Feature #16534
closed
Omit reserved NAT64 addresses from DNS64 answers
100%
Description
We create default filter rules to prevent the NAT64 translation for reserved IPv4 addresses. For example, a request to 64:ff9b::a00:1 will not be translated to 10.0.0.1. These rules are required for RFC compliance. Though the translation itself is prevented, DNS64 replies with the translated reserved address. This results in unnecessary traffic and potential timeouts for the client. To resolve this, we can use the respip unbound module to omit these reserved addresses from the answer to client AAAA queries.
Related issues
Updated by Marcos M 9 months ago
- Status changed from New to Needs Patch
This needs addressed first: https://github.com/NLnetLabs/unbound/issues/1373
Updated by Marcos M 7 months ago
- Related to Feature #16615: Omit NAT64 address for queries from the firewall itself added
Updated by Marcos M about 1 month ago
- Related to Todo #16848: Update Unbound added
Updated by Marcos M about 1 month ago
- Status changed from Resolved to Confirmed
This has regressed because it relied on a local patch that was lost with the unbound update from #16615.
Updated by Marcos M about 1 month ago
- Status changed from Confirmed to Resolved
The patch has been restored and unbound has been updated for versions >=26.03.