On 02/02/2020 18:48, Matthias Leisi via mailop wrote:
From one particular IPv6 range, each and every DNS query was sent from a unique IPv6 /128, and every /128 seen was used exactly once.
Um, I do this. To guard against cache poisoning attacks. Each nameserver has a /64 to use for outgoing interfaces. I thought it was pretty standard. From years back when there was a whole panic about DNS cache poisons being much easier than everybody thought.
I'm surprised you've not seen it before. https://nlnetlabs.nl/documentation/unbound/unbound.conf/ *outgoing-interface:* /<ip/ /address/ /or/ /ip6/ /netblock>/ Interface to use to connect to the network. This interface is used to send queries to authoritative servers and receive their replies. Can be given multiple times to work on several inter- faces. If none are given the default (all) is used. You can specify the same interfaces in*interface:* and*outgoing-inter-* *face:* lines, the interfaces are then used for both purposes. Outgoing queries are sent via a random outgoing interface to counter spoofing. If an IPv6 netblock is specified instead of an individual IPv6 address, outgoing UDP queries will use a randomised source address taken from the netblock to counter spoofing. Requires the IPv6 netblock to be routed to the host running unbound, and requires OS support for unprivileged non-local binds (currently only supported on Linux). Several netblocks may be specified with multiple*outgoing-interface:* options, but do not specify both an individual IPv6 address and an IPv6 netblock, or the randomisation will be compromised. Consider combining with*pre-* *fer-ip6:* *yes* to increase the likelihood of IPv6 nameservers being selected for queries. On Linux you need these two com- mands to be able to use the freebind socket option to receive traffic for the ip6 netblock: ip -6 addr add mynetblock/64 dev lo && ip -6 route add local mynetblock/64 dev lo
_______________________________________________ mailop mailing list [email protected] https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
