<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Since writing up the issue below I have updated two systems and after a lot of experiments I have found that the best way to resolve this issue (at the moment) is in the following way:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>You can set up the interface statements to use your actual IP’s (IPV4 & IPV6) which is OK if all are static addresses. If you are using DHCP then it is possible the address will change over time. This will certainly be true if you are using a WiFi Laptop to travel.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So setting the interface: statements like this would seem to be best.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:36.0pt'>interface: 0.0.0.0 <br>interface: ::0<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The access-control: statements now look like this:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> access-control: 0.0.0.0/0 allow_snoop<o:p></o:p></p><p class=MsoNormal> access-control: 127.0.0.0/8 refuse<o:p></o:p></p><p class=MsoNormal> access-control: ::0/0 allow_snoop<o:p></o:p></p><p class=MsoNormal> access-control: ::1 refuse<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have then used an event driven task:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Microsoft-Windows-NetworkProfile_Operational_Microsoft-Windows-NetworkProfile_10000<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To run a PowerShell script that then sets the DNS servers for the adapter you want to configure it works for Ethernet and WiFi connections. You can define the name you want to use by renaming the adapter to something that makes it unique and identifiable from any others. I have not yet found a way to actually see which interface the event is derived from as the script only runs when the network interface comes up having it run several time (in my case 3) is not an issue it only sets the DNS addresses for one interface (the same one each time).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The IP Addresses to use can be obtained using:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>$IPV4 = ([string](Get-NetIPAddress -InterfaceAlias $NetworkType).IPV4Address).Trim() <br><br>$IPV6 = ([string](Get-NetIPAddress -InterfaceAlias $NetworkType -AddressState Preferred -SuffixOrigin Link -PrefixOrigin RouterAdvertisement).IPAddress).Trim()<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Where $NetworkType is the name of the adapter.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>You do have to work out a few more bits to set the address but this is essentially what I am doing and so far it is working OK. I know the system is not using other methods (as far as I can tell) to obtain DNS information as if I stop the Unbound service nothing appears to have network Access when a DNS name needs to be looked up.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I hope this helps anyone else who is struggling in this way.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I don’t know if this is a bug in Microsoft s code see:<o:p></o:p></p><p class=MsoNormal><a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-no-internet-bug-in-latest-windows-10-dev-build/">https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-no-internet-bug-in-latest-windows-10-dev-build/</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>That looks like it will be in the next build not V2004 so watch this space.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><span lang=EN-US style='mso-fareast-language:EN-GB'><br><b>Subject:</b> No Network problem - Running Unbound on Windows 10 V2004<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Since the Windows 10 V2004 update has been out and about, every time I have upgraded a system I have had issues with the networking. Windows thought that it was not connected to the internet. The little system tray icon always showed the little world icon (as I call it) to say no internet access. I could never get it to show the little TV screen icon to say networking was up and running and the internet was fully accessible.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I was made aware of this issue:<o:p></o:p></p><p class=MsoNormal><a href="https://www.bleepingcomputer.com/news/microsoft/windows-10-hosts-file-blocking-telemetry-is-now-flagged-as-a-risk/">https://www.bleepingcomputer.com/news/microsoft/windows-10-hosts-file-blocking-telemetry-is-now-flagged-as-a-risk/</a><o:p></o:p></p><p class=MsoNormal>where blocking MS telemetry IP addresses (DNS Names) via the hosts file would cause Windows Defender to complain that the hosts file had been “infected” and would return it to defaults depending on how you answered Defenders prompt. This apparently has been the case sine the end of July.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This got me thinking and I have now upgraded my desktop to V2004 again and low and behold – networking issues.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I use Macrium Reflect as backup software and that allows me to take a backup and then convert that into a VM. I did this and then played with the Unbound configuration.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>What I found was:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any reference to 127.0.0.x or ::1 for DNS entries in the Adapter configuration causes the networking to fail to detect internet access is available. I don’t know if this is intentional on MS’s behalf or a bug – time will perhaps tell.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>That said, if I changed the Adapter configuration so that it pointed to the IPV4 and IPV6 address the IPCONFIG /ALL <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> IPv6 Address. . . . . . . . . . . : :x:x:x:x(Preferred)<o:p></o:p></p><p class=MsoNormal> IPv4 Address. . . . . . . . . . . : x.x.x.x(Preferred)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>For the DNS server entries then the networking worked correctly if I also set the “interface:” and “access_control” definitions in the unbound configuration file to the same addresses<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>interface: :x:x:x:x<o:p></o:p></p><p class=MsoNormal>interface: x.x.x.x<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>&<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>access_control: :x:x:x:x allow_snoop<o:p></o:p></p><p class=MsoNormal>access_control: x.x.x.x allow_snoop<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I also commented out the references to 127.0.0.0/8 and ::1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I don’t know if anyone else is having these issues but hopefully the above will help.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I would also be VERY interested if nlnetlabs have come across this issue and how they have resolved it and if indeed it happens on anyone else’s system(s).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>RayG<o:p></o:p></p></div></body></html>