 2(SERVFAIL) when behind NAT

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=196138

--- Comment #3 from christop at physik.tu-berlin.de ---
Yes and no.
No, because the default installation fails.
I booted FreeBSD-10.2-PRERELEASE-amd64-20150704-r285132-bootonly.iso and made
an network install. Unbound is of version 1.4.22.

I do not think this a problem with the unbound software, but with the unbound
configuration or DNSSEC in general.
In the default configuration with dnssec unbound tries to get the DNSSEC public
keys from the upstream nameserver, but the upstram nameserver does not deliver.
Without public keys unbound cannot do validate the domain and fails.
This behaviour is correct, because otherwise any attacker could disable DNSSEC.

Yes, when I edit my /etc/resolv.conf

root at freebsd:~ # cat /etc/resolv.conf
search home
nameserver 8.8.8.8
options edns

and run

root at freebsd:~ # /etc/rc.d/local_unbound setup
Performing initial setup.
Extracting forwarders from /etc/resolv.conf.
original /var/unbound/forward.conf saved as
/var/unbound/forward.conf.20150725.174438
/var/unbound/lan-zones.conf not modified
/var/unbound/unbound.conf not modified
/etc/resolvconf.conf not modified
original /etc/resolv.conf saved as /etc/resolv.conf.20150725.174438

and then unbound config looks like

root at freebsd:~ # cat /etc/unbound/forward.conf
# Generated by local-unbound-setup
# Do not edit this file.
forward-zone:
        name: .
        forward-addr: 8.8.8.8

After an restart of unbound 
root at freebsd:~ # /etc/rc.d/local_unbound restart

unbound resolves hosts:

root at freebsd:~ # host google.com
google.com has address 216.58.213.46
google.com has IPv6 address 2a00:1450:4008:800::1007
google.com mail is handled by 10 aspmx.l.google.com.
google.com mail is handled by 40 alt3.aspmx.l.google.com.
google.com mail is handled by 20 alt1.aspmx.l.google.com.
google.com mail is handled by 30 alt2.aspmx.l.google.com.
google.com mail is handled by 50 alt4.aspmx.l.google.com.

When you are using DHCP, it will overwrite /etc/resolv.conf and unbound will be
back to use the DHCP provided DNS Server.

In short:
Correctly configured Unbound works for me. Default configuration does not work.
DNSSEC by design does not work with forward nameserver, which does not answer
for public DNSSEC keys. This should be mentioned somewhere explicitly, because
in my opinion the most SOHO devices do not run a DNSSEC aware DNS Server.

-- 
You are receiving this mail because:
You are the assignee for the bug.