Hi,
I have a somewhat strange problem running unbound and BIND together on one Linux box (2.6.32).
BIND is listening only on the primary IP address (IPv4 and IPv6) while unbound is configured to listen on the loopack interface (127.0.0.1 and ::1) and the secondary ipv4 and ipv6 addresses.
As usual both nameserver software is using port 53 for this kind of service.I stopped the firewall at the time running the test, to made sure that the traffic is not blocked anywhere. Unbound is configured with query logging to get some feedback if a query is handled by the software or not. As I'm not willing to run an open resolver, queries are restricted to localhost and some subnets via the access-control directive.
For testing purposes I also added port 553 as listening port, so the related unbound config is like this (port 443 is filtered out):
# grep " interface:" unbound.conf | grep -v 443
interface: 127.0.0.1
interface: ::1
interface: 88.198.13.180@553
interface: 88.198.13.180@53
interface: 2a01:4f8:130:1261::180@553
interface: 2a01:4f8:130:1261::180@53
This (plus the running BIND authoritative server) results in a list of
listening udp ports (output compressed, so that it fits in a line):
# netstat -p -anu | grep 53 | cut -c1-5,21-55,80- udp 88.198.13.180:553 0.0.0.0:* 10515/unbound udp 88.198.13.180:53 0.0.0.0:* 10515/unbound udp 127.0.0.1:53 0.0.0.0:* 10515/unbound udp 88.198.13.165:53 0.0.0.0:* 10551/named udp6 2a01:4f8:130:1261:::553 :::* 10515/unbound udp6 2a01:4f8:130:1261::1:53 :::* 10515/unbound udp6 ::1:53 :::* 10515/unbound udp6 2a01:4f8:130:1261::2:53 :::* 10551/namednetstat cuts off parts of the ip address so in the third last line the host id is not ::1 but ::180.
Now sending a query from a host which subnet is allowed in the access-control directive:
$ dig -p 53 www.google.com @88.198.13.180 ; <<>> DiG 9.10.1b1 <<>> -p 53 www.google.com @88.198.13.180 ;; global options: +cmd ;; connection timed out; no servers could be reachedAt the same time I sniffed on the dns server side, and got the incoming query, but no response. Also nothing seen in the querylog of unbound.
Now I tried the same with port 553 and this works: $ dig -p 553 www.google.com @88.198.13.180 ; <<>> DiG 9.10.1b1 <<>> -p 553 www.google.com @88.198.13.180 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7336 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.google.com. IN A ;; ANSWER SECTION: www.google.com. 124 IN A 173.194.116.148 www.google.com. 124 IN A 173.194.116.147 www.google.com. 124 IN A 173.194.116.144 www.google.com. 124 IN A 173.194.116.146 www.google.com. 124 IN A 173.194.116.145 ;; Query time: 79 msec ;; SERVER: 88.198.13.180#553(88.198.13.180) ;; WHEN: Wed Aug 06 19:28:44 CEST 2014 ;; MSG SIZE rcvd: 123I also got a message in the query log and saw the incoming and outgoing packets in the trace. The same is true if I use IPv6 as transport protocol (port 53 is not working while 553 is).
Has anybody an idea why port 53 is not working?To be a bit more confused, I tried the same dig command on the server itself. Now IPv4 is working (port 53 and 553) but IPv6 is still working only on port 553 but not on port 53!
# dig -p 53 www.google.com @88.198.13.180 ; <<>> DiG 9.7.0-P1 <<>> -p 53 www.google.com @88.198.13.180 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29523 ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.google.com. IN A ;; ANSWER SECTION: www.google.com. 298 IN A 173.194.116.148 www.google.com. 298 IN A 173.194.116.145 www.google.com. 298 IN A 173.194.116.146 www.google.com. 298 IN A 173.194.116.144 www.google.com. 298 IN A 173.194.116.147 ;; Query time: 0 msec ;; SERVER: 88.198.13.180#53(88.198.13.180) ;; WHEN: Wed Aug 6 19:34:01 2014 ;; MSG SIZE rcvd: 123 # dig -p 53 www.google.com @2a01:4f8:130:1261::180 ; <<>> DiG 9.7.0-P1 <<>> -p 53 www.google.com @2a01:4f8:130:1261::180 ;; global options: +cmd ;; connection timed out; no servers could be reached Thanks for any idea/suggestion how to go further. Holger
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Unbound-users mailing list [email protected] http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users
