Solved local-unbound does not query local authoritative DNS server for reverse queries

skhal

skhal

I have a jail with 2 DNS servers:

- authoritative DNS bind20 on 10.0.0.2@5353 to run DNS resolution for the local network
- local-unbound on localhost@53 with stub-zones (forward + reverse) to the authoritative server + forward for the rest

Code: 
freebsd 15.1 op@dns:~ % doas sockstat -4lp5353
USER COMMAND      PID  FD PROTO LOCAL ADDRESS         FOREIGN ADDRESS     
bind named      88591 154 udp4  10.0.0.2:5353         *:*                 
bind named      88591 155 udp4  10.0.0.2:5353         *:*                 
bind named      88591 156 udp4  10.0.0.2:5353         *:*                 
bind named      88591 157 udp4  10.0.0.2:5353         *:*                 
bind named      88591 158 udp4  10.0.0.2:5353         *:*                 
bind named      88591 159 udp4  10.0.0.2:5353         *:*                 
bind named      88591 160 udp4  10.0.0.2:5353         *:*                 
bind named      88591 161 udp4  10.0.0.2:5353         *:*                 
bind named      88591 162 udp4  10.0.0.2:5353         *:*                 
bind named      88591 163 udp4  10.0.0.2:5353         *:*                 
bind named      88591 164 udp4  10.0.0.2:5353         *:*                 
bind named      88591 165 udp4  10.0.0.2:5353         *:*                 
bind named      88591 166 udp4  10.0.0.2:5353         *:*                 
bind named      88591 167 udp4  10.0.0.2:5353         *:*                 
bind named      88591 168 udp4  10.0.0.2:5353         *:*                 
bind named      88591 169 udp4  10.0.0.2:5353         *:*                 
bind named      88591 170 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 171 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 172 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 173 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 174 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 175 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 176 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 177 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 178 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 179 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 180 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 181 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 182 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 183 tcp4  10.0.0.2:5353         *:*                 
bind named      88591 184 tcp4  10.0.0.2:5353         *:*

freebsd 15.1 op@dns:~ % doas sockstat -4lp53
USER    COMMAND      PID FD PROTO LOCAL ADDRESS         FOREIGN ADDRESS     
unbound local-unbo 72353  3 udp4  127.0.0.1:53          *:*                 
unbound local-unbo 72353  4 tcp4  127.0.0.1:53          *:*

local-unbound configuration is:

Code: 
freebsd 15.1 op@dns:~ % cat /etc/unbound/unbound.conf
server:
    # keep-sorted start
    access-control: 127.0.0.0/8 allow
    do-ip6: no
    interface: 127.0.0.1
    logfile: /var/unbound/unbound.log
    pidfile: /var/run/local_unbound.pid
    prefetch: yes
    verbosity: 3
    # keep-sorted end

# local_unbound uses local-unbound-control to check status:
# https://github.com/freebsd/freebsd-src/blob/750d429a228fb102d6e5d45bdc116489acbfff00/libexec/rc/rc.d/local_unbound#L111
remote-control:
    control-enable: yes
    control-interface: 127.0.0.1
    control-use-cert: no
stub-zone:
    name: "lab.net"
    stub-addr: "10.0.0.2@5353"

stub-zone:
    name: "10.in-addr.arpa."
    stub-addr: "10.0.0.2@5353"

forward-zone:
    name: "."
    forward-addr: "192.168.10.1"

Both DNS resolvers are up and running:

Code: 
freebsd 15.1 op@dns:~ % doas ps -Adj | grep -E '(unbound|bind)'
unbound 72353     1 72353 72353    0 IsJ   -  0:00.01 /usr/sbin/local-unbound -c /var/unbound/unbound.conf
bind    88591     1 88591 88591    0 IsJ   -  0:00.08 /usr/local/sbin/named -u bind -c /usr/local/etc/namedb/named.conf
op      91301 81528 91164 35550    2 S+J   0  0:00.00 `-- grep -E (unbound|bind)

Lookups via authoritative server run fine:

Code: 
freebsd 15.1 op@dns:~ % drill -Q -p 5353 nuc.lab.net @10.0.0.2
10.0.0.1
freebsd 15.1 op@dns:~ % drill -Q -p 5353 -x 10.0.0.1 @10.0.0.2
nuc.lab.net.

A forward lookup works via local-unbound:

Code: 
freebsd 15.1 op@dns:~ % drill -Q -p 53 nuc.lab.net @127.0.0.1
10.0.0.1

The reverse lookup does not work via local-unbound:

Code: 
freebsd 15.1 op@dns:~ % drill -p 53 -x 10.0.0.1 @127.0.0.1
;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 43363
;; flags: qr aa rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;; 1.0.0.10.in-addr.arpa.    IN    PTR

;; ANSWER SECTION:

;; AUTHORITY SECTION:
10.in-addr.arpa.    10800    IN    SOA    localhost. nobody.invalid. 1 3600 1200 604800 10800

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; SERVER: 127.0.0.1
;; WHEN: Mon Jul 13 14:30:21 2026
;; MSG SIZE  rcvd: 98

It is expected that local-unbound would use authoritative DNS server 10.0.0.2@5353 for the reverse lookups. What is missing in the setup?
 
It looks like the local_unbound configuration needed server.local-zone configuration parameter set:

Code: 
server:
    ...
    local-zone: "10.in-addr.arpa." always_transparent
    ...
 
You must log in or register to reply here.
Back
Top