Project

General

Profile

Bug #7884

Unbound refusing non-recursive/iterative queries even from localhost

Added by Kill Bill 3 months ago. Updated 2 months ago.

Status:
Resolved
Priority:
Low
Assignee:
-
Category:
DNS Resolver
Target version:
Start date:
09/21/2017
Due date:
% Done:

0%

Affected Version:
All
Affected Architecture:
All

Description

This is so much secure that it's annoying and getting in the way of normal work for not exactly any good reason.

# dig www.google.com +trace

; <<>> DiG 9.11.2 <<>> www.google.com +trace
;; global options: +cmd
;; Received 12 bytes from 127.0.0.1#53(127.0.0.1) in 0 ms

Wonderful and very "useful". So what's really going on is this:

# dig ns . +norecur

; <<>> DiG 9.11.2 <<>> ns . +norecur
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 57656
;; flags: qr ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Sep 21 16:40:09 CEST 2017
;; MSG SIZE  rcvd: 12

Suggested fix for more useful default ACLs for localhost available @ https://github.com/pfsense/pfsense/pull/3826

History

#1 Updated by Jim Pingle 3 months ago

  • Status changed from New to Confirmed

PR looks good and the change lets dig +trace and drill -T work locally.

#2 Updated by James Dekker 2 months ago

On pfSense-netgate-memstick-ADI-2.4.1-DEVELOPMENT-amd64-20171016-1127.img "dig google.com +trace" and "drill -T google.com" both succeed.

#3 Updated by Jim Pingle 2 months ago

  • Status changed from Confirmed to Resolved

Also available in: Atom PDF