ULA is recursively not resolved

s.beimer · February 24, 2019, 8:03pm

Hi

first of all: a big thank you for this fantastic piece of software.

Second: It seems as if pihole is blocking reverse lookups on ULA addresses and marks them as bogus.
I have a pihole internaly with an unbound as upstream server with qname minimization. The router is a FritzBox and this is set for conditional forwarding of 'fritz.box' and the internal IPv4 network. This works well. But in the dashboard I have a number of ULA IPv6 reverse lookups and all are marked BOGUS.

I did a dig directly against the FritzBox and the result (name) was correct. I also tried it directly against the unbound at the NXDOMAIN result is also correct. But when I query against the pi-hole, I get a BOGUS result. I don't get it againt the unbound, which also checks DNSSEC.

Ain't it the case that, as there is no field to define it, the local ULA and there reverse lookups are not forwarded to the FritzBox with conditional forwarding? Is this only for IPv4?

Kind regards

Stefan

DanSchaper · February 24, 2019, 9:18pm

How should we implement this as a feature request?

s.beimer · February 25, 2019, 6:10pm

The feature would be to include IPv6 into conditional forwarding. That's what seems to be missing.

s.beimer · February 26, 2019, 7:46pm

Hi
thanks for the answer. I just don't want to disable the DNSSEC. Also, I'm not sure if this is the problem. For me it seems as if the conditional forwarding is only used for IPv4 reverse lookups, not for IPv6. I have a number of digs attached..

The 192.168.40.1 is the FritzBox
The 192.168.40.2 (127.0.0.1) is the Pi-Hole (53) and unbound (on 5353)

As you can see,

the A, AAAA and PTR (IPv4) are answered correctly: pi-hole -> FritzBox
the PTR (IPv6) seems not to be forwarded to the FritzBox, but instead to the unbound (and fails)

I'd like to have the conditional forwarding for IPv6 local addresses (ULA) as well.

s.beimer · February 26, 2019, 7:48pm

pi@pi-hole:~ $ dig @192.168.40.2 -p 53 pi-nc1.fritz.box

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.2 -p 53 pi-nc1.fritz.box
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13427
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;pi-nc1.fritz.box. IN A

;; ANSWER SECTION:
pi-nc1.fritz.box. 9 IN A 192.168.40.62

;; AUTHORITY SECTION:
pi-nc1.fritz.box. 9 IN NS fritz.box.

;; ADDITIONAL SECTION:
fritz.box. 9 IN A 192.168.40.1
fritz.box. 9 IN AAAA fd40::e228:6dff:fe65:3e03

;; Query time: 1 msec
;; SERVER: 192.168.40.2#53(192.168.40.2)
;; WHEN: Tue Feb 26 19:10:58 UTC 2019
;; MSG SIZE rcvd: 108

pi@pi-hole:~ $ dig @192.168.40.2 -p 5353 pi-nc1.fritz.box

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.2 -p 5353 pi-nc1.fritz.box
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

pi@pi-hole:~ $ dig @127.0.0.1 -p 5353 pi-nc1.fritz.box

; <<>> DiG 9.10.3-P4-Raspbian <<>> @127.0.0.1 -p 5353 pi-nc1.fritz.box
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 9483
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;pi-nc1.fritz.box. IN A

;; AUTHORITY SECTION:
box. 900 IN SOA a.nic.box. support.ariservices.com. 1494208759 1800 300 1814400 1800

;; Query time: 96 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Tue Feb 26 19:22:06 UTC 2019
;; MSG SIZE rcvd: 110

pi@pi-hole:~ $ dig @192.168.40.1 -p 53 pi-nc1.fritz.box

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.1 -p 53 pi-nc1.fritz.box
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59831
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;pi-nc1.fritz.box. IN A

;; ANSWER SECTION:
pi-nc1.fritz.box. 9 IN A 192.168.40.62

;; AUTHORITY SECTION:
pi-nc1.fritz.box. 9 IN NS fritz.box.

;; ADDITIONAL SECTION:
fritz.box. 9 IN A 192.168.40.1
fritz.box. 9 IN AAAA fd40::e228:6dff:fe65:3e03

;; Query time: 1 msec
;; SERVER: 192.168.40.1#53(192.168.40.1)
;; WHEN: Tue Feb 26 19:12:08 UTC 2019
;; MSG SIZE rcvd: 108

pi@pi-hole:~ $ dig @192.168.40.2 -p 53 pi-nc1.fritz.box AAAA

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.2 -p 53 pi-nc1.fritz.box AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25287
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;pi-nc1.fritz.box. IN AAAA

;; ANSWER SECTION:
pi-nc1.fritz.box. 9 IN AAAA fd40::ba27:ebff:fec8:6aec

;; AUTHORITY SECTION:
pi-nc1.fritz.box. 9 IN NS fritz.box.

;; ADDITIONAL SECTION:
fritz.box. 9 IN A 192.168.40.1
fritz.box. 9 IN AAAA fd40::e228:6dff:fe65:3e03

;; Query time: 1 msec
;; SERVER: 192.168.40.2#53(192.168.40.2)
;; WHEN: Tue Feb 26 19:24:56 UTC 2019
;; MSG SIZE rcvd: 120

pi@pi-hole:~ $ dig @127.0.0.1 -p 5353 pi-nc1.fritz.box AAAA

; <<>> DiG 9.10.3-P4-Raspbian <<>> @127.0.0.1 -p 5353 pi-nc1.fritz.box AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 21140
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;pi-nc1.fritz.box. IN AAAA

;; AUTHORITY SECTION:
box. 661 IN SOA a.nic.box. support.ariservices.com. 1494208759 1800 300 1814400 1800

;; Query time: 31 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Tue Feb 26 19:26:05 UTC 2019
;; MSG SIZE rcvd: 110

pi@pi-hole:~ $ dig @192.168.40.1 -p 53 pi-nc1.fritz.box AAAA

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.1 -p 53 pi-nc1.fritz.box AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4660
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;pi-nc1.fritz.box. IN AAAA

;; ANSWER SECTION:
pi-nc1.fritz.box. 9 IN AAAA fd40::ba27:ebff:fec8:6aec

;; AUTHORITY SECTION:
pi-nc1.fritz.box. 9 IN NS fritz.box.

;; ADDITIONAL SECTION:
fritz.box. 9 IN A 192.168.40.1
fritz.box. 9 IN AAAA fd40::e228:6dff:fe65:3e03

;; Query time: 1 msec
;; SERVER: 192.168.40.1#53(192.168.40.1)
;; WHEN: Tue Feb 26 19:25:38 UTC 2019
;; MSG SIZE rcvd: 120

pi@pi-hole:~ $ dig @192.168.40.2 -p 53 -x 192.168.40.62

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.2 -p 53 -x 192.168.40.62
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41180
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;62.40.168.192.in-addr.arpa. IN PTR

;; ANSWER SECTION:
62.40.168.192.in-addr.arpa. 9 IN PTR pi-nc1.fritz.box.

;; AUTHORITY SECTION:
62.40.168.192.in-addr.arpa. 9 IN NS fritz.box.

;; ADDITIONAL SECTION:
fritz.box. 9 IN A 192.168.40.1
fritz.box. 9 IN AAAA fd40::e228:6dff:fe65:3e03

;; Query time: 10 msec
;; SERVER: 192.168.40.2#53(192.168.40.2)
;; WHEN: Tue Feb 26 19:15:58 UTC 2019
;; MSG SIZE rcvd: 132

pi@pi-hole:~ $ dig @192.168.40.2 -p 5353 -x 192.168.40.62

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.2 -p 5353 -x 192.168.40.62
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

pi@pi-hole:~ $ dig @127.0.0.1 -p 5353 -x 192.168.40.62

; <<>> DiG 9.10.3-P4-Raspbian <<>> @127.0.0.1 -p 5353 -x 192.168.40.62
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 49342
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;62.40.168.192.in-addr.arpa. IN PTR

;; AUTHORITY SECTION:
168.192.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800

;; Query time: 0 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Tue Feb 26 19:22:49 UTC 2019
;; MSG SIZE rcvd: 114

pi@pi-hole:~ $ dig @192.168.40.1 -p 53 -x 192.168.40.62

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.1 -p 53 -x 192.168.40.62
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9240
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;62.40.168.192.in-addr.arpa. IN PTR

;; ANSWER SECTION:
62.40.168.192.in-addr.arpa. 9 IN PTR pi-nc1.fritz.box.

;; AUTHORITY SECTION:
62.40.168.192.in-addr.arpa. 9 IN NS fritz.box.

;; ADDITIONAL SECTION:
fritz.box. 9 IN A 192.168.40.1
fritz.box. 9 IN AAAA fd40::e228:6dff:fe65:3e03

;; Query time: 1 msec
;; SERVER: 192.168.40.1#53(192.168.40.1)
;; WHEN: Tue Feb 26 19:16:46 UTC 2019
;; MSG SIZE rcvd: 132

pi@pi-hole:~ $ dig @192.168.40.2 -p 53 -x fd40::ba27:ebff:fec8:6aec

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.2 -p 53 -x fd40::ba27:ebff:fec8:6aec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48544
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;c.e.a.6.8.c.e.f.f.f.b.e.7.2.a.b.0.0.0.0.0.0.0.0.0.0.0.0.0.4.d.f.ip6.arpa. IN PTR

;; Query time: 10 msec
;; SERVER: 192.168.40.2#53(192.168.40.2)
;; WHEN: Tue Feb 26 19:19:07 UTC 2019
;; MSG SIZE rcvd: 101

pi@pi-hole:~ $ dig @192.168.40.2 -p 5353 -x fd40::ba27:ebff:fec8:6aec

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.2 -p 5353 -x fd40::ba27:ebff:fec8:6aec
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

pi@pi-hole:~ $ dig @127.0.0.1 -p 5353 -x fd40::ba27:ebff:fec8:6aec

; <<>> DiG 9.10.3-P4-Raspbian <<>> @127.0.0.1 -p 5353 -x fd40::ba27:ebff:fec8:6aec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 2582
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;c.e.a.6.8.c.e.f.f.f.b.e.7.2.a.b.0.0.0.0.0.0.0.0.0.0.0.0.0.4.d.f.ip6.arpa. IN PTR

;; AUTHORITY SECTION:
d.f.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800

;; Query time: 0 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Tue Feb 26 19:20:48 UTC 2019
;; MSG SIZE rcvd: 160

pi@pi-hole:~ $ dig @192.168.40.1 -p 53 -x fd40::ba27:ebff:fec8:6aec

; <<>> DiG 9.10.3-P4-Raspbian <<>> @192.168.40.1 -p 53 -x fd40::ba27:ebff:fec8:6aec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37741
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;c.e.a.6.8.c.e.f.f.f.b.e.7.2.a.b.0.0.0.0.0.0.0.0.0.0.0.0.0.4.d.f.ip6.arpa. IN PTR

;; ANSWER SECTION:
c.e.a.6.8.c.e.f.f.f.b.e.7.2.a.b.0.0.0.0.0.0.0.0.0.0.0.0.0.4.d.f.ip6.arpa. 9 IN PTR pi-nc1.fritz.box.

;; AUTHORITY SECTION:
c.e.a.6.8.c.e.f.f.f.b.e.7.2.a.b.0.0.0.0.0.0.0.0.0.0.0.0.0.4.d.f.ip6.arpa. 9 IN NS fritz.box.

;; ADDITIONAL SECTION:
fritz.box. 9 IN A 192.168.40.1
fritz.box. 9 IN AAAA fd40::e228:6dff:fe65:3e03

;; Query time: 1 msec
;; SERVER: 192.168.40.1#53(192.168.40.1)
;; WHEN: Tue Feb 26 19:20:02 UTC 2019
;; MSG SIZE rcvd: 178

yubiuser · May 31, 2020, 9:07pm

In the pipline

github.com/pi-hole/web

Improve conditional forwarding settings

pi-hole:devel ← pi-hole:new/rev-server

opened 07:27AM - 09 Apr 20 UTC

DL6ER

+129 -58

**By submitting this pull request, I confirm the following:** - [X] I have r…ead and understood the [contributors guide](https://github.com/pi-hole/pi-hole/blob/master/CONTRIBUTING.md), as well as this entire template. - [X] I have made only one major change in my proposed changes. - [X] I have commented my proposed changes within the code. - [X] I have tested my proposed changes, and have included unit tests where possible. - [X] I am willing to help maintain this change if there are issues with it later. - [X] I give this submission freely and claim no ownership. - [X] It is compatible with the [EUPL 1.2 license](https://opensource.org/licenses/EUPL-1.1) - [X] I have squashed any insignificant commits. ([`git rebase`](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html)) --- **What does this PR aim to accomplish?:** "Conditional forwarding" can be used to tell FTL to send queries to local devices (either with a local domain) and PTR requests for private ranges to a dedicated device (typically the router of the network) instead of the configured upstreams. While this works for most users, it is not very flexible, as it implies three severe limitations (assuming the router is `10.1.2.3`): - It is limited to IPv4 - It automatically assumes a Class D network. i.e. `10.1.2.0/24`. This is often correct (typically for `192.168.x.0/24` networks, but may also be wrong! - It requires the subnet to be the same Class D network the router is in (this may be a fair assumption, however). **How does this PR accomplish the above?:** This PR aims at making conditional forwarding more flexible. - It supports IPv4 and IPv6 - It adds a dedicated box for the local subnet to be used (can be, e.g., `10.0.0.0/8` in above's example) - The router can be specified independently of the subnet, it could even be a foreign device (like "ask `13.225.3.2` for all IPs in range `10.0.0.0/8`). ![Screenshot from 2020-04-09 09-25-46](https://user-images.githubusercontent.com/16748619/78869000-25470e80-7a44-11ea-8ed9-89a02e1976d4.png) **This feature is intended for Pi-hole v5.1 to ensure we have proper time for testing once it hits `development`** **What documentation changes (if any) are needed to support this PR?:** It has to be checked whether/where we document conditional forwarding.

yubiuser · July 16, 2020, 9:14am

IPv6 conditional forwarding is implemented in v5.1
https://pi-hole.net/2020/07/15/pi-hole-5-1-released/