Feature: Unbound: AAAA-only mode

[maurice-w]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Is your feature request related to a problem? Please describe.

Some poorly implemented devices (IoT) do have IPv6 support, but prefer IPv4 whenever possible. These devices do perform DNS queries for A + AAAA records. If both exist, they should use IPv6, but actually use IPv4. Some devices don't even "fall back" to IPv6 in case IPv4 connections fail. The solution to this is only sending AAAA records in DNS responses, which successfully forces these devices to use IPv6.

Describe the solution you like

I would like an option in the Unbound settings which removes all A records from responses. Since this only makes sense if all host names have AAAA records, this option should only apply if DNS64 is enabled.

Additional context

This is also useful for testing which devices / applications brake if there are no A records in DNS at all.

[fichtner]

@maurice-w can you check 4bc0871 for me on top? too many variables in the config and if/else bootstrap for my taste

[maurice-w]

@fichtner Thanks for the clean-up, works fine! We don't strictly need the .= and \n here, do we?

core/src/etc/inc/plugins.inc.d/unbound.inc

Line 128 in 4bc0871

$dns64_config .= "\ndns64-prefix: {$config['unbound']['dns64prefix']}";

Same here for .=:

core/src/etc/inc/plugins.inc.d/unbound.inc

Line 131 in 4bc0871

$module_config .= 'respip ';

[fichtner]

for consistency and later additions all the conditionals should only append (and clear lines if they add full configuration lines).

[maurice-w]

Makes sense, I'll keep that in mind. Thanks!

[KDGundermann]

sorry my dumb question but I'm new to OPNsense and Unbound
but is there also an A-only mode ?
(as we use only IPv4 in our network )

[maurice-w]

@KDGundermann There is no A-only mode. What problem would that solve?