This is a follow-up question to my earlier question. Below is the /etc/unbound/unbound.conf
file:
# unbound.conf(5) config file for unbound(8).
server:
directory: "/etc/unbound"
username: "unbound"
chroot: ""
logfile: "/etc/unbound/unbound.log"
pidfile: "/etc/unbound/unbound.pid"
verbosity: 1
# listen on all interfaces and answer queries from the local port 3000.
interface: 0.0.0.0
interface: ::0
port: 3000
access-control: 10.0.0.0/8 allow
#access-control: 2001:DB8::/64 allow
With unbound.service
started, I tried to dig
a domain via the local unbound server:
root@DNS:/etc/unbound# dig example.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 8367
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 0 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 16:18:19 UTC 2024
;; MSG SIZE rcvd: 12
I don't understand why WARNING: recursion requested but not available
as unbound is configured to be a recursive resolver by default. Also. SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
shows that unbound was used, however, it failed to get the domain. What is wrong and how do I fix this issue?
Below shows the answer via systemd-resolved.service
stub server:
root@DNS:/etc/unbound# dig example.com
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36356
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 3304 IN A 93.184.215.14
;; Query time: 12 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue Oct 29 16:43:59 UTC 2024
;; MSG SIZE rcvd: 56
Update:
After correcting the subnet as mentioned by @mpboden answer, the dig
command only worked once. Why is this the case?
root@DNS:/etc/unbound/unbound.conf.d# systemctl start unbound.service
root@DNS:/etc/unbound/unbound.conf.d# [1730230920] unbound[5780:0] notice: init module 0: subnetcache
[1730230920] unbound[5780:0] notice: init module 1: validator
[1730230920] unbound[5780:0] notice: init module 2: iterator
[1730230921] unbound[5780:0] info: start of service (unbound 1.19.2).
root@DNS:/etc/unbound/unbound.conf.d# dig example.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40273
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 3600 IN A 93.184.215.14
;; Query time: 712 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 19:42:34 UTC 2024
;; MSG SIZE rcvd: 56
root@DNS:/etc/unbound/unbound.conf.d# dig google.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> google.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 49774
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 0 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 19:42:56 UTC 2024
;; MSG SIZE rcvd: 12
root@DNS:/etc/unbound/unbound.conf.d# dig example.com A @192.168.1.50 -p 3000
; <<>> DiG 9.18.28-0ubuntu0.24.04.1-Ubuntu <<>> example.com A @192.168.1.50 -p 3000
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 46236
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 0 msec
;; SERVER: 192.168.1.50#3000(192.168.1.50) (UDP)
;; WHEN: Tue Oct 29 19:43:36 UTC 2024
;; MSG SIZE rcvd: 12
I see that you defined the following:
access-control: 10.0.0.0/8 allow
But your subnet is
192.168.1.0/24
. Change this line to:access-control: 192.168.1.0/24 allow
This will allow unbound to accept DNS queries from the 192.168.1.0/24 network.