I have installed and run unbound on two bare metal colocated FreeBSD servers for years now. When I transitioned from running BIND (which operated simultaneously as an authoritative and a recursive lookup server) to NSD and Unbound, I was faced with running both daemons needing to run on one machine, but independently answer queries on port 53. The colocated boxes have a /29 so the simplest solution was to run NSD on the host and a copy of Unbound in a jail with a 2nd IP address. I remember setup being pretty straightforward and this has worked fine for quite sometime.
Early on with these bare metal servers, I made the mistake of trying to use FreeBSD’s built-in local_unbound as a lookup server available for outside queries (albeit constrained to certain IP blocks I would be making outside queries from). I soon discovered local_unbound was a scaled-down version of unbound and was not really meant to be used for outside queries. It’s really just meant to be used by the server to do lookups itself. But again, in the end, running a stock version of unbound in a jail worked fine.
Now I am trying to run unbound in my home on my LAN. I have a Windows 10 machine as a host running Virtualbox as the hypervisor with FreeBSD 12 in a VM. We’ll call this FreeBSD VM freebsd.mylan.local henceforth.
In Virtualbox, I configured the freebsd.mylan.local VM to have one *bridged* virtual network adapter. Within FreeBSD, it appeared as em0 and I hardcoded it a LAN IP of 192.168.1.150.
I then created a jail called lookup.mylan.local with an IP of 192.168.1.151. When starting the jail (using ezjail-admin), I found that the jail’s IP had been bound to the one adapter (em0). When I ran ifconfig on freebsd.mylan.local, as long as the jail is running, the jail IP appeared just below the VM’s main IP, similar to if I had manually added an alias IP to /etc/rc.conf. This is also how it shows on my bare metal colos:
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=8009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,LINKSTATE> ether ab:cd:ef:01:02:03 inet 192.168.1.150 netmask 0xffffff00 broadcast 192.168.1.255 inet 18.104.22.168 netmask 0xffffffff broadcast 192.168.1.151 nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL> media: Ethernet autoselect (1000baseT <full-duplex>) status: active
Within the jail, I used pkg install to install a stock version of unbound. I downloaded root.hints and started the unbound service. I confirmed the unbound service was running with *service unbound status* and *ps auxw | grep unbound*.
I then used pkg to install bind-tools, so I could use nslookup for testing. When I ran nslookup from within the jail itself, I get:
root@lookup:~ # nslookup > server 192.168.1.151 Default server: 192.168.1.151 Address: 192.168.1.151#53 > amiga.com Server: 192.168.1.151 Address: 192.168.1.151#53 ** server can't find amiga.com: REFUSED > server 127.0.0.1 Default server: 127.0.0.1 Address: 127.0.0.1#53 > amiga.com ;; reply from unexpected source: 192.168.1.151#53, expected 127.0.0.1#53 ;; reply from unexpected source: 192.168.1.151#53, expected 127.0.0.1#53 ;; reply from unexpected source: 192.168.1.151#53, expected 127.0.0.1#53 ;; connection timed out; no servers could be reached
If I make the same query from freebsd.mylan.local, I get the same failures.
BTW even with verbosity set to 5, if I tail my log file, nothing shows up in the logs when attempting these queries.
So then I went back out to Virtualbox’s settings and created a second virtual network adapter, also in bridged mode. Then on freebsd.mylan.local I edited this line in /usr/local/etc/ezjail/lookup_mylan.local:
I then restarted the jail and confirmed unbound was watching. ifconfig now looked like this:
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=81009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWFILTER> ether 08:00:27:49:50:47 inet 192.168.1.150 netmask 0xffffff00 broadcast 192.168.1.255 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL> em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=81009b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,VLAN_HWFILTER> ether 08:00:27:4a:e7:fd inet 192.168.1.151 netmask 0xffffffff broadcast 192.168.1.151 media: Ethernet autoselect (1000baseT <full-duplex>) status: active nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
However I ran the same nslookup queries again and get the same failures. Would appreciate any input because I am now stumped.
In the meantime here are my config files: