graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

resolvers: enable IPv6 in unbound (listen, do-ip6, access-control)

Browse source 
Listen on ::0, set do-ip6: yes for IPv6 upstream resolution, and add
IPv6 access-control: default-deny ::0/0, allow ::1 and the VNTX
2606:1c80::/32 allocation.
This commit is contained in:
Graham McIntire 2026-05-14 09:04:22 -05:00
parent 5443e75d70
commit 1612910654
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ansible/roles/resolvers/templates/unbound.conf.j2
View file

@ -59,6 +59,7 @@ server:
# interface: 2001:DB8::5
# interface: eth0@5003
interface: 0.0.0.0
interface: ::0
# enable this feature to copy the source address of queries to reply.
# Socket options are not supported on all platforms. experimental.
@ -252,7 +253,7 @@ server:
do-ip4: yes
# Enable IPv6, "yes" or "no".
do-ip6: no
do-ip6: yes
# If running unbound on an IPv6-only host, domains that only have
# IPv4 servers would become unresolveable. If NAT64 is available in
@ -326,6 +327,9 @@ server:
access-control: 172.1.0.0/15 allow
access-control: 100.64.0.0/10 allow
access-control: 216.180.128.0/20 allow
access-control: ::0/0 refuse
access-control: ::1 allow
access-control: 2606:1c80::/32 allow
# tag access-control with list of tags (in "" with spaces between)
# Clients using this access control element use localzones that