<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Rod,</p>
On 11/10/2019 23:35, rod--- via Unbound-users wrote:<br>
<blockquote type="cite"
cite="mid:fc4ebcfb9d17433fae295ecdd3ed6985@strumbel.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div style="font-family: arial; font-size: 12px;">
<div><br>
</div>
<div>Here is my scenario...</div>
<div><br>
</div>
<div>I use untangle as my firewall and typically utilize its DNS
server static entries for routing DNS on my home LAN to get to
servers by private IP and then let my domains public DNS
manage everything from the outside world.</div>
</div>
</blockquote>
<p><br>
</p>
<p>Your config entry for the local-zone is wrong. There are several
options for the local-zone you can use. It defaults to 'static'
that gives not found for records not listed in the zone.</p>
<p>local-zone: "strumbel.com" transparent</p>
<p>That would use the local data entries, but if there is no
local-data entry try to look it up upstream. That seems to be
what you want.</p>
<p>In the example config and man page there is a longer list of
possibilities for the local-zone depending on what you want
(refusal, logging). If you decide to use a separate namespace for
that set of machines as Andreas suggests, a local-zone of type
static may be easier, as it denies other names in that namespace.<br>
</p>
<p>Best regards, Wouter<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:fc4ebcfb9d17433fae295ecdd3ed6985@strumbel.com">
<div style="font-family: arial; font-size: 12px;">
<div><br>
</div>
<div>This past week I decided to setup a home lab where I will
want to access a different set of machines by the same names
as what are already registered in Untangle... BUT at different
IPs from those machines the other users in my LAN would access
them from.</div>
<div> Example:</div>
<div> Typical config: <a href="//iis.strumbel.com"
target="_blank" moz-do-not-send="true">iis.strumbel.com</a>
is at 192.168.1.200</div>
<div> In my test env: <a href="//iis.strumbel.com"
target="_blank" moz-do-not-send="true">iis.strumbel.com</a>
needs to be at 192.168.1.171</div>
<div><br>
</div>
<div>Unbound seemed the ideal solution, spun up a Centos 7 vm,
installed Unbound and configured my test machines into the
local-zone utilizing local-data commands. And pointed a
forward-addr at my Untangle box. Pretty neat and as long as I
am querying for items either in the local-data, or items not
managed by Untangle all works fine.</div>
<div><br>
</div>
<div>The issue comes when I try to query for an item that is NOT
in my local-data but IS in the Untangle DNS entries.</div>
<div>Those come back NOT FOUND.</div>
<div> Example:</div>
<div> <a href="//iis.strumbel.com" target="_blank"
moz-do-not-send="true">iis.strumbel.com</a> is managed by
unbound via local-data: "iis.strumbel.com. IN A
192.168.1.171" this works fine</div>
<div> <a href="//webmail.strumbel.com" target="_blank"
moz-do-not-send="true">webmail.strumbel.com</a> is
managed by untangle this cannot be found</div>
<div> <a target="_blank" href="http://www.crunch.com"
moz-do-not-send="true">www.crunch.com</a> is not managed
by either this works fine</div>
<div><br>
</div>
<div><br>
</div>
<div>Thinking maybe it was an issue with how Untangle handles
DNS, spun up another Centos vm and installed BIND in its most
basic form and added a zone for my domain and entered the same
records Untangle was managing and then pointed by Unbound
forward-addr to this new BIND box instead. Same results.
local-data items: OK, items not maintained in BIND: OK, items
NOT in local-data but are in BIND: NOT FOUND.</div>
<div><br>
</div>
<div>Tells me I must have screwed up something in my Unbound
config:</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>server:<br>
<br>
# verbosity number, 0 is least verbose. 1 is default.<br>
verbosity: 1<br>
<br>
# answer queries for this interface 0.0.0.0 says ALL
interfaces<br>
interface: 0.0.0.0<br>
<br>
# what port are we listening on - needs to be opened up in the
firewall<br>
port: 53<br>
<br>
# turn on ipv4 turn off ipv6 queries<br>
do-ip4: yes<br>
do-ip6: no<br>
<br>
# turn on udp and tcp querying - don't forget to open in the
firewall<br>
do-udp: yes<br>
do-tcp: yes<br>
<br>
# what client ips can access utilize the results of this dns
server<br>
access-control: 192.168.1.0/24 allow<br>
access-control: 127.0.0.1/32 allow<br>
<br>
# hide hacking information from anyone accessing the server<br>
hide-identity: yes<br>
hide-version: yes<br>
<br>
# this helps avoid spoofing attempts<br>
harden-glue: yes<br>
harden-dnssec-stripped: yes<br>
<br>
# upper and lower bounds for TTL<br>
cache-min-ttl: 3600<br>
cache-max-ttl: 14400</div>
<div><br>
</div>
<div># prefetch<br>
prefetch: yes<br>
<br>
# Optimization parameters<br>
num-threads: 4<br>
msg-cache-slabs: 8<br>
rrset-cache-slabs: 8<br>
infra-cache-slabs: 8<br>
key-cache-slabs: 8<br>
rrset-cache-size: 256m<br>
msg-cache-size: 128m<br>
so-rcvbuf: 1m<br>
unwanted-reply-threshold: 10000<br>
val-clean-additional: yes<br>
<br>
# avoid rebinding attacks<br>
private-address: 192.168.1.0/24<br>
<br>
# here is what allows us to OVERRIDE DNS settings<br>
private-domain: "DNS.OVERRIDES"<br>
do-not-query-localhost: no<br>
<br>
# here are our overrides!<br>
local-zone: "DNS.OVERRIDES." static<br>
# forward OVERRIDE records<br>
local-data: "iis.strumbel.com. IN A 192.168.1.171"<br>
local-data: "sm.strumbel.com. IN A 192.168.1.171"<br>
local-data: "rodsmachine.strumbel.com. IN A 192.168.1.98"<br>
# reverse OVERRIDE records<br>
local-data-ptr: "192.168.1.171 apps.strumbel.com"<br>
local-data-ptr: "192.168.1.98 rodsmachine.strumbel.com"<br>
<br>
# and where do we go if records are not overridden above?<br>
forward-zone:<br>
name: "."<br>
forward-addr: 192.168.1.238</div>
<div># The below was the setting to talk to untangle as the DNS
forward - same issue as the above which is a temporarily setup
BIND server</div>
<div># forward-addr: 192.168.1.1<br>
<br>
## END OF CONFIG FILE</div>
<div><br>
</div>
<div><br>
</div>
<div>Anyone have any ideas?</div>
<div><br>
</div>
<div>Rod</div>
</div>
</blockquote>
</body>
</html>