Project

General

Profile

Actions

Bug #10460

closed

OpenVPN does not add IPv6 prefix to unbound DNS resolver

Added by MIchael K about 2 years ago. Updated about 2 years ago.

Status:
Resolved
Priority:
Normal
Category:
DNS Resolver
Target version:
Start date:
04/15/2020
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.4.5
Affected Architecture:
amd64

Description

I added a private local IPv6 network (fd32:..../64) on the OpenVPN server setup. The idea was to avoid any real IP and simply have an internal network to mirror the 172.16 network on the IPv4 VPN. A DNS server on the OpenVPN setup included the IPv6 address of pfSense.

Whenever I do a DNS query, I was getting query refused on the IPv6 address.

It appears /var/unbound/access_lists.conf did not contain the IPv6 tunnel network the way IPv4 did.

This should be added automatically to allow resolution over the IPv6 addresses via
access-control: fd34:.../64 allow
for any network included in the IPv6 Tunnel Network for OpenVPN.

Actions #1

Updated by Viktor Gurov about 2 years ago

Fix:
https://github.com/pfsense/pfsense/pull/4276

It adds OpenVPN IPv6 Tunnel Networks and IPsec Mobile Virtual IPv6 Address Pool to the /var/unbound/access_lists.conf

Actions #2

Updated by Jim Pingle about 2 years ago

  • Status changed from New to Pull Request Review
  • Target version set to 2.5.0
Actions #3

Updated by Renato Botelho about 2 years ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Renato Botelho
  • % Done changed from 0 to 100

PR has been merged. Thanks!

Actions #4

Updated by Viktor Gurov about 2 years ago

  • Status changed from Feedback to Resolved

tested on 2.5.0.a.20200423.1513

works as expected - adds IPsec Mobile Virtual IPv6 Address Pool and OpenVPN IPv6 Tunnel Networks to /var/unbound/access_lists.conf, but (other issue), only after restarting DNS Resolver

Actions #5

Updated by Jim Pingle about 2 years ago

  • Target version changed from 2.5.0 to 2.4.5-p1
Actions #6

Updated by Jim Pingle about 2 years ago

  • Status changed from Resolved to Feedback
Actions #7

Updated by Jim Pingle about 2 years ago

  • Status changed from Feedback to Resolved

OpenVPN IPv6 tunnel network is now added to DNS Resolver ACLs automatically.

Actions

Also available in: Atom PDF