On 02/02/2020 18:48, Matthias Leisi via mailop wrote:
From one particular IPv6 range, each and every DNS query was sent from a unique IPv6 /128, and every /128 seen was used exactly once.


Um, I do this.   To guard against cache poisoning attacks.   Each nameserver has a /64 to use for outgoing interfaces.  I thought it was pretty standard.   From years back when there was a whole panic about DNS cache poisons being much easier than everybody thought.

I'm surprised you've not seen it before.


https://nlnetlabs.nl/documentation/unbound/unbound.conf/



       *outgoing-interface:*  /<ip/  /address/  /or/  /ip6/  /netblock>/
              Interface to use to connect to the network.  This  interface  is
              used  to send queries to authoritative servers and receive their
              replies. Can be given multiple times to work on  several  inter-
              faces.  If  none  are  given  the default (all) is used. You can
              specify the same interfaces in*interface:*   and*outgoing-inter-*
              *face:*   lines,  the  interfaces  are then used for both 
purposes.
              Outgoing queries are sent via a  random  outgoing  interface  to
              counter spoofing.

              If  an  IPv6 netblock is specified instead of an individual IPv6
              address, outgoing UDP  queries  will  use  a  randomised  source
              address  taken  from  the netblock to counter spoofing. Requires
              the IPv6 netblock to be routed to the host running unbound,  and
              requires  OS support for unprivileged non-local binds (currently
              only supported on Linux). Several  netblocks  may  be  specified
              with  multiple*outgoing-interface:*   options, but do not specify
              both an individual IPv6 address and an  IPv6  netblock,  or  the
              randomisation will be compromised.  Consider combining with*pre-*
              *fer-ip6:*  *yes*  to increase  the  likelihood  of  IPv6  
nameservers
              being  selected  for  queries.  On Linux you need these two com-
              mands to be able to use the freebind socket  option  to  receive
              traffic  for  the ip6 netblock: ip -6 addr add mynetblock/64 dev
              lo && ip -6 route add local mynetblock/64 dev lo

_______________________________________________
mailop mailing list
[email protected]
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Reply via email to