<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi John,<div><br></div><div>You are looking at the default local-zones.</div><div><br></div><div>from <a href="http://unbound.net/documentation/unbound.conf.html">http://unbound.net/documentation/unbound.conf.html</a></div><div><br></div><div></div><blockquote type="cite"><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">The default zones are localhost, reverse 127.0.0.1 and ::1, and the </span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">AS112 zones. The AS112 zones are reverse DNS zones for private use and</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">reserved IP addresses for which the servers on the internet cannot pro-</span><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">vide</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">correct answers. They are configured by default to give nxdomain</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">(no reverse information) answers. The defaults can be turned off by</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">specifying your own local-zone of that name, or using the 'nodefault'</span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre; ">type.</span></div></blockquote><div><font class="Apple-style-span" face="monospace" size="4"><span class="Apple-style-span" style="white-space: pre;"><br></span></font></div><div><font class="Apple-style-span" face="monospace" size="4"><span class="Apple-style-span" style="white-space: pre;">You need to remove the AS112 zone you need by adding a line to your config:</span></font></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre-wrap; "><i><br></i></span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre-wrap; "><i>local-zone: "x.y.in-addr.arpa." nodefault</i></span></div><div><span class="Apple-style-span" style="font-family: monospace; font-size: 14px; white-space: pre-wrap; "><i><br></i></span></div><div><font class="Apple-style-span" face="monospace" size="4"><span class="Apple-style-span" style="white-space: pre;">Best regards,</span></font></div><div><font class="Apple-style-span" face="monospace" size="4"><span class="Apple-style-span" style="white-space: pre;">Arni</span></font></div><div><font class="Apple-style-span" face="monospace" size="4"><span class="Apple-style-span" style="white-space: pre;"><div>Men & Mice</div></span></font></div><div><br></div><div><br><div><div>On Feb 14, 2012, at 8:14 AM, John Stäck wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hi!<br><br>I am having some issues getting unbound to do reverse-resolution of<br>RFC1918 names, in this case 10.255.0.0/16 (255.10.in-addr.arpa.).<br><br>We got unbound set up as basically a local resolver cache, the config<br>looks like this:<br><br><br>server:<br> prefetch: yes<br> num-threads: 1<br> incoming-num-tcp: 256<br> outgoing-num-tcp: 256<br> statistics-interval: 60<br><br>forward-zone:<br> name: "."<br> forward-addr: 78.31.10.86<br> forward-addr: 78.31.10.93<br><br><br>The two forward-addr IP:s are our upstream recursive resolvers (which<br>are set up to properly answer the RFC1918 stuff we need). When I ask<br>them, I get a perfectly normal answer:<br><br>$ dig @78.31.10.86 -x 10.255.1.17 +short<br>calc7.c.lon.spotify.net.<br><br>But when I ask the unbound server, I get NXDOMAIN and a strange SOA:<br>$ dig @127.0.0.1 -x 10.255.1.17<br><br>; <<>> DiG 9.7.3 <<>> @127.0.0.1 -x 10.255.1.17<br>;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1244<br>;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0<br><br>;; QUESTION SECTION:<br>;17.1.255.10.in-addr.arpa.<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>PTR<br><br>;; AUTHORITY SECTION:<br>10.in-addr.arpa.<span class="Apple-tab-span" style="white-space:pre"> </span>10800<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>SOA<span class="Apple-tab-span" style="white-space:pre"> </span>localhost. nobody.invalid. 1 3600 1200<br>604800 10800<br><br>(removed some useless extra info for brevity)<br><br><br><br>Unbound is not doing any forwarded upstream requests for the failed<br>query (according to packet traces), and one rather odd thing is that I<br>get nothing whatsoever in the log for it (no matter what verbosity). I<br>get the exact same answer for any RFC1918 address, while all other<br>queries (regular or reverse) resolve normally and show up in the log.<br>A-record lookups that return 10.X addresses work just fine, it is only<br>PTR records that do not.<br><br>I have been messing around with some other settings, such as various<br>combinations of private-address / private-domain, and setting<br>10.in-addr.arpa. as a separate forward or stub zone. In no case do I<br>see anything for those queries in the logs.<br><br>None of it works. The only way I get any answer back (except NXDOMAIN)<br>is if I specify data with local-data or local-data-ptr, but those<br>queries are not logged either.<br><br>Tested on unbound 1.4.16 on Ubuntu 11.10, as well as 1.4.14-2~bpo60+1<br>on debian squeeze with the same result.<br><br>Have I set things up incorrectly (especially with the<br>private-address/-domain)? From what I understand, not having these<br>statements should mean they are treated normally and not filtered out,<br>but it doesn't seem to make any difference to this issue. What should<br>I do to get this going? Thankful for any pointers in the right<br>direction.<br><br><br>Best regards,<br>John Stäck<br><a href="mailto:stack@spotify.com">stack@spotify.com</a><br><br>_______________________________________________<br>Unbound-users mailing list<br>Unbound-users@unbound.net<br>http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users<br></div></blockquote></div><br><div apple-content-edited="true">
<div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 12pt; "><font class="Apple-style-span" face="Arial"><span class="Apple-style-span" style="font-weight: 800;"><br></span></font></div></div></div></div></body></html>