Menu
What's new
By:
Filters Better Search

Unbound DNSSec with unbound_manager?

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

D

dominik

Occasional Visitor
Hello,
I'm using latest merlinwrt 388.1 on AX86U with unbound manager (v3.22) and can't get DNSSec to work :(
With unbound turned on DNSSec validation is gone, please take a look at this example:

Bash: 
admin@router:/tmp/home/root# dig @192.168.1.1 +adflag example.org A

; <<>> DiG 9.18.1 <<>> @192.168.1.1 +adflag example.org A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41136
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;example.org.                   IN      A

;; ANSWER SECTION:
example.org.            14040   IN      A       93.184.216.34

;; Query time: 1 msec
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)
;; WHEN: Wed Jan 04 11:48:50 CET 2023
;; MSG SIZE  rcvd: 56

This returns answer without dnssec validation (no AD flag).

Trying same thing on google nameservers (also quad9 are ok):

Bash: 
admin@router:/tmp/home/root# dig @8.8.8.8 +adflag example.org A

; <<>> DiG 9.18.1 <<>> @8.8.8.8 +adflag example.org A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45771
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;example.org.                   IN      A

;; ANSWER SECTION:
example.org.            13696   IN      A       93.184.216.34

;; Query time: 9 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Wed Jan 04 11:48:59 CET 2023
;; MSG SIZE  rcvd: 56

Also it works when unbound is stopped:

Bash: 
admin@router:/tmp/home/root# dig @192.168.1.1 +adflag example.org A

; <<>> DiG 9.18.7 <<>> @192.168.1.1 +adflag example.org A
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56427
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;example.org.                   IN      A

;; ANSWER SECTION:
example.org.            84638   IN      A       93.184.216.34

;; Query time: 0 msec
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)
;; WHEN: Wed Jan 04 12:59:53 CET 2023
;; MSG SIZE  rcvd: 56

I noticed that unbound in it's options recommends turning off DNSSec and DNS Rebind protection:

1672834007502.png


no matter what is selected there AD flag is missing when unbound is working.
I also checked advanced options for unbound manager, also with DoT - but still AD flag with running unbound is lost :(

Anybody got it working with DNSSec?
 
No need for DNSSEC with Unbound as it works as a forwarding resolver. I believe it uses its own secure communications.
 
I am running on AC86U. Can you try to run the below command and see if you get the same similar output?

Code: 
admin@RT-AC86U-DBA8:/tmp/home/root# unbound-control get_option port
53535
admin@RT-AC86U-DBA8:/tmp/home/root# dig +dnssec -p 53535

; <<>> DiG 9.18.7 <<>> +dnssec -p 53535
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20668
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1428
;; QUESTION SECTION:
;.                              IN      NS

;; ANSWER SECTION:
.                       323476  IN      NS      i.root-servers.net.
.                       323476  IN      NS      j.root-servers.net.
.                       323476  IN      NS      k.root-servers.net.
.                       323476  IN      NS      l.root-servers.net.
.                       323476  IN      NS      m.root-servers.net.
.                       323476  IN      NS      a.root-servers.net.
.                       323476  IN      NS      b.root-servers.net.
.                       323476  IN      NS      c.root-servers.net.
.                       323476  IN      NS      d.root-servers.net.
.                       323476  IN      NS      e.root-servers.net.
.                       323476  IN      NS      f.root-servers.net.
.                       323476  IN      NS      g.root-servers.net.
.                       323476  IN      NS      h.root-servers.net.
.                       323476  IN      RRSIG   NS 8 0 518400 20230114170000 20230101160000 951 . jjT6lEOHlA/x47a2y++jVTGdYV8aJ9g4Pworcv1lHDkzQWEIX4/ie+Nk FjXfzUEWxKGXbDluX/AT1aVum48O8eYUO4gkJ1yOhz6y593t6iFWyw+G cVmVrRU8bOdAmizX6/qxjB4FIiUrepzuhko8MuZgRt5+LasuHMKBTGBu sjnBMkLBd6K6bivYGgmZ10jagUxSyfmqeJFanMcBTO5ysp+nkavxRu2r 4Y1DrGldgMKFpyyYEQK0bx4DJRAmM2Eoqvzped1OukI/7+kGSLpY5q1J vwG2T4cdv55nbcXI/lGFVkALTMCI5ubANbVA0skZN0nibI2VtHOb4tqe sHl+lw==

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53535(127.0.0.1) (UDP)
;; WHEN: Wed Jan 04 20:53:45 MYT 2023
;; MSG SIZE  rcvd: 525

You can also run this to check the query counter
Code: 
unbound-control stats_noreset | grep -F num.query.flags.AD
 
bbunge said:
No need for DNSSEC with Unbound as it works as a forwarding resolver. I believe it uses its own secure communications.
Click to expand...

One of my services checking for dnssec flags and won't start without it :( It will fail to start doing dnssec validation and script is looking exactly for this flag inside queries

chongnt said:
I am running on AC86U. Can you try to run the below command and see if you get the same similar output?
Click to expand...

trying:

Code: 
admin@router:/tmp/home/root# unbound-control get_option port
53535
admin@router:/tmp/home/root# dig +dnssec -p 53535
;; communications error to 9.9.9.9#53535: host unreachable
;; communications error to 9.9.9.9#53535: host unreachable
;; communications error to 9.9.9.9#53535: host unreachable
;; communications error to 149.112.112.112#53535: host unreachable
;; communications error to 127.0.1.1#53535: connection refused

; <<>> DiG 9.18.7 <<>> +dnssec -p 53535
;; global options: +cmd
;; no servers could be reached

this probably looks for /etc/resolv.conf nameservers (now quad9) and trying to query all of them on given port, I guess that unbound is listening on 127.0.0.1:53535 (not 127.0.1.1)

Code: 
admin@router:/tmp/home/root# dig +dnssec @127.0.0.1 -p 53535

; <<>> DiG 9.18.7 <<>> +dnssec @127.0.0.1 -p 53535
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14811
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1472
;; QUESTION SECTION:
;.                              IN      NS

;; ANSWER SECTION:
.                       516072  IN      NS      f.root-servers.net.
.                       516072  IN      NS      g.root-servers.net.
.                       516072  IN      NS      h.root-servers.net.
.                       516072  IN      NS      i.root-servers.net.
.                       516072  IN      NS      j.root-servers.net.
.                       516072  IN      NS      k.root-servers.net.
.                       516072  IN      NS      l.root-servers.net.
.                       516072  IN      NS      m.root-servers.net.
.                       516072  IN      NS      a.root-servers.net.
.                       516072  IN      NS      b.root-servers.net.
.                       516072  IN      NS      c.root-servers.net.
.                       516072  IN      NS      d.root-servers.net.
.                       516072  IN      NS      e.root-servers.net.
.                       516072  IN      RRSIG   NS 8 0 518400 20230117050000 20230104040000 951 . GCWB4LpmDiyF/elU8+NuAhg/Q6RFCHWIQTT09TOOErpP4TZbD99n7/Kw uQcR7OUcVqwpnEaIu+DSWXye5Ee1n4ZmZipsg3JISJDIj41lFsk3t5D8 IRtPJpedAvrehz7hnn4yt7F5wm5N3s5R0PyehS+B8Pxb9tIpSyzt6nB1 B0IS0zugvOTfoJ3LAEkvnKo+q/PGcykjAtm5ZIA82VsVOR+eNXeWV2vC G2Mxx5ld0A7grTEBSracozCDak4SpbQ48b5aoTiR5o9JblZdJn0diqwr 1ihBXE2DcqFPKDNqYdf5S5L6ep36CEv92SPLPhWz4dAwhVWOsOH5gJhW BawM9g==

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53535(127.0.0.1) (UDP)
;; WHEN: Wed Jan 04 14:09:12 CET 2023
;; MSG SIZE  rcvd: 525

this answer got AD flag :/
other settings:

Code: 
admin@router:/tmp/home/root# unbound-control stats_noreset | grep -F num.query.flags.RD
num.query.flags.RD=173
admin@router:/tmp/home/root# unbound-control stats_noreset | grep -F num.query.edns.DO
num.query.edns.DO=41
admin@router:/tmp/home/root# unbound-control stats_noreset | grep -F num.query.edns.present
num.query.edns.present=43

I also increased verbosity to 3 and checked that unbound receives queries (no errors):

Code: 
Jan 04 13:55:40 unbound[3965:0] query: 127.0.0.1 example.org. A IN
Jan 04 13:55:40 unbound[3965:0] debug: worker request: max UDP reply size modified (4096 to max-udp-size)
Jan 04 13:55:40 unbound[3965:0] reply: 127.0.0.1 example.org. A IN NOERROR 0.000000 1 227

Seems that unbound is responding with ad flag but only on 127.0.0.1:53535, but same thing is lost at router address :/
 
dnsmasq is likely not passing the ad flag since unbound_manager disables dnsmasq’s dnssec for caching purposes. The dnsmasq proxy-dnssec option would be handy but might not play well with the whole picture.
 
You must log in or register to reply here.

Similar threads

B
Unbound Test unbound
Replies
6
Views
958
Gary_Dexter
Gary_Dexter
M
Unbound Unable to make Unbound work
Replies
13
Views
1K
mangkoran
M
pdc
Router DNS returning Refused
Replies
2
Views
574
pdc
pdc
Don Walker
Unbound Unbound fails to resolve "epaper.ottawacitizen.com" with SERVFAIL
Replies
3
Views
2K
Don Walker
Don Walker
K
Unbound Unbound suddenly not resolving certian domains!
2 3
Replies
57
Views
6K
Khadanja
K
Similar threads
Thread starter Title Forum Replies Date
muffintastic Unbound Force all DNS requests through Unbound using iptables? Asuswrt-Merlin AddOns 14
Z Unbound Unbound + AdGuard Settings Asuswrt-Merlin AddOns 1
Z Unbound Unbound on subnet router Asuswrt-Merlin AddOns 3
B Unbound Does unbound update automatically? Asuswrt-Merlin AddOns 8
F Unbound Unbound stopped working Asuswrt-Merlin AddOns 3
B Unbound Unbound whitelist Asuswrt-Merlin AddOns 15
Jack-Sparr0w Is it possible to use nord dns with unbound or any way to add it? Asuswrt-Merlin AddOns 9
Jack-Sparr0w Guide to using vpn with unbound dns? Asuswrt-Merlin AddOns 3
B Unbound Use unbound/router as default DNS server Asuswrt-Merlin AddOns 2
B Unbound Test unbound Asuswrt-Merlin AddOns 6

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 746 (members: 22, guests: 724)
Top